Updating pfSense and Elastic Stack (ELK) Posts for 6.3.x

Updating pfSense and Elastic Stack (ELK) Posts for 6.3.x

Hi everyone,

I’ve been neglecting this blog a little recently as I’m presently studying for two degrees, which has had me a little distracted. But now it’s the summer break I’ve a little time to play with things. After rebuilding my pfSense recently (due to a hardware change) I discovered that my pfSense and ELK stack tutorials no longer worked as expected for the ELK 6.3.x releases. Apologies, the step from ELK 5.x to ELK 6.x seems to have changed a fair few elements which are not the most intuitive things to work out if you’re following my tutorials verbatim. So, time to fix things!

I’m going through and updating the articles, and have completed updates to the following so far:



The rest will follow shortly (As I rebuild my ELK server)




9 Replies to “Updating pfSense and Elastic Stack (ELK) Posts for 6.3.x”

  1. Hi, thankyou so much for documenting this guide Just what i needed for a spinoff in securityland
    I was wondering when you’re updating the other parts iv’e tryed the 2017 tutorials as a follow-up but got stuck with the Geo filter in logstash is it possible that things have changed for the newer versions?

    K.r. Ruben

    1. Hi Ruben,
      I’m glad you have found it of use. Yes – there are some geo changes I’ve spotted when trying spark a new install into life. I’ll try and take a look over the next couple of weeks at parts 3 & 4. I’ve got a University assignment i’m trying to wrap up at the moment which is taking my time.

      1. Hi James,

        tanks for the response, life can be bussy sometimes, right? I know the feeling.
        so take your time. Its good to know that the updates are comming. I had it figured out, by accident… but a few changes later it broke again and i haven’t been able to fix it again yet. so i’d like to actualy understand whats happening under the hood… the elkstack is a nifty piece of software.

        k.r. Ruben.

        1. Hi Ruben,

          It’s taken a while but i’m going through this step by step. Spotted a few typos in part-3 which i’m fixing. Also look out for a follow-up for deploying via the elk-docker Docker container (Which will remove the need for the part-2 installation)

  2. Hey James, Just wanted to say – you a rock star been spending months hacking away at some Docker Containers etc to get this type of dashboards working and so far so good with your guide. There is definately a few changes with 6.x.x and they about to release 7.x.x to. Am following this thread carefully as step by step it has been working so far.

    My current Env: Pfsense (bought the 7100 1U rack mount from them) with 2.4.3 and latest ELK

    Again thank you so much.

  3. Thank you so much. This is the only good setup I could find. Looking forward to parts 3 and 4! What grok/kibana dash are you using?

    1. Hey Joel,
      Thanks for the kind words. Life got in the way but going through the final parts now with a follow-up tutorial for running in docker.

    1. That looks pretty interesting. I’m re-deploing on my environment using elk-docker docker containers. Once i’ve got that done i’ll take a look at this and see if it simplifies matters.