- Authors : Tomáš Mokoš, Marek Brodec
- Operating system : Ubuntu 16.04
- Elasticsearch version : 5.5.1
- Suricata version : 4.0.1
This article is outdated, see the newer installation guides below.
Hardware Requirements
The architecture of Moloch enables it to be distributed on multiple devices. For small networks, demonstrations or home deployment, it is possible to host all the tools necessary on a single device; however, for capturing large volumes of data at high transfer rates, it is recommended not to run Capture and Elasticsearch on the same machine. Moloch allows for software demo version testing directly on the website. In case of storage space shortage, Moloch replaces the oldest data with the new. Moloch can also perform replications, effectively doubling storage space usage. We advise to thoroughly think through the use of this feature.
Elasticsearch and amount of nodes
Amount of nodes(servers) to be used depends on:
Server monitoring with Elastic Stack
- Author: Miroslav Kohútik
- Elastic Stack Version: 6.7.0
- Operating system : Ubuntu 16.04
Elastic stack is a group of products from the Elastic company built around the Elasticsearch database designed to process data from any type of source.
In this article we will show you how to monitor the state of the Elasticsearch service and server load using the Elastic Stack services.