vee1e/PcapMonkey
1
0
Fork 0
mirror of https://github.com/vee1e/PcapMonkey.git synced 2026-09-01 17:57:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

docs: address review - preserve ES defaults, warn about auth chain, fix mount/restart (fixes #34)

Browse source 
- preserve cluster.name/network.host when mounting elasticsearch.yml
- add mkdir -p and chmod, note file must exist before up
- warn that enabling xpack breaks filebeat/kibana without password
- show volumes under services.elasticsearch.volumes
- fix restart to whole stack and env var example in context
- note 7.17.28 vs 7.17.28-arm64
This commit is contained in:
lakshit verma 2026-08-25 22:25:45 +05:30
parent 0b541ccea5
commit 71a8a8c41f
No known key found for this signature in database
1 changed files with 34 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

55
README.md
View file

@ -69,34 +69,47 @@ Even if you'd like to use directly the log file I suggest keeping them in `.json
### Elasticsearch configuration (`elasticsearch.yml`) and enabling X-Pack Security
By default PcapMonkey does **not** ship a host-side `config/elasticsearch/elasticsearch.yml`. The `elasticsearch` service in `docker-compose.yaml` (and `docker-compose.arm64.yaml`) runs the official image `docker.elastic.co/elasticsearch/elasticsearch:7.17.28` with built-in defaults at `/usr/share/elasticsearch/config/elasticsearch.yml` inside the container, configured via the `environment:` block in compose.
By default PcapMonkey does **not** ship a host-side `config/elasticsearch/elasticsearch.yml`. The `elasticsearch` service in `docker-compose.yaml` (`docker.elastic.co/elasticsearch/elasticsearch:7.17.28`, `7.17.28-arm64` on ARM64) runs with built-in defaults at `/usr/share/elasticsearch/config/elasticsearch.yml` inside the container (`cluster.name: "docker-cluster"`, `network.host: 0.0.0.0`, `discovery.type: single-node` via the `environment:` block).
To enable X-Pack Security (`xpack.security.enabled: true`) as asked in [#34](https://github.com/certego/PcapMonkey/issues/34):
1. Create `config/elasticsearch/elasticsearch.yml` on the host:
```yaml
xpack.security.enabled: true
# optional, common companion settings:
# discovery.type: single-node
# xpack.security.transport.ssl.enabled: true
```
2. Mount it in `docker-compose.yaml` (and `docker-compose.arm64.yaml` on ARM64) under the `elasticsearch` service:
```yaml
volumes:
- ./config/elasticsearch/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro
- elasticsearch_data:/usr/share/elasticsearch/data
```
3. Restart the stack:
1. Create the file on the host (must exist before `docker compose up`, otherwise Docker creates a directory):
```bash
sudo docker compose down && sudo docker compose up -d elasticsearch
mkdir -p config/elasticsearch
cat > config/elasticsearch/elasticsearch.yml <<'EOF'
cluster.name: "docker-cluster"
network.host: 0.0.0.0
discovery.type: single-node
xpack.security.enabled: true
EOF
chmod 644 config/elasticsearch/elasticsearch.yml
```
Alternative without a file, add an environment variable to the `elasticsearch` service:
Copy the three defaults above - mounting a file with only `xpack.security.enabled: true` hides the image defaults and Elasticsearch may not bind. For a single-node setup TLS is not required; for multi-node you must add TLS (see Elastic minimal security guide).
2. Mount it in `docker-compose.yaml` (and `docker-compose.arm64.yaml` on ARM64) under `services.elasticsearch.volumes` (keep the existing data volume):
```yaml
services:
elasticsearch:
volumes:
- ./config/elasticsearch/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro
- elasticsearch_data:/usr/share/elasticsearch/data
```
3. Restart the whole stack (security affects filebeat, kibana, logstash and evtxtoelk which all talk to `http://elasticsearch:9200` without credentials today):
```bash
sudo docker compose down && sudo docker compose up -d
```
After enabling security you must set a password (`ELASTIC_PASSWORD` / `elasticsearch-setup-passwords`) and update `output.elasticsearch.username/password` in Filebeat/Logstash and Kibana. Without this the pipeline will return `security_exception` and appear down.
Alternative without a file, add to the existing `environment:` list (same password caveat applies):
```yaml
environment:
- xpack.security.enabled=true
services:
elasticsearch:
environment:
- node.name=pcapmonkey
- discovery.type=single-node
- xpack.security.enabled=true
```
## PcapMonkey Architecture