Installation on FreeBSD - two remaining issues

[pmhausen]

Hi all,

I just finished installing pfELK on FreeBSD 13.2 (in a TrueNAS jail) - all necessary components are available as FreeBSD packages, so I thought "why not". Using the "manual installation" guide for Ubuntu everything was quite obvious and I did not run into any major problems. Replacing /etc with /usr/local/etc for example. Of course ...

Now I have two error messages when I try to import dashboards.

The firewall dashboard at 23.09:

The file could not be processed due to error: "Unprocessable Entity: Document "274304d0-3a8f-11eb-96b2-e765737b7534" belongs to a more recent version of Kibana [8.9.0] when the last known version is [8.6.0]."

The DHCP dashboard at 23.03:

The following saved objects use data views that do not exist. Please select the data views you'd like re-associated with them. You can create a new data view if necessary.

id-dhcp

Firewall dashboard at 22.04 seems to work.

The ELK version on FreeBSD is 8.8.2 for all products. Does the first message imply I need to wait until 8.9 is available? And what about the DHCP error?

Thanks in advance,
Patrick

[a3ilson]

Patrick,

Thanks for sharing! This was inquired about two years ago by @coldbootinitheart via issue #318.

There were some quirks since v8.8-Present and dashboard issues as a result. I updated some but will eventually rebuild within the latest elasticstack. In theory, rebuilding within v.8.8.2 should work but what are your thoughts on the following:

1. Video (YouTube) tutorial rebuilding each dashboard?
2. I could export visualizations for both the Firewall and DHCP dashboards, then utilize each element to reconstruct the dashboard?

• Not sure as to why there is incompatibilities but something that I'll need to figure out.

Thanks again for sharing your TrueNAS installation and I'm certain there will be others eager and very interested in replication your efforts.

[pmhausen]

Hi! That older issue lacks a bit of detail, don't you think? I'll credit the reporter that the state of the ELK stack on FreeBSD was a bit rough, specifically for current versions. Possibly their experiments fell into that period.

Today we have more or less current (8.8.2) versions of all components as official packages. Just pkg install elasticsearch8 kibana8 logstash8 and go.

And from your step by step instructions I did not find it too difficult to get the basic functionality up and running. Main problem was that the logstash8 package comes with a predefined path.config and it took me a while to google that logstash simply won't accept more than one.

After I fixed that, everything went really smooth - apart from the dashboard issues.

So your suggestion is? You post an instructional video on how to create the dashboards from scratch using the UI?

Glad if I can be of help, really thinking of creating either an addition to your installation instructions or a full FreeBSD package/port. The latter depending on how frequent I would have to track updates on your part. And I still do not quite understand where the problem I am experiencing lies. Your docs state "elastic etc. 8+" - wich I clearly have up and running.

Kind regards
Patrick

[a3ilson]

Yes, I can create a tutorial on creating dashboards. I will also recreate and export the firewall and dhcp for you to test.

I too am a bit confused on importing saved objects and the associated errors/issues. They work until a release albeit nothing major has changed.

[pmhausen]

So I just wait for you, now? Perfectly fine with that. I have some FreeBSD driver issues and some OPNsense features for Hacktoberfest ;-)

[a3ilson]

Sorry for the delay…traveling and will rebuild some of the dashboards this weekend and post an updated tutorial on how to buildout a dashboard.