---
title: "MacOS High Sierra : Installation de ELK"
url: https://www.cyber-neurones.org/2018/09/macos-high-sierra-installation-de-elk/
date: 2018-09-26
modified: 2018-09-26
author: "Frederic"
description: "Voici le mac, en version 10.13.16 : A noter qu'il y a 16 Go de RAM, avec ELK c'est minimum 6 Go .... donc si on a 8 Go, je..."
categories:
  - "mac"
tags:
  - "ELK"
word_count: 1059
---

# MacOS High Sierra : Installation de ELK

Voici le mac, en version **10.13.16** :

[![](https://www.cyber-neurones.org/wp-content/uploads/2018/09/capture-decran-2018-09-26-a-09-10-27-300x192.png)](https://www.cyber-neurones.org/wp-content/uploads/2018/09/capture-decran-2018-09-26-a-09-10-27.png)

A noter qu'il y a 16 Go de RAM, avec ELK c'est minimum** 6 Go** .... donc si on a 8 Go, je pense que c'est pas la peine. Ensuite on peut toujours faire toujours via un Raspberry avec des configuration minimale, mais j'observe que quand il a moins de 6 Go il fonctionne nettement moins bien.

### Etape n°1 : Installation de Homebrew :

**#/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"**
==> This script will install:
/usr/local/bin/brew
/usr/local/share/doc/homebrew
/usr/local/share/man/man1/brew.1
/usr/local/share/zsh/site-functions/_brew
/usr/local/etc/bash_completion.d/brew
/usr/local/Homebrew
==> The following new directories will be created:
/usr/local/Caskroom

Press RETURN to continue or any other key to abort
....
==> Downloading and installing Homebrew...
remote: Enumerating objects: 3965, done.
remote: Counting objects: 100% (3965/3965), done.
remote: Compressing objects: 100% (23/23), done.
remote: Total 13167 (delta 3945), reused 3960 (delta 3942), pack-reused 9202
Receiving objects: 100% (13167/13167), 2.93 MiB | 910.00 KiB/s, done.
Resolving deltas: 100% (10207/10207), completed with 870 local objects.
From https://github.com/Homebrew/brew
....
==> Renamed Formulae
cdiff -> ydiff geth -> ethereum php56 -> php@5.6 php71 -> php@7.1 saltstack -> salt
crystal-lang -> crystal latexila -> gnome-latex php70 -> php@7.0 rebar@3 -> rebar3 wpcli-completion -> wp-cli-completion
==> Deleted Formulae
arm boot2docker ghc@8.0 i3status mal4s nazghul submarine
artifactory-cli-go boot2docker-completion gnupg@2.0 llvm@3.7 mediatomb node@4 ufoai
aws-cloudsearch dirmngr gpg-agent llvm@3.8 mimetic picolisp voltdb
bokken ecj i3 luciddb monotone python3 wry
==> Installation successful!

==> Homebrew has enabled anonymous aggregate formulae and cask analytics.
Read the analytics documentation (and how to opt-out) here:
https://docs.brew.sh/Analytics.html

==> Homebrew is run entirely by unpaid volunteers. Please consider donating:
https://github.com/Homebrew/brew#donations
==> Next steps:
- Run `brew help` to get started
- Further documentation:
https://docs.brew.sh

**#brew update**
Already up-to-date.

En résumé deux alertes de sécurité qu'il faut permettre :

[![](https://www.cyber-neurones.org/wp-content/uploads/2018/09/capture-decran-2018-09-26-a-09-14-26-300x139.png)](https://www.cyber-neurones.org/wp-content/uploads/2018/09/capture-decran-2018-09-26-a-09-14-26.png) [![](https://www.cyber-neurones.org/wp-content/uploads/2018/09/capture-decran-2018-09-26-a-09-15-05-300x145.png)](https://www.cyber-neurones.org/wp-content/uploads/2018/09/capture-decran-2018-09-26-a-09-15-05.png)

### Etape 2 : Installation de Java :

Normalement on tape la commande :
**# java -version**
No Java runtime present, requesting install.

