{"action":"created","issue":{"url":"https://api.github.com/repos/HASecuritySolutions/VulnWhisperer/issues/133","repository_url":"https://api.github.com/repos/HASecuritySolutions/VulnWhisperer","labels_url":"https://api.github.com/repos/HASecuritySolutions/VulnWhisperer/issues/133/labels{/name}","comments_url":"https://api.github.com/repos/HASecuritySolutions/VulnWhisperer/issues/133/comments","events_url":"https://api.github.com/repos/HASecuritySolutions/VulnWhisperer/issues/133/events","html_url":"https://github.com/HASecuritySolutions/VulnWhisperer/issues/133","id":391084186,"node_id":"MDU6SXNzdWUzOTEwODQxODY=","number":133,"title":"No results found on Dashboard, just 5 fields in Index Pattern","user":{"login":"HardcoreHacker","id":3662952,"node_id":"MDQ6VXNlcjM2NjI5NTI=","avatar_url":"https://avatars2.githubusercontent.com/u/3662952?v=4","gravatar_id":"","url":"https://api.github.com/users/HardcoreHacker","html_url":"https://github.com/HardcoreHacker","followers_url":"https://api.github.com/users/HardcoreHacker/followers","following_url":"https://api.github.com/users/HardcoreHacker/following{/other_user}","gists_url":"https://api.github.com/users/HardcoreHacker/gists{/gist_id}","starred_url":"https://api.github.com/users/HardcoreHacker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HardcoreHacker/subscriptions","organizations_url":"https://api.github.com/users/HardcoreHacker/orgs","repos_url":"https://api.github.com/users/HardcoreHacker/repos","events_url":"https://api.github.com/users/HardcoreHacker/events{/privacy}","received_events_url":"https://api.github.com/users/HardcoreHacker/received_events","type":"User","site_admin":false},"labels":[{"id":627538100,"node_id":"MDU6TGFiZWw2Mjc1MzgxMDA=","url":"https://api.github.com/repos/HASecuritySolutions/VulnWhisperer/labels/bug","name":"bug","color":"ee0701","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2018-12-14T12:02:46Z","updated_at":"2018-12-14T15:51:08Z","closed_at":null,"author_association":"NONE","body":"Hello,\r\n\r\nI'm trying to get VulnWhisperer to work but I'm having huge problems with understanding how this should work in ELK. The documentation is very cryptic about this and I'm stuck for days now.\r\n\r\nAfter setting it all up (VulnWhisperer, ELK (ElasticStack 5.x), tested, approved!) I enter Kibana which has no clue what's it's doing on my system, there's no indice or index pattern. \r\n\r\nAfter some digging around I found posts about curling the template to ES to create the index:\r\ncurl -XPUT 'http://[IP]:9200/logstash-vulnwhisperer-template' -d@/VulnWhisperer/elasticsearch/logstash-vulnwhisperer-template.json\r\n\r\nI've done this, and it says it worked but nothing shows up until I go to \"Index Patterns\" in Kibana, press \"Create New\" , then \"logstash-vulnwhisperer-*\" shows up, I click that, and it goes all wrong it seems, there is no way it can map a \"Time Filter\" to that Index.\r\n\r\nThen I read somewhere else that you must import the dashboards so \"Index Patterns\" are created, I try this, it says: \"the Index Patterns do not exist, Please select the index patterns you'd like re-associated them with.\" In the field \"New index pattern\", it does recognize \"logstash-vulnwhisperer-*\". I click \"confirm all changes\". Nothing shows up in the \"Index Patterns\" where it should have added 21 fields.\r\n\r\nAny help would be greatly appreciated!\r\n\r\nThanks in advance."},"comment":{"url":"https://api.github.com/repos/HASecuritySolutions/VulnWhisperer/issues/comments/447365508","html_url":"https://github.com/HASecuritySolutions/VulnWhisperer/issues/133#issuecomment-447365508","issue_url":"https://api.github.com/repos/HASecuritySolutions/VulnWhisperer/issues/133","id":447365508,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NzM2NTUwOA==","user":{"login":"HardcoreHacker","id":3662952,"node_id":"MDQ6VXNlcjM2NjI5NTI=","avatar_url":"https://avatars2.githubusercontent.com/u/3662952?v=4","gravatar_id":"","url":"https://api.github.com/users/HardcoreHacker","html_url":"https://github.com/HardcoreHacker","followers_url":"https://api.github.com/users/HardcoreHacker/followers","following_url":"https://api.github.com/users/HardcoreHacker/following{/other_user}","gists_url":"https://api.github.com/users/HardcoreHacker/gists{/gist_id}","starred_url":"https://api.github.com/users/HardcoreHacker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HardcoreHacker/subscriptions","organizations_url":"https://api.github.com/users/HardcoreHacker/orgs","repos_url":"https://api.github.com/users/HardcoreHacker/repos","events_url":"https://api.github.com/users/HardcoreHacker/events{/privacy}","received_events_url":"https://api.github.com/users/HardcoreHacker/received_events","type":"User","site_admin":false},"created_at":"2018-12-14T15:51:08Z","updated_at":"2018-12-14T15:51:08Z","author_association":"NONE","body":"Hello qmontal,\r\n\r\nI managed to import 3 reports, seems to go OK, it creates the JSON files of those scan results. But when I go to Kibana:\r\n\r\n\"Unable to fetch mapping. Do you have indices matching the pattern?\"\r\n\r\nI still am puzzled about those Indexes/Indices and what to do with them to be honest. I've setup a few other instances of ELK before but this is unknown to me.\r\n\r\nBecause if I don't curl that template (curl -XPUT 'http://[IP]:9200/logstash-vulnwhisperer-template' -d@/VulnWhisperer/elasticsearch/logstash-vulnwhisperer-template.json) I can't even create a new \"index pattern\" for logstash-vulnwhisperer-*\r\n\r\nIt currently seems like:\r\n- ES is OK (services running, curl replies)\r\n- Logstash is OK (services running, curl replies)\r\n- Kibana is OK (services running, curl replies)\r\n- VulnWhisperer is OK (config, can connect to my OpenVAS box\r\n\r\nAfter reading your last comment, I tried:\r\n/usr/share/logstash/bin/logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/3000_openvas.conf\r\n\r\nit was very busy for ~30secs, then it only said:\r\n\"Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties\"\r\n\r\nI can only find instances of this log4j2.properties file in /etc/logstash and /etc/elasticsearch I don't think this requires any configuration.\r\n\r\nI've started to inspect the /var/log/logstash dir and it says ES instance is dead, it's still on localhost it seems, alright, trying to fix that :-)\r\n\r\nThanks again!"}}
{"actor":{"display_login":"HardcoreHacker"}}