replace es-head with elasticvue, tweaking

es-head does not support building with ARM64 and had to be replaced with the even better elasticvue elasticvue will now run within the nginx container, freeing some RAM :) on the way
2025-04-20 06:02:24 +00:00 · 2022-01-27 02:39:23 +00:00 · 2022-01-27 02:39:23 +00:00 · 12a413b4cb
commit 12a413b4cb
parent 6a277fd1e9
22 changed files with 241 additions and 280 deletions
--- a/README.md
+++ b/README.md
@ -37,7 +37,7 @@ Furthermore T-Pot includes the following tools
 * [Cockpit](https://cockpit-project.org/running) for a lightweight, webui for docker, os, real-time performance monitoring and web terminal.
 * [Cyberchef](https://gchq.github.io/CyberChef/) a web app for encryption, encoding, compression and data analysis.
 * [ELK stack](https://www.elastic.co/videos) to beautifully visualize all the events captured by T-Pot.
-* [Elasticsearch Head](https://mobz.github.io/elasticsearch-head/) a web front end for browsing and interacting with an Elastic Search cluster.
+* [Elasticvue](https://github.com/cars10/elasticvue/) a web front end for browsing and interacting with an Elastic Search cluster.
 * [Fatt](https://github.com/0x4D31/fatt) a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic.
 * [Spiderfoot](https://github.com/smicallef/spiderfoot) a open source intelligence automation tool.
 * [Suricata](http://suricata-ids.org/) a Network Security Monitoring engine.
@ -121,7 +121,7 @@ In T-Pot we combine the dockerized honeypots ...
 * [Cockpit](https://cockpit-project.org/running) for a lightweight, webui for docker, os, real-time performance monitoring and web terminal.
 * [Cyberchef](https://gchq.github.io/CyberChef/) a web app for encryption, encoding, compression and data analysis.
 * [ELK stack](https://www.elastic.co/videos) to beautifully visualize all the events captured by T-Pot.
-* [Elasticsearch Head](https://mobz.github.io/elasticsearch-head/) a web front end for browsing and interacting with an Elastic Search cluster.
+* [Elasticvue](https://github.com/cars10/elasticvue/) a web front end for browsing and interacting with an Elastic Search cluster.
 * [Fatt](https://github.com/0x4D31/fatt) a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic.
 * [Spiderfoot](https://github.com/smicallef/spiderfoot) a open source intelligence automation tool.
 * [Suricata](http://suricata-ids.org/) a Network Security Monitoring engine.
@ -160,7 +160,7 @@ There are prebuilt installation types available each focussing on different aspe

 ##### Standard
 - Honeypots: adbhoney, ciscoasa, citrixhoneypot, conpot, cowrie, dicompot, dionaea, elasticpot, heralding, honeysap, honeytrap, mailoney, medpot, rdpy, snare & tanner
- Tools: cockpit, cyberchef, ELK, fatt, elasticsearch head, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata
+- Tools: cockpit, cyberchef, ELK, fatt, elasticvue, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata


 ##### Sensor
@ -171,22 +171,22 @@ There are prebuilt installation types available each focussing on different aspe

 ##### Industrial
 - Honeypots: conpot, cowrie, dicompot, heralding, honeysap, honeytrap, medpot & rdpy
- Tools: cockpit, cyberchef, ELK, fatt, elasticsearch head, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata
+- Tools: cockpit, cyberchef, ELK, fatt, elasticvue, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata


 ##### Collector
 - Honeypots: heralding & honeytrap
- Tools: cockpit, cyberchef, fatt, ELK, elasticsearch head, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata
+- Tools: cockpit, cyberchef, fatt, ELK, elasticvue, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata


 ##### NextGen
 - Honeypots: adbhoney, ciscoasa, citrixhoneypot, conpot, cowrie, dicompot, dionaea, glutton, heralding, honeysap, ipphoney, mailoney, medpot, rdpy, snare & tanner
- Tools: cockpit, cyberchef, ELK, fatt, elasticsearch head, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata
+- Tools: cockpit, cyberchef, ELK, fatt, elasticvue, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata


 ##### Medical
 - Honeypots: dicompot & medpot
- Tools: cockpit, cyberchef, ELK, fatt, elasticsearch head, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata
+- Tools: cockpit, cyberchef, ELK, fatt, elasticvue, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata


 <a name="installation"></a>
@ -419,8 +419,6 @@ The following web based tools are included to improve and ease up daily tasks.

 ![Cyberchef](doc/cyberchef.png)

-![ES Head Plugin](doc/headplugin.png)
-
 ![Spiderfoot](doc/spiderfoot.png)


@ -500,8 +498,8 @@ We hope you understand that we cannot provide support on an individual basis. We
 The software that T-Pot is built on uses the following licenses.
 <br>GPLv2: [conpot](https://github.com/mushorg/conpot/blob/master/LICENSE.txt), [dionaea](https://github.com/DinoTools/dionaea/blob/master/LICENSE), [honeysap](https://github.com/SecureAuthCorp/HoneySAP/blob/master/COPYING), [honeytrap](https://github.com/armedpot/honeytrap/blob/master/LICENSE), [suricata](http://suricata-ids.org/about/open-source/)
 <br>GPLv3: [adbhoney](https://github.com/huuck/ADBHoney), [elasticpot](https://gitlab.com/bontchev/elasticpot/-/blob/master/LICENSE), [ewsposter](https://github.com/telekom-security/ews/), [log4pot](https://github.com/thomaspatzke/Log4Pot/blob/master/LICENSE), [fatt](https://github.com/0x4D31/fatt/blob/master/LICENSE), [rdpy](https://github.com/citronneur/rdpy/blob/master/LICENSE), [heralding](https://github.com/johnnykv/heralding/blob/master/LICENSE.txt), [ipphoney](https://gitlab.com/bontchev/ipphoney/-/blob/master/LICENSE), [redishoneypot](https://github.com/cypwnpwnsocute/RedisHoneyPot/blob/main/LICENSE), [snare](https://github.com/mushorg/snare/blob/master/LICENSE), [tanner](https://github.com/mushorg/snare/blob/master/LICENSE)
-<br>Apache 2 License: [cyberchef](https://github.com/gchq/CyberChef/blob/master/LICENSE), [dicompot](https://github.com/nsmfoo/dicompot/blob/master/LICENSE), [elasticsearch](https://github.com/elasticsearch/elasticsearch/blob/master/LICENSE.txt), [logstash](https://github.com/elasticsearch