Si on n'a pas java, la fenêtre suivante s'ouvre :
[![](https://www.cyber-neurones.org/wp-content/uploads/2018/09/capture-decran-2018-09-26-a-09-19-59-300x122.png)](https://www.cyber-neurones.org/wp-content/uploads/2018/09/capture-decran-2018-09-26-a-09-19-59.png)Il faut suivre le lien suivant pour faire l'installation : [https://support.apple.com/kb/dl1572?locale=fr_FR](https://support.apple.com/kb/dl1572?locale=fr_FR) ou alors [https://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html](https://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html) ( [jdk-8u181-macosx-x64.dmg](http://download.oracle.com/otn-pub/java/jdk/8u181-b13/96a7b8442fe848ef90c96a2fad6ed6d1/jdk-8u181-macosx-x64.dmg) )

[![](https://www.cyber-neurones.org/wp-content/uploads/2018/09/capture-decran-2018-09-26-a-09-35-52-300x212.png)](https://www.cyber-neurones.org/wp-content/uploads/2018/09/capture-decran-2018-09-26-a-09-35-52.png)

### Etape 3 : Installation d'Elasticsearch

Les commandes :
**# brew install elasticsearch && brew info elasticsearch**
==> Downloading https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-oss-**6.4.1**.tar.gz
...
==> Summary
? /usr/local/Cellar/elasticsearch/6.4.1: 118 files, 36MB, built in 55 seconds
elasticsearch: **stable 6.4.1**, HEAD
Distributed search & analytics engine
https://www.elastic.co/products/elasticsearch
/usr/local/Cellar/elasticsearch/6.4.1 (118 files, 36MB) *
Built from source on 2018-09-26 at 09:37:48
From: https://github.com/Homebrew/homebrew-core/blob/master/Formula/elasticsearch.rb
==> Requirements
Required: java = 1.8 ✔
==> Options
--HEAD
Install HEAD version
...
==> Analytics
install: 8,330 (30d), 30,977 (90d), 152,516 (365d)
install_on_request: 7,623 (30d), 26,652 (90d), 117,574 (365d)
build_error: 10 (30d)

Démarrage de Elasticsearch :
**# brew services start elasticsearch**
==> Tapping homebrew/services
Cloning into '/usr/local/Homebrew/Library/Taps/homebrew/homebrew-services'...
remote: Enumerating objects: 14, done.
remote: Counting objects: 100% (14/14), done.
remote: Compressing objects: 100% (10/10), done.
remote: Total 14 (delta 0), reused 8 (delta 0), pack-reused 0
Unpacking objects: 100% (14/14), done.
Tapped 1 command (44 files, 58.9KB).
==> Successfully started `elasticsearch` (label: homebrew.mxcl.elasticsearch)

On peut faire un premier test : [http://localhost:9200](http://localhost:9200)

### ETAPE 4 : Installation de Logstash

Lancement de l'installation :
**# brew install logstash**
==> Downloading https://artifacts.elastic.co/downloads/logstash/logstash-oss-6.4.1.tar.gz
######################################################################## 100.0%
==> Caveats
Please read the getting started guide located at:
https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html

To have launchd start logstash now and restart at login:
brew services start logstash
Or, if you don't want/need a background service you can just run:
logstash
==> Summary
? /usr/local/Cellar/logstash/6.4.1: 12,009 files, 247.1MB, built in 4 minutes 12 seconds

Lancement du service :
**# brew services start logstash**
==> Successfully started `logstash` (label: homebrew.mxcl.logstash

### ETAPE 5 : INSTALLATION DE KIBANA

Installation :
**# brew install kibana**
==> Downloading https://homebrew.bintray.com/bottles/kibana-6.4.1.high_sierra.bottle.tar.gz
...
==> Pouring kibana-6.4.1.high_sierra.bottle.tar.gz
==> Caveats
Config: /usr/local/etc/kibana/
If you wish to preserve your plugins upon upgrade, make a copy of
/usr/local/opt/kibana/plugins before upgrading, and copy it into the
new keg location after upgrading.

To have launchd start kibana now and restart at login:
brew services start kibana
Or, if you don't want/need a background service you can just run:
kibana
==> Summary
? /usr/local/Cellar/kibana/6.4.1: 47,176 files, 256.3MB

Lancement :
#** brew services start kibana**
==> Successfully started `kibana` (label: homebrew.mxcl.kibana)

Vérification des services :
**# brew services list**
Name Status User Plist
elasticsearch started .... /Users/..../Library/LaunchAgents/homebrew.mxcl.elasticsearch.plist
kibana started .... /Users/..../Library/LaunchAgents/homebrew.mxcl.kibana.plist
logstash started .... /Users/..../Library/LaunchAgents/homebrew.mxcl.logstash.plist

### ETAPE 6 : CONFIGURATION DE KIBANA

Changement de la configuration de kibana.yml :
**# sudo vi /usr/local/etc/kibana/kibana.yml**
# Kibana is served by a back end server. This setting specifies the port to use.
server.port: 5601

# The Kibana server's name. This is used for display purposes.
server.name: "MacOSFred"

# The URL of the Elasticsearch instance to use for all your queries.
elasticsearch.url: "http://localhost:9200"

On relance :
**# brew services restart kibana**
Stopping `kibana`... (might take a while)
==> Successfully stopped `kibana` (label: homebrew.mxcl.kibana)
==> Successfully started `kibana` (label: homebrew.mxcl.kibana)

Et on fait un test via l'URL : http://localhost:5601/status :

[![](https://www.cyber-neurones.org/wp-content/uploads/2018/09/capture-decran-2018-09-26-a-10-01-58-300x178.png)](https://www.cyber-neurones.org/wp-content/uploads/2018/09/capture-decran-2018-09-26-a-10-01-58.png)

Maintenant on fait des ajouts ...

### ETAPE 6 : CONFIGURATION DE LOGSTACH :

Modification du fichier syslog.conf :
**# sudo mkdir -p /etc/logstash/conf.d/**
**# sudo vim /etc/logstash/conf.d/syslog.conf**
**# brew services restart logstash**
Stopping `logstash`... (might take a while)
==> Successfully stopped `logstash` (label: homebrew.mxcl.logstash)
==> Successfully started `logstash` (label: homebrew.mxcl.logstash)

### ETAPE 7 : INSTALLATION DE FILEBEAT :

**# cd /usr/local/**
**# sudo bin/elasticsearch-plugin install ingest-geoip**
-> Downloading ingest-geoip from elastic
[=================================================] 100%  
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: plugin requires additional permissions @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
* java.lang.RuntimePermission accessDeclaredMembers
* java.lang.reflect.ReflectPermission suppressAccessChecks
See http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html
for descriptions of what these permissions allow and the associated risks.

Continue with installation? [y/N]y
-> Installed ingest-geoip

**# brew services restart elasticsearch**
Stopping `elasticsearch`... (might take a while)
==> Successfully stopped `elasticsearch` (label: homebrew.mxcl.elasticsearch)
==> Successfully started `elasticsearch` (label: homebrew.mxcl.elasticsearch)
**# sudo curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.4.1-darwin-x86_64.tar.gz
**...
**# sudo tar xzvf filebeat-6.4.1-darwin-x86_64.tar.gz**
**# cd filebeat-6.4.1-darwin-x86_64/
**
**# sudo mkdir -p /var/log/Filebeat/registry
**
Attention il faut permettre de sortir :

[![](https://www.cyber-neurones.org/wp-content/uploads/2018/09/capture-decran-2018-09-26-a-10-18-34-300x144.png)](https://www.cyber-neurones.org/wp-content/uploads/2018/09/capture-decran-2018-09-26-a-10-18-34.png)

Modification de filebeat.yml :
**# sudo vi filebeat.yml**

**# sudo cat filebeat.yml | grep -v "#" | grep -v "^$" **
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/*.log
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 3
setup.kibana:
host: "127.0.0.1:5601"
output.elasticsearch:
hosts: ["127.0.0.1:9200"]

**# sudo ./filebeat modules enable system**
Enabled system

**# sudo ./filebeat setup**
Loaded index template
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards
Loaded machine learning job configurations

Pour voir le runtime :
**# sudo ./filebeat -e
**
A suivre.

[![](https://www.cyber-neurones.org/wp-content/uploads/2018/09/capture-decran-2018-09-26-a-10-55-04-300x73.png)](https://www.cyber-neurones.org/wp-content/uploads/2018/09/capture-decran-2018-09-26-a-10-55-04.png)

A noter qu'ensuite le but est d'ajouter un maximum de logs, la commande suivante devrait vous permettre de trouver quelques fichiers de logs
$ lsof | grep "REG" | grep "\.log$"