filebeat_zeek

curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.6.2-amd64.deb
sudo dpkg -i filebeat-7.6.2-amd64.deb


#####  Modify /etc/filebeat/filebeat.yml to set the connection information:

output.elasticsearch:
  hosts: ["<es_url>"]
  username: "elastic"
  password: "<password>"
setup.kibana:
  host: "<kibana_url>"


sudo filebeat modules enable zeek

##### Modify the settings in the /etc/filebeat/modules.d/zeek.yml file.


sudo filebeat setup
sudo service filebeat start

##### Show debug
filebeat -e -d "*"

##### Test config
filebeat test config -c filebeat.yml