User's Guide

Part 1 – Installing and Configuring ElastiFlow and Elastic Stack
212 of 218
sudo mv 20_filter_40_sflow.logstash.conf 20_filter_40_
sflow.logstash.conf.disabled;
8. To prevent packet drops:
sudo cp -arv /usr/local/src/elastiflow-3.4.2/sysctl.d/87-
elastiflow.conf /etc/sysctl.d/.
To apply sysctl changes without restart:
sudo sysctl --system
9. Set up Kibana index patterns.
a. Download
https://github.com/robcowart/elastiflow/archive/v3.4.2.tar.gz to the
computer that you will use to view ElastiFlow.
b. Extract the files to a temporary directory.
c. In the web browser, go to http://YOUR_KIBANA_SERVER_IP:5601.
d. In the Kibana UI, select Management on the left side of the screen and then Saved Objects.
e. Click Import.
f. Select elastiflow-3.4.2\kibana\elastiflow.kibana.6.7.x.json.
g. Click Import.
10. Start Logstash:
a.
sudo /usr/share/logstash/bin/system-install
sudo systemctl daemon-reload
sudo systemctl start logstash
b. Run sudo tail -f /var/log/logstash/logstash-plain.log to see
messages from Logstash.
It is normal to see info messages such as the following in the log:
[INFO ][logstash.config.source.local.configpathloader] No
config files found in path
{:path=>"/etc/logstash/conf.d/*.conf"}
Depending on your system, it can take a few minutes for Logstash to start
up. When it starts, you should see a message that says: Successfully
started Logstash API endpoint.
11. Go to
https://github.com/robcowart/elastiflow/blob/master/INSTALL.md
and perform “Recommended Kibana Advanced Settings.”