sudo add-apt-repository ppa:linuxuprising/java

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -

sudo apt-get install apt-transport-https

echo "deb https://artifacts.elastic.co/packages/6.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-6.x.list

sudo apt-get update

sudo apt install oracle-java11-installer

sudo apt-get install elasticsearch && sudo apt-get install kibana && sudo apt-get install logstash

sudo nano /etc/kibana/kibana.yml

server.port: 5601
server.host: "0.0.0.0"

cd /etc/logstash/conf.d

sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/01-inputs.conf

sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/10-syslog.conf

sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/11-pfsense.conf

sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/30-outputs.conf

sudo mkdir /etc/logstash/conf.d/patterns

cd /etc/logstash/conf.d/patterns/

sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/pfsense_2_4_2.grok

sudo nano /etc/logstash/conf.d/10-syslog.conf

Change line 3; the "if [host]..." should point to your pfSense IP address
Change line 9 to point to your second PfSense IP address or comment out

sudo nano /etc/logstash/conf.d/11-pfsense.conf

Change line 12 to the same timezone as your phSense configruation
_Note if the timezone is offset or mismatched, you may not see any logs_

cd /etc/logstash

sudo wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz

sudo gunzip GeoLite2-City.mmdb.gz

sudo /bin/systemctl daemon-reload
sudo /bin/systemctl enable elasticsearch.service
sudo /bin/systemctl enable kibana.service
sudo /bin/systemctl enable logstash.service

sudo -i service elasticsearch start
sudo -i service kibana start
sudo -i service logstash start

systemctl status elasticsearch.service
systemctl status kibana.service
systemctl status logstash.service

cat/nano/vi the files within this location to view Logstash logs