1 Example configuration for logstash/elasticsearch
2 ================================================
4 So you've got all these RADIUS logs, but how do you analyse them? What is the
5 easiest way to query the logs, find out when a client connected or disconnected,
6 or view the top ten clients logging into the system over the last six hours?
8 The logstash/elasticsearch/kibana stack is designed and built to do just that.
9 elasticsearch is a search engine; logstash is commonly used to feed data in,
10 and kibana the web interface to query the logs in near real time.
12 Installing the ELK stack is beyond the scope of this document, but can be done
13 in a short amount of time by any competent sysadmin. Then comes getting the
16 This directory contains the following files as a starting point for feeding
17 RADIUS logs into elasticsearch via logstash, then sample dashboards for Kibana
23 Please note that all files should be reviewed before use to determine if they
24 are suitable for your configuration/system, especially if you are integrating
25 this into an existing logstash/elasticsearch setup.
29 Each elasticsearch index needs a mapping to describe how fields are stored.
30 If one is not provided then all is not lost as elasticsearch will build one
31 on the fly. However, this may not be optimal, especially for RADIUS data, as
32 all fields will be analyzed making some visualisations hard or impossible
33 (such as showing top N clients).
35 This shell script (which just runs curl) pushes a template mapping into the
36 elasticsearch cluster.
40 A sample configuration file for logstash that parses RADIUS 'detail' files.
41 It processes these by joining each record onto one line, then splitting the
42 tab-delimited key-value pairs out. Some additional data is then extracted
43 from certain key attributes.
45 The file will need to be edited at least to set the input method: for
46 experimentation the given input (stdin) may be used. If logstash is running on
47 the RADIUS server then 'file' input may be appropriate, otherwise a different
48 input such as log-courier or logstash-forwarder may be better to get the data
49 over the network to the logstash server.
51 It would be best to use an input method that can join the multiple lines of
52 the detail file together and feed them to logstash as a single entry, rather
53 than using the logstash multiline filter.
57 An example configuration for the log-courier feeder.
59 kibana4-dashboard.json
61 Basic RADIUS dashboard for Kibana4.
63 To import the dashboard first create a new index called "radius-*" in
64 Settings/Indices. Then go to Kibana's Settings page, "Objects" and "Import".
65 Once imported open the "RADIUS detail" dashboard.
67 kibana3-dashboard.json
69 Basic RADIUS dashboard for Kibana3. To import the dashboard go to Load,
70 Advanced and "Choose File".
76 Install mapping (only needs to be done once):
79 Feed a detail file in:
80 $ /path/to/logstash -f logstash-radius.conf < acct-detail
86 elasticsearch web site: http://www.elastic.co/
88 The configuration examples presented here have been tested with the
89 following software versions (note that elasticsearch 2.x may not yet
90 work with this config).