Skip to content

Latest commit

 

History

History
46 lines (28 loc) · 2.68 KB

faq.md

File metadata and controls

46 lines (28 loc) · 2.68 KB
Raw

FAQ

View this page in Japanese (日本語) | Back to README

What if I find a bug?

  • Check out the following AWS official web pages to see if the bug is already being worked on.

I want to learn how to use Amazon Elasticsearch Service or Kibana.

  • Amazn ES Workshop content is available for you on GitHub.

Deployment doesn’t complete.

There may be a time when deployment doesn’t finish even after waiting for 30 minutes or longer. This may be because something happened when creating a domain in Amazon Elasticsearch Service (Amazon ES). Amazon ES is deployed by AWS Lambda functions: deploy-aes and configure-aes. So you can check aes-siem-deploy-aes and aes-siem-configure-aes in CloudWatch Logs to see whether deployment is still in progress, or stopped due to an error. If you see an error, please fix it or clean up as described in README and then redeploy.

Amazon ES does not load STDERR of container logs sent via Firelens.

STDERR logs are not loaded by default. Add the following to user.ini if you need to load them.

ignore_container_stderr = False

There is a discrepancy between the time when the log was generated and the timestamp in Amazon ES when STDERR of container logs is loaded via Firelens.

@timestamp is based on the time when the log is loaded because STDERR has many different log formats and some log formats do not even contain a time field.

I forgot my master user (aesadmin) password and can not login to Kibana

You can set a new password with AWS Management Console.

  1. Navigate to the Amazon ES console
  2. Select [aes-siem] domain
  3. Select [Actions] at the top of screen and choose the [Modify authnetication] from the drop-down menu.
  4. Check [Create master user] from [Fine-grained access control - powered by Open Distro for Elasticsearch]
  5. Type [aesadmin] to [Master usernames] and [any password] to [Master password]/[Confirm master password]
  6. Select [Submit] at the bottom right of the screen

Back to README