kibana plugin installation

[Joe Beiter]

The Wazuh documentation assumes the hosts you are working on have
unrestricted internet access. I'm attempting to install a pilot
configuration which does not.

does anyone know where to get installation instructions for wazuhapp
into kibana manually? I tried downloading the zip file and manually
running the install but it still tries to get out to
"artifacts.elastic.co" to pull down more stuff... and of course fails.

[Robert H]

Hi,

I believe you can download the Wazuh app zip file for any version from this page.
https://github.com/wazuh/wazuh-kibana-app

and then move the file to that system and install from a file

/usr/share/kibana/bin/kibana-plugin install ///filename.zip

Something like that.

Regards,

Robert

[Robert H]

Actually, looks like it's like this

/usr/share/kibana/bin/kibana-plugin install file:///filename.zip

[Joe Beiter]

Yes, I did download the plugin from the github site and fed it the
local file to install instead of the url, but something in the process
is trying to pull other stuff from outside: "artifacts.elastic.co"

-----------------------------------------------------------------------------------------
(wazuhtest-log ~)$ sudo -u kibana
NODE_OPTIONS="--max-old-space-size=3072"
/usr/share/kibana/bin/kibana-plugin install ./wazuhapp-3.8.2_6.7.0.zip

Attempting to transfer from ./wazuhapp-3.8.2_6.7.0.zip

Attempting to transfer from
https://artifacts.elastic.co/downloads/kibana-plugins/./wazuhapp-3.8.2_6.7.0.zip/./wazuhapp-3.8.2_6.7.0.zip-6.6.1.zip

Error: Client request error: read ECONNRESET

Plugin installation was unsuccessful due to error "Client request
error: read ECONNRESET"

(wazuhtest-log ~)$

On Tue, Apr 2, 2019 at 5:20 PM Robert H <rhe...@proficio.com> wrote:
>
> Actually, looks like it's like this
>
> /usr/share/kibana/bin/kibana-plugin install file:///filename.zip
>

> --
> You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
> To post to this group, send email to wa...@googlegroups.com.
> Visit this group at https://groups.google.com/group/wazuh.
> To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/6001d7e2-c2d2-4388-b6b3-5eb6bb9d5c68%40googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[jesus.g...@wazuh.com]

Hi JoeB,

As Robert H said, you should use a different syntax for installing plugins locally.

The right usage should be the next one:

sudo -u kibana NODE_OPTIONS="--max-old-space-size=3072" /usr/share/kibana/bin/kibana-plugin install file:///absolute_path/wazuhapp-3.8.2_6.7.0.zip

Let’s say your wazuhapp-3.8.2_6.7.0.zip was downloaded in /home/foo/downloads, then your command should look like this:

sudo -u kibana NODE_OPTIONS="--max-old-space-size=3072" /usr/share/kibana/bin/kibana-plugin install file:///home/foo/downloads/wazuhapp-3.8.2_6.7.0.zip

Note that /home/foo/downloads must be reachable for the user kibana. My suggestion is to install it from /tmp or some other directory where we are sure about
kibana user permissions.

mv /home/foo/downloads/wazuhapp-3.8.2_6.7.0.zip /tmp/wazuhapp-3.8.2_6.7.0.zip
sudo chown -R kibana:kibana /usr/share/kibana/optimize
sudo chown -R kibana:kibana /usr/share/kibana/plugins

sudo -u kibana NODE_OPTIONS="--max-old-space-size=3072" /usr/share/kibana/bin/kibana-plugin install file:///tmp/wazuhapp-3.8.2_6.7.0.zip 

systemctl restart kibana

Command explained:

• sudo -u kibana. The effective user for installing the plugin.
• NODE_OPTIONS="--max-old-space-size=3072". Avoids OOM errors.
• /usr/share/kibana/bin/kibana-plugin. Kibana tool for plugin management.
• install argument for kibana-plugin for installing.
• file://. Think about it like http://, just another “protocol”.
• /tmp/wazuhapp-3.8.2_6.7.0.zip the full path to the plugin, accessible by kibana user.

I hope it helps.

Best regards,
Jesús

​