WARNING: Version 5.3 of Packetbeat has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Step 1: Installing Packetbeat Step 3: Loading the Index Template in Elasticsearch »

› ›

Step 2: Configuring Packetbeat

edit

Step 2: Configuring Packetbeat

edit

To configure Packetbeat, you edit the configuration file. For rpm and deb, you’ll find the configuration file at /etc/packetbeat/packetbeat.yml. For mac and win, look in the archive that you just extracted. There’s also a full example configuration file called packetbeat.full.yml that shows all non-deprecated options.

See the Config File Format section of the Beats Platform Reference for more about the structure of the config file.

To configure Packetbeat:

Select the network interface from which to capture the traffic.
- On Linux: Packetbeat supports capturing all messages sent or received by the server on which Packetbeat is installed. For this, use any as the device:
```
packetbeat.interfaces.device: any
```
- On OS X, capturing from the any device doesn’t work. You would typically use either lo0 or en0 depending on which traffic you want to capture.
- On Windows, run the following command to list the available network interfaces:
```
PS C:\Program Files\Packetbeat> .\packetbeat.exe -devices

0: \Device\NPF_{113535AD-934A-452E-8D5F-3004797DE286} (Intel(R) PRO/1000 MT Desktop Adapter)
```
  In this example, there’s only one network card, with the index 0, installed on the system. If there are multiple network cards, remember the index of the device you want to use for capturing the traffic.
  
  Modify the device line to point to the index of the device:
```
packetbeat.interfaces.device: 0
```

In the protocols section, configure the ports on which Packetbeat can find each protocol. If you use any non-standard ports, add them here. Otherwise, the default values should do just fine.

packetbeat.protocols.dns:
  ports: [53]

  include_authorities: true
  include_additionals: true

packetbeat.protocols.http:
  ports: [80, 8080, 8081, 5000, 8002]

packetbeat.protocols.memcache:
  ports: [11211]

packetbeat.protocols.mysql:
  ports: [3306]

packetbeat.protocols.pgsql:
  ports: [5432]

packetbeat.protocols.redis:
  ports: [6379]

packetbeat.protocols.thrift:
  ports: [9090]

packetbeat.protocols.mongodb:
  ports: [27017]

packetbeat.protocols.cassandra:
  ports: [9042]

Set the IP address and port where Packetbeat can find the Elasticsearch installation:
```
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  hosts: ["192.168.1.42:9200"]
```
If you are sending output to Logstash, see Configuring Packetbeat to Use Logstash instead.

To test your configuration file, change to the directory where the Packetbeat binary is installed, and run Packetbeat in the foreground with the following options specified: sudo ./packetbeat -configtest -e. Make sure your config files are in the path expected by Packetbeat (see Directory Layout). If you installed from DEB or RPM packages, run sudo ./packetbeat.sh -configtest -e. Depending on your OS, you might run into file ownership issues when you run this test. See Config File Ownership and Permissions in the Beats Platform Reference for more information.

« Step 1: Installing Packetbeat Step 3: Loading the Index Template in Elasticsearch »