Not able to expose elasticsearch port 9200 externally(outside docker) and connect #556
Labels
custom build
Using the HELK with settings that have not been tested or recommended yet
Comments
|
you can use nginx to "expose" port 9200 to forward to elasticsearch |
|
Thank you for replying Nate.
Do you have any guidance/notes on how to do this?
From: Nate Guagenti ***@***.***>
Sent: Wednesday, April 28, 2021 2:24 AM
To: Cyb3rWard0g/HELK ***@***.***>
Cc: Ashish Gupta ***@***.***>; Author ***@***.***>
Subject: Re: [Cyb3rWard0g/HELK] Not able to expose elasticsearch port 9200 externally(outside docker) and connect (#556)
you can use nginx to "expose" port 9200 to forward to elasticsearch
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub<#556 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAH5JU4K2FOL5ANI2KI7KMLTK6SWZANCNFSM43Q5JZAA>.
|
|
I just checked one of your configs, and I see you modifying the docker config file and adding port 9200 to it, but you added it to the logstash service and not Elasticsearch. can you verify that please @ashishmgupta ? thank you!
|
Cyb3rWard0g
added
the
custom build
|
Thank you.
What would be the name of the elasticsearch file so I can make the change there?
Thanks and Regards,
Ashish Gupta
…________________________________
From: Roberto Rodriguez ***@***.***>
Sent: Sunday, May 9, 2021 12:14:37 AM
To: Cyb3rWard0g/HELK ***@***.***>
Cc: Ashish Gupta ***@***.***>; Mention ***@***.***>
Subject: Re: [Cyb3rWard0g/HELK] Not able to expose elasticsearch port 9200 externally(outside docker) and connect (#556)
I just checked one of your configs, and I see you modifying the docker config file and adding port 9200 to it, but you added it to the logstash service and not Elasticsearch. can you verify that please @ashishmgupta<https://github.com/ashishmgupta> ? thank you!
[image]<https://user-images.githubusercontent.com/9653181/117560403-77010480-b05b-11eb-9d35-e75ced6a5ad7.png>
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub<#556 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAH5JU3YJH4SYRDC6TJKRSLTMYD23ANCNFSM43Q5JZAA>.
|
|
Ah. I realized it would be same file but elasticsearch section and add a port section to it with 9200. Will give that a shot.
Thanks and Regards,
Ashish Gupta
…________________________________
From: Ashish Gupta ***@***.***>
Sent: Sunday, May 9, 2021 8:26:26 AM
To: Cyb3rWard0g/HELK ***@***.***>; Cyb3rWard0g/HELK ***@***.***>
Cc: Mention ***@***.***>
Subject: Re: [Cyb3rWard0g/HELK] Not able to expose elasticsearch port 9200 externally(outside docker) and connect (#556)
Thank you.
What would be the name of the elasticsearch file so I can make the change there?
Thanks and Regards,
Ashish Gupta
________________________________
From: Roberto Rodriguez ***@***.***>
Sent: Sunday, May 9, 2021 12:14:37 AM
To: Cyb3rWard0g/HELK ***@***.***>
Cc: Ashish Gupta ***@***.***>; Mention ***@***.***>
Subject: Re: [Cyb3rWard0g/HELK] Not able to expose elasticsearch port 9200 externally(outside docker) and connect (#556)
I just checked one of your configs, and I see you modifying the docker config file and adding port 9200 to it, but you added it to the logstash service and not Elasticsearch. can you verify that please @ashishmgupta<https://github.com/ashishmgupta> ? thank you!
[image]<https://user-images.githubusercontent.com/9653181/117560403-77010480-b05b-11eb-9d35-e75ced6a5ad7.png>
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub<#556 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAH5JU3YJH4SYRDC6TJKRSLTMYD23ANCNFSM43Q5JZAA>.
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the problem
I'm trying to send logs from the Office 365 using the o365 filebeat to the ElasticSearch.
Filebeat gets the data from o365 but not able to send to ElasticSearch and shows below error
Failed to connect to backoff(elasticsearch(http://localhost:9200)): Get "http://localhost:9200": EOFI added 9200:9200 to the docker config files so It could be exposed externally outside docker.
helk-kibana-analysis-alert-basic.yml
helk-kibana-analysis-basic.yml
helk-kibana-notebook-analysis-alert-basic.yml
helk-kibana-notebook-analysis-basic.yml
and then composed docker for each file.
docker-compose -f docker/<config> up --build -dAfter composing the docker using one file, I would test the filebeat using
filebeat -eand It would give me the same error
Failed to connect to backoff(elasticsearch(http://localhost:9200)): Get "http://localhost:9200": EOFAttaching the config files here.
helk-kibana-analysis-alert-basic.yml.txt
helk-kibana-analysis-basic.yml.txt
helk-kibana-notebook-analysis-alert-basic.yml.txt
helk-kibana-notebook-analysis-basic.yml.txt
Provide the output of the following commands
Get operating system and version
for linux (except Mac) use:
cat /etc/os-releasefor Mac/OSX use:
sw_versGet disk space, memory, processor cores, and docker storage
echo -e "\nDocker Space:" && df -h /var/lib/docker; echo -e "\nMemory:" && free -g; echo -e "\nCores:" && getconf _NPROCESSORS_ONLNGet output of the HELK docker containers:
docker ps --filter "name=helk"What version of HELK are you using
run the command from within the HELK repo run
git log -1 --onelineWhat version of Winlogbeat are you using if you are using Windows/WEF logs
What steps did you take trying to fix the issue
How could we replicate the issue
Any additionally code or log context you would like to provide
Any additional context or input you have
pictures, comments, etc.
The text was updated successfully, but these errors were encountered: