# ELK in a jail



## trumee (Jan 8, 2016)

I would like to analyse my pfSense data using a Elasticsearch-Logstash-Kibana server. Has anybody tried setting up an ELK server in a FreeBSD jail?


----------



## junovitch@ (Jan 15, 2016)

If you plan to use textproc/elasticsearch2 I found that would not start without a loopback device.  So I switched my testing jail to a VIMAGE jail.  There may be a configuration option that prevents the need for this if VIMAGE is an issue since it's not available by default.  However, in my little testing jail I've found that Elasticsearch 2 is much slower searching for data via Kibana so I haven't touched my production ELK box on Elasticsearch 1.7 (textproc/elasticsearch).

It's a fairly simple setup however, install it:
`pkg install logstash kibana41 elasticsearch`
If you want to explore Elasticsearch 2:
`pkg install logstash kibana43 elasticsearch2`

In this case you'll just point Logstash to log to the Elasticsearch running locally.  Just uncomment the line for it in /usr/local/etc/logstash/logstash.conf.

```
# This will use elasticsearch to store your logs.
  elasticsearch { hosts => [ "localhost:9200" ] }
```

Enable it:
`sysrc elasticsearch_enable=YES logstash_enable=YES kibana_enable=YES`

And go go go:
`service elasticsearch start; service kibana start; service logstash start`

You'll probably want to explore the ELK documentation further for adding input options. TCP and UDP 514 for syslog data are described here:
https://www.elastic.co/guide/en/logstash/current/plugins-inputs-tcp.html
https://www.elastic.co/guide/en/logstash/current/plugins-inputs-udp.html


----------

