0

I have Packetbeat running using Logstash, and I have a problem. Almost all of the traffic is the traffic of the actual box sending things to Logstash. Here is what I mean:

enter image description here

As you can see, almost all my traffic is useless. Is there a way to make a filter for this using Grok or something?

Kulasangar
  • 9,046
  • 5
  • 51
  • 82
BenjaFriend
  • 664
  • 3
  • 13
  • 29

1 Answers1

0

You didn't mention what you are monitoring with Packetbeat, but I'm assuming you are talking about flow data rather than any one specific protocol.

There are multiple ways to filter Packetbeat data. Here are a few options you can set in your config file.

  • packetbeat.interfaces.device: eth0 - On Linux the psuedo "any" interface is used by default. If you do not want to capture localhost traffic then you can change the value to listen on a specific interface like eth0.
  • packetbeat.interfaces.bpf_filter: "net 192.168.0.0/16 not port 5044" - You can use a custom BPF filter to select the traffic you are interested in.
  • Use a drop_event processor to select specific events to drop. It's more efficient to filter the traffic using one of the other methods. This would drop the data only after it has been processed by Packetbeat and turned into an event.
A J
  • 2,508
  • 21
  • 26