Fresh install Wazuh from Winlogbeat

153 views
Skip to first unread message

Ray Wilson

unread,
May 18, 2021, 11:11:05 AM5/18/21
to Wazuh mailing list
Dear Team,

Previously I've been working setup Winlogbeat for collect Windows servers logs.
It seems Winlogbeat quite complicate to setup.
So finally I've decided to configure Wazuh for the purpose.
Currently, there is ELK server ready with Ubuntu 18.04. I will add the application installed and versions:-

1) Ubuntu 18.04.5 LTS
2) ElasticSearch 7.12.1
3) Kibana 7.12.1
4) Logstash 7.12.1
5) Filebeat

From the installed application, which I have to remove in order to install Wazuh?

Thank you.

Sebastian Dario Bustos

unread,
May 19, 2021, 5:58:12 PM5/19/21
to Wazuh mailing list
Hi Ray,
I'm affraid Wazuh doesn't support ELK above 7.10.2, I'll recommend uninstalling the entire ELK and filebeat for that matter so you can install the one from the Wazuh repository matching with the Wazuh version you will install. Once you have uninstalled all  (Elasticsearch, Kibana, Logstash and Filebeat) I would reboot and then start the documentation's installation guide.

Here you have the initial installation page where you have all the installation options:

If it is going to be installed all (Wazuh, Elasticsearch/Opendistro and Kibana) in one server, I'll recommend to perform the unattended all-in-one installation, it's just one command and the installation process is fully automated and pretty quick also:

If you have a distributed environment you also have an unattended installation, here are the steps documented:

There are other step by step installation guides, all of these installation methods can be found starting from the initial installation page above. Please let us know if this answers your question.
Thank you for choosing Wazuh!!!

Best Regards
Sebastian Bustos.
Reply all
Reply to author
Forward
0 new messages