[id="{beatname_lc}-installation-configuration"]
== {beatname_uc} quick start: installation and configuration

++++
<titleabbrev>Quick start: installation and configuration</titleabbrev>
++++

The best way to understand the value of a network packet analytics system like
{beatname_uc} is to try it on your own traffic.

This guide describes how to get started quickly with network packets analytics.
You'll learn how to:

* install {beatname_uc} on each system you want to monitor
* specify the network devices and protocols to sniff
* parse the packet data into fields and send it to {es}
* visualize the packet data in {kib}

[role="screenshot"]
image::./images/packetbeat-overview-dashboard.png[{beatname_uc} Overview dashboard]

[float]
=== Before you begin

* You need {es} for storing and searching your data, and {kib} for visualizing
and managing it.
+
--
include::{libbeat-dir}/tab-widgets/spinup-stack-widget.asciidoc[]
--

* On most platforms, {beatname_uc} requires the libpcap packet capture
library. Depending on your OS, you might need to install it:
+
--
include::tab-widgets/install-libpcap-widget.asciidoc[]
--

[float]
[[installation]]
=== Step 1: Install {beatname_uc}

You can install {beatname_uc} on dedicated servers, getting the traffic from
mirror ports or tap devices, or you can install it on your existing application
servers.

To download and install {beatname_uc}, use the commands that work with your
system:

include::{libbeat-dir}/tab-widgets/install-widget.asciidoc[]

[float]
[[other-installation-options]]
==== Other installation options

* <<setup-repositories,APT or YUM>>
* https://www.elastic.co/downloads/beats/{beatname_lc}[Download page]
* <<running-on-docker,Docker>>

[float]
[[set-connection]]
=== Step 2: Connect to the {stack}

include::{libbeat-dir}/shared/connecting-to-es.asciidoc[]


[float]
[[configuration]]
=== Step 3: Configure sniffing

In +{beatname_lc}.yml+, configure the network devices and protocols to
capture traffic from.

. Set the sniffer type. By default, {beatname_uc} uses `pcap`, which uses the
libpcap library and works on most platforms.
+
On Linux, set the sniffer type to `af_packet` to use memory-mapped sniffing.
This option is faster than libpcap and doesn’t require a kernel module, but
it’s Linux-specific:
+
[source,yaml]
----
packetbeat.interfaces.type: af_packet
----

. Specify the network device to capture traffic from. For example:
+
[source,yaml]
----
packetbeat.interfaces.device: eth0
----
+
[TIP]
====
On Linux, specify `packetbeat.interfaces.device: any` to capture all
messages sent or received by the server where {beatname_uc} is installed.
The `any` setting does not work on macOS.
====
+
To see a list of available devices, run:
+
--
include::tab-widgets/devices-widget.asciidoc[]
--
+
For more information about these settings, see <<configuration-interfaces>>.

. In the `protocols` section, configure the ports where {beatname_uc} can find
each protocol. If you use any non-standard ports, add them here. Otherwise,
use the default values.
+
[source,yaml]
----------------------------------------------------------------------
packetbeat.protocols:

- type: dhcpv4
  ports: [67, 68]

- type: dns
  ports: [53]

- type: http
  ports: [80, 8080, 8081, 5000, 8002]

- type: memcache
  ports: [11211]

- type: mysql
  ports: [3306,3307]

- type: pgsql
  ports: [5432]

- type: redis
  ports: [6379]

- type: thrift
  ports: [9090]

- type: mongodb
  ports: [27017]

- type: cassandra
  ports: [9042]

- type: tls
  ports: [443, 993, 995, 5223, 8443, 8883, 9243]

----------------------------------------------------------------------

include::{libbeat-dir}/shared/config-check.asciidoc[]

[float]
[[setup-assets]]
=== Step 4: Set up assets

{beatname_uc} comes with predefined assets for parsing, indexing, and
visualizing your data. To load these assets:

. Make sure the user specified in +{beatname_lc}.yml+ is
<<privileges-to-setup-beats,authorized to set up {beatname_uc}>>.

. From the installation directory, run:
+
--
include::{libbeat-dir}/tab-widgets/setup-widget.asciidoc[]
--
+
`-e` is optional and sends output to standard error instead of the configured log output.

This step loads the recommended {ref}/index-templates.html[index template] for writing to {es}
and deploys the sample dashboards for visualizing the data in {kib}.

[TIP]
=====
A connection to {es} (or {ess}) is required to set up the initial
environment. If you're using a different output, such as {ls}, see
<<load-template-manually>> and <<load-kibana-dashboards>>.
=====

[float]
[[start]]
=== Step 5: Start {beatname_uc}

Before starting {beatname_uc}, modify the user credentials in
+{beatname_lc}.yml+ and specify a user who is
<<privileges-to-publish-events,authorized to publish events>>.

To start {beatname_uc}, run:

// tag::start-step[]
include::{libbeat-dir}/tab-widgets/start-widget.asciidoc[]
// end::start-step[]

{beatname_uc} should begin streaming data to {es}.

[float]
[[view-data]]
=== Step 6: View your data in {kib}

include::{libbeat-dir}/shared/opendashboards.asciidoc[tag=open-dashboards-intro]

include::{libbeat-dir}/shared/opendashboards.asciidoc[tag=open-dashboards]

TIP: To populate the client locations map in the overview dashboard, follow the
steps described in <<{beatname_lc}-geoip>>.

[float]
=== What's next?

Now that you have your data streaming into {es}, learn how to unify your logs,
metrics, uptime, and application performance data.

include::{libbeat-dir}/shared/obs-apps.asciidoc[]
