Processing data from hive server

[Filisimus]

Hi everyone,

so I have a master server (hive) and multiple hive sensors which are all forwarding their information to the hive server. Let's say I want to access the forwarded data on the hive server, can that be done? I know I could reconfigure logstash on the sensor servers to point to another system but since all the data is already on the hive server this doesnt make much sense to me. I just need a way to read them, please. :)

Cheers,
Fili

[t3chn0m4g3]

You say you forward the sensor data to the hive already, that's basically it. What more do you want to access? Unless it does not work correctly since you are using Ubuntu 🥲

[Filisimus]

I'm no longer trying to install T-Pot on Ubuntu, no worries 👍

And I'd like to access the raw data / database on the hive server where all the data from the sensors is being saved.

[t3chn0m4g3]

So you want to access ES on the Hive directly, instead of Kibana?

[Filisimus]

If that's where all the data is being stored, exactly.

[t3chn0m4g3]

Best way to do that is trough an SSH tunnel accessing the only locally exposed tcp/64298 of ES.

[Filisimus]

Thanks, that should be enough to get started!

[lcia-projects]

in kibana, you can look at the raw data in the "Discover" view. you'll be able to look at individual log entries. If you want to do more than that, you can use one elasticsearch API's. I use the Python API to query it once an hour and pull different information.