WARNING: Version 1.3 of Packetbeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
We currently recommend using Kibana 4 together with Packetbeat. However, the topology panel type is not yet available for Kibana 4. This panel type is implemented in a fork of Kibana 3 that was never merged (and never will be). When Kibana 4 adds support for plugins, the topology panel will be re-implemented as a plugin.
This page walks you through the steps required to install the forked Kibana 3 and load the Packetbeat dashboards. You can install Kibana 3 on the same system as Kibana 4.
Download and install the Kibana 3 fork by issuing the following commands:
curl -L -O https://github.com/packetbeat/kibana/releases/download/v3.1.2-pb/kibana-3.1.2-packetbeat.tar.gz tar -xzvf kibana-3.1.2-packetbeat.tar.gz
cd kibana-3.1.2-packetbeat python -m SimpleHTTPServer
Now point your browser to port 8000, and you should see the Kibana web interface. It will probably complain that it cannot reach Elasticsearch, like in the following screenshot:
This is because
cross-origin resource sharing (CORS) is
disabled by default in recent versions of Elasticsearch to respect the "secure
by default" philosophy. You can enable CORS by adding the following lines to the
end of the
http.cors.enabled: true http.cors.allow-origin: http://localhost:8000
Make sure that you replace
http://localhost:8000 with the URL under which you
access Kibana up to the first slash. Restart Elasticsearch:
sudo /etc/init.d/elasticsearch restart
And try again to access Kibana in your browser. You should now see Kibana’s welcome page.
To load our sample Kibana 3 dashboards, use the following commands:
curl -L -O https://download.elastic.co/beats/packetbeat/packetbeat-dashboards-k3-1.0.0~Beta1.tar.gz tar xzvf packetbeat-dashboards-k3-1.0.0~Beta1.tar.gz cd packetbeat-dashboards-k3-1.0.0~Beta1/ ./load.sh localhost
Make sure you replace
localhost with the host of your Elasticsearch