• install ELK6 with YAF, super_mediator, curl and wireshark on ubuntu/bionic64
• JSON files and Elasticsearch indicies created before 30 days are automatically deleted.

• VirtualBox
• Vagrant
• vagrant plugin install vagrant-disksize
• vagrant plugin install vagrant-proxyconf (if you use proxy)
• vagrant plugin install vagrant-vbguest (option)

Please set http_proxy and https_proxy if you need.

$ vagrant up
(snip)
(select network interface for packet capture)
==> default: Available bridged network interfaces:
1) en1: Wi-Fi (AirPort)
2) bridge0
3) en0: Ethernet
4) en2: Thunderbolt 1
5) p2p0
==> default: When choosing an interface, it is usually the one that is
==> default: being used to connect to the internet.
    default: Which interface should the network bridge to? 3
(snip)
PLAY RECAP *********************************************************************
testserver                 : ok=44   changed=40   unreachable=0    failed=0       

$ vagrant ssh
(snip)
vagrant@ubuntu-xenial:~$ ls -l yaf/json
total 2396
-rw-r--r-- 1 root root 2447363 Dec 18 06:11 yaf.20181217154009.json
vagrant@ubuntu-xenial:~$ 

Please use firefox or chrome.

• open http://127.0.0.1:5601/
• select "Management"
• select "Saved Objects"
• push "Import"
• File Upload: kibana6/yaf_ndpi.json (check "Automatically overwrite all saved objects?")
• push "Done"
• select "Dashboard"
• select "main", "bar", "bar2", "bar2_nDPI", "circle" or "circle2"
• enjoy!

• open http://127.0.0.1:3000/
• login (username: admin password: admin)
• change password
• push "Add data source"
• push "Elasticsearch" from "Choose data source type"
• input "yaf" in Name
• input "http://localhost:9200" in URL
• input "yaf.*" in Elasticsearch details Index Name
• select "6.0+" in Elasticsearch deaiils Version
• push "Save & Test"
• select "+" and "Import"
• push "Upload .json File"
• upload "grafana/ElasticSearch YAF count.json"
• select "yaf" from "Select a Elasticsearch data source"
• push "Import"
• enjoy!

• document