ELK stack configure alert email - elasticsearch

Trying to configure email in Kibana, documentation states to modify elasticsearch.yml
elasticsearch\config\elasticsearch.yml
Added the following at the bottom:
xpack.notification.email.account:
account:
smtp:
auth: false
starttls.enable: true
starttls.required: false
host: localhost
port: 25
When I start service and do "test send email" i get error sending email
How does one configure emailing for alerts.
Am i editing the right configuration file?

Figured it out. I was able to enable emailing through gmail.
elasticsearch\config\elasticsearch.yml
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
xpack.notification.email.account:
gmail_account:
profile: gmail
smtp:
auth: true
starttls.enable: true
host: smtp.gmail.com
port: 587
user: yourmeail#gmail.com
password: ******* your password

Related

"Couldn't connect to host" occurs when trying to send mail from Gmail with Spring-Boot mail in Admin Server

I want to send mail as a reminder in Admin Server
But get this error:
com.sun.mail.util.MailConnectException: Couldn't connect to host, port: smtp.gmail.com, 587; timeout 20000
...
I have searched a lot online but still don't work
My Admin Server Application YAML configuration file:
spring:
security:
user:
name: admin
password: 123456
boot:
admin:
notify:
mail:
enabled: true
# receivers
to: xxx#outlook.com
ignore-changes: {"UNKNOWN:UP"}
# copy-to list
cc:
from: Spring Boot Admin<xxx#gmail.com>
# mail sender
mail:
host: smtp.gmail.com
port: 587
username: xxx#gmail.com
# with 2-factor authentication, we should get app password from Google
password: my-app-password
default-encoding: UTF-8
properties:
mail:
smtp:
connectiontimeout: 20000
timeout: 20000
writetimeout: 20000
starttls:
enable: true
required: true
auth: true
ssl:
enable: true
required: true
debug: true
server:
port: 8081
I config the settings with the help of this instruction
btw, 2-factor authentication is enabled with my Google account, so I followed this instruction to get my "app password"
But after I start my Admin Server application, and wait 20 second, the error appears
I have tried change port to 465, not working
I have tried spring.mail.properties.mail.smtp.socketFactory.port and configure it to 465, not working
I'm using Windows 11 and windows firewall has no Outbound rule against java, java platform, intelliJ idea, there're Inbound rules that block java and java(TM) platform, not working
With my config above, Admin Server should send a mail to xxx#outlook.com from xxx#gmail.com.

i setup keycloak authentication for elasticsearch.but login is not work properlly

i have add elasticsearch & kibana yml files and few screenshots.for login kibana dashboard it take properly but kibana dashboard not appear it will redirect again back page.
video link - enter link description here
screenshot --> keycloak client configurations
elasticsearch.yml
# --------------------------------------------------------------------------------
# Enable security features
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
enabled: true
keystore.path: certs/http.p12
# Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
enabled: true
verification_mode: certificate
keystore.path: certs/transport.p12
truststore.path: certs/transport.p12
# Create a new cluster with the current node only
# Additional nodes can still join the cluster later
cluster.initial_master_nodes: ["surangas-MacBook-Air.local"]
# Allow HTTP API connections from anywhere
# Connections are encrypted and require user authentication
http.host: 0.0.0.0
# Allow other nodes to join the cluster from anywhere
# Connections are encrypted and mutually authenticated
#transport.host: 0.0.0.0
#----------------------- END SECURITY AUTO CONFIGURATION -------------------------
xpack.security.authc.realms.oidc.oidc1:
order: 0
rp.client_id: "kibana"
rp.response_type: code
rp.redirect_uri: "http://localhost:5601/app/home#/"
op.issuer: "http://localhost:8080/realms/oidc1"
op.authorization_endpoint: "http://localhost:8080/realms/oidc1/protocol/openid-connect/auth"
op.token_endpoint: "http://localhost:8080/realms/oidc1/protocol/openid-connect/token"
op.jwkset_path: "https://localhost:8080/realms/oidc1/protocol/openid-connect/certs"
op.userinfo_endpoint: "http://localhost:8080/realms/oidc1/protocol/openid-connect/userinfo"
op.endsession_endpoint: "http://localhost:8080/realms/oidc1/protocol/openid-connect/logout"
rp.post_logout_redirect_uri: "http://localhost:5601/security/logged_out"
claims.principal: email
claims.groups: "http://localhost:8080/claims/groups"
kibana.yml
this my kibana.yml file. here i have configure keycloak login page configurations
# =================== Search Autocomplete ===================
xpack.security.session.idleTimeout: "30m"
xpack.security.session.cleanupInterval: "1d"
xpack.security.authc.providers:
oidc.oidc1:
order: 0
realm: "oidc1"
description: "Keycloak"
basic.basic:
order: 1
# This section was automatically generated during setup.
elasticsearch.hosts: ['https://192.168.8.184:9200']
elasticsearch.serviceAccountToken: AAEAAWVsYXN0aWMva2liYW5hL2Vucm9sbC1wcm9jZXNzLXRva2VuLTE2NTUwMDc0NDM1MDY6YXRIcmpaVnRRclMwSHM4NmVJcWpVZw
elasticsearch.ssl.certificateAuthorities: [/Users/suranga/Desktop/Monitoring/test/keycloak/kibana-8.2.0/data/ca_1655007444485.crt]
xpack.fleet.outputs: [{id: fleet-default-output, name: default, is_default: true, is_default_monitoring: true, type: elasticsearch, hosts: ['https://192.168.8.184:9200'], ca_trusted_fingerprint: 82d6e3b36b6132052fb895809a97588fb366edf7f3dfba981e724194d2d19af3}]

Filebeat over HTTPS

I am totally newbie in elk but I'm currently deploying ELK stack via docker-compose (https://www.elastic.co/guide/en/elastic-stack-get-started/current/get-started-docker.html TLS part).
Elasticsearch and Kibana work correctly in HTTPS.
However, I don't understand how to enable Filebeat over HTTPS. I would like to send my nginx logs which is located on another server (over internet, so I do not want to send logs in clear text). Everything works fine in HTTP but when I switch to HTTPS and reload Filebeat I get the following message:
Error: ... Get https://10.15.0.12:9200: x509: certificate is valid for 127.0.0.0.1, not 10.15.0.12
I know I'm doing something wrong but I don't find the answer for Filebeat over HTTPS...
Here is my Filebeat configuration :
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["10.15.0.12:9200"]
# Protocol - either `http` (default) or `https`.
protocol: "https"
# Authentication credentials - either API key or username/password.
username: "elastic"
password: "myelasticpassword"
Thanks in advance.
I found the error :
My self signed certificate was for 127.0.0.1 host.
I've changed the IP in the instances.yml
Then I changed my filebeat config :
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["xx.xx.xx.xx:9200"]
# Protocol - either `http` (default) or `https`.
protocol: "https"
# Authentication credentials - either API key or username/password.
#api_key: "id:api_key"
username: "elastic"
password: "mypassword"
ssl.verification_mode: none

Placeholders within UAA_CONFIG_YAML environment variable

I'm trying to set the SMTP settings within the UAA_CONFIG_YAML section of the manifest.
smtp:
host: ${vcap.services.smtpdev.credentials.hostname:localhost}
port: 2525
user: ${vcap.services.smtpdev.credentials.username:user}
password: ${vcap.services.smtpdev.credentials.password:password}
This doesn't work yet the default of localhost is being picked up. If I provide an invalid placeholder it throws an error.
The way I have done it, I have set the UAA_CONFIG_PATH environment variable which points to the location of the yaml file.
The settings are provided as follows:
smtp:
host: smtp.gmail.com
port: <port_number>
auth: true
starttls.enable: false
user: <username>
password: <password>
These values are getting picked up by uaa.
Please let me know if it was helpful.

Sending email with Joomla and Google Apps

I have the next settings in the Joomla Global Configuration panel.
**Mail Settings**
Mailer: SMTP Server
Mail from: email#mydomain.com
From Name: John Smith
Sendmail Path:
SMTP Authentication: Yes
SMTP Security: SSL
SMTP Port: 465
SMTP Username: email#mydomain.com
SMTP Password: ******
SMTP Host: gmail-smtp-in.l.google.com
I am running Joomla 1.5.14.
I have in my google apps domain both IMAP and POP enabled.
When I try to send an email with an article link by clicking the small envelope icon I get the next feedback. "The e-mail cold not be send correctly". The SMTP validation seems to work because I do not get any SMTP error but the email is not sent. Any idea would be really appreciated!
I have tested with SMTP Host as smtp.gmail.com without success.
I have tried with sendmail defined as /usr/sbin/postfix but without success.
Solution
Set sendmail path to the sendmail command or point sendmail to postfix if you have postfix installed.
Set SMTP Host to smtp.gmail.com. I would look like:
**Mail Settings**
Mailer: SMTP Server
Mail from: email#mydomain.com
From Name: John Smith
Sendmail Path: /usr/sbin/sendmail
SMTP Authentication: Yes
SMTP Security: SSL
SMTP Port: 465
SMTP Username: email#mydomain.com
SMTP Password: ******
SMTP Host: smtp.gmail.com
Mail Settings
Mailer: SMTP Server Mail from: emailmydomain.com
From Name: John Smith
Sendmail Path: /usr/sbin/sendmail
SMTP Authentication: Yes
SMTP Security: None
SMTP Port: 25
SMTP Username: emailmydomain.com
SMTP Password: **
SMTP Host: ssl://smtp.gmail.com:465
I have Virtuemart 1.1.4 with Joomla! 1.5.15.
The configuration that works for me was (both for virtuemart and joomla contacts):
Mail Settings
Mailer: SMTP Server
Mail from: email#mydomain.com
From Name: John Smith
Sendmail Path: /usr/sbin/sendmail
SMTP Authentication: Yes
SMTP Security: None
SMTP Port: 25
SMTP Username: email#mydomain.com
SMTP Password: ******
SMTP Host: ssl://smtp.gmail.com:465

Resources