Kibana+Elasticsearch+Logstash [ELK] v6.3.0 pfSense v2.4.3p1 and Suricata using docker-compose | docker for windows



  • I wanted to share my approach for setting up the ELK stack. I set this up using docker for windows. Docker for windows works by creating a linux VM in Hyper-V for you to run the containers and overall was pretty easy to install and use. In theory this should work on linux systems as well.

    https://github.com/evaluationcopy/pfsense-suricata-elk-docker

    This setup uses docker-compose to pull the docker images from elastic. The docker images do not require any modifications, and the elastic version to use is specified on the command line. I believe this will allow for easy future upgrades.

    The logstash configs and elastic data directories are mapped to local folders outside of the containers, on the host computer.

    I've combined logstash filters for pfSense and Suricata so they can both be parsed and viewed in kibana. The filters have been updated to reduce the pfSense logging to just firewall activity (no dhcp, dns requests, etc).

    Finally, this builds upon a number of existing works out there. Instructions and original sources are located in the readme on github.