Elasticsearch & Kibana Integration

Route DNS events into Elasticsearch and visualize them with Kibana.

1. Download and start the Elasticsearch Docker Compose stack:

2. Elasticsearch docker-compose.yml

   docker compose up -d
   

3. Run DNS-collector with the Elasticsearch integration configuration:

4. Elasticsearch config.yml

   ./dnscollector -config docs/_integration/elasticsearch/config.yml
   

5. Go to Kibana at http://127.0.0.1:5601. Click Explore on my own -> Discover, and create an index pattern named dnscollector using the time field dnstap.timestamp-rfc3339ns.