Broker VM

[weejh]

Hi everyone

From the Ingest Logs from Elasticsearch Filebeat documentation, it mentioned "use the broker VM to proxy Filebeat communication". May I know how to configure the broker VM as proxy for Filebeat communication?

[jcandelaria]

Hi Weejh,

Basically you need to setup/configure the Broker VM first, (1st link below) then once you configure the Broker VM, then you can activate/configure the Local Agent Settings app inside the Broker VM (2nd link below)

1. https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/broker-vm/set-up-broker-vm/...

2. https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/broker-vm/set-up-broker-vm/...

[weejh]

Hi 

Thanks for your reply.

Yes, the broker VM is setup according to links you've shared. I guess the next step is "When using the broker VM, ensure that you activate the Local Agent Settings applet with the Agent Proxy  enabled."

May I know how validate that Agent Proxy is enabled?

[jcandelaria]

Click on gear icon (top right corner) --> configurations --> Broker VM list (left side) then select the deployed broker vm and should be able to see if you configured and activated it.

[weejh]

Hi

Thanks for the reply.

from the screenshot, is this the proxy setup that we should use to proxy Filebeat communication?

If yes, what should be the address and port? 

[jcandelaria · Accepted solution]

Hi Weejh,

the screenshot you attached is the configuration of broker VM itself. If your broker vm doesnt have restriction going to internet then you dont need to configure the proxy server. But if your broker vm need proxy to go out then you need to configure this setting.

But back to your question on filebeat.

once you deploy and configure broker, you need to configure the local agent setting app on the broker.

Then once its activated, now you can use the broker ip and port in your filebeat configuration