search

magnuslarsen / logstash-filter-phpipam

A Logstash filter that looks up an IP-address, and returns results from phpIPAM
Other
0 stars 0 forks source link

Where do I put the configuration? #1

Open phmazzoni opened 3 years ago

phmazzoni commented 3 years ago

Hi!

Thanks for the plugin! Where do I put the configuration? Do I have to enable it on Kibana? Can I use it with Netflow?

Thanks again, Pedro

magnuslarsen commented 3 years ago

Hello!

You can use it all kinds of data, anything really :-)

You place the config in your logstash pipeline (which can be in quite a few places, depending on installation), more specifically in the "Filter" section.
Perhaps this may be of help: https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html

Nothing has to be done in Kibana, but you do need to create an API endpoint in phpipam, which Logstash will consume from.
You can create one of these in phpipam, somewhere in admin settings (I unfortunately don't use phpipam anymore, so I can check)