espcap | Packet capture and indexing with Wireshark and Elasticsearch | Learning library

Install Wireshark for your OS. Clone the Espcap repo then cd into the espcap directory.
Install Wireshark for your OS.
Clone the Espcap repo then cd into the espcap directory.
Optionally, activate your pipenv virtual environment: pipenv shell
Install the required Python modules for Elasticsearch 7.x: pip install -r requirements-7.x.txt If you have Elasticsearch 6.x, use the requirements-6.x.txt file instead.
Create the packet index template by running scripts/templates.sh as follows specifying the node IP address and TCP port of your Elasticsearch instance (localhost:9200 in this example): scripts/packet_template-7.x.sh localhost:9200 If you are using Elasticsearch 6.x, run packet_template-6.x.sh instead.
Set the tshark_path variable in the config/espcap.yml file. You can locate espcap.yml in one of 3 places: Use the file directly from the config directory. Copy it to the same directory where espcap.py and its related Python files reside. Create the /etc/espcap directory and copy it there. Any other directory you want. However, if you don't use one of the previous options, you'll need to add the directory path to the list of config directories contained in the tshark.py file.
cd into the src directory.
Run espcap.py to index some packet data in Elasticsearch: espcap.py --file=test_pcaps/test_http.pcap --node=localhost:9200
Run packet_query.sh as follows to check that the packet data resides in your Elasticsearch instance: scripts/packet_query.sh localhost:9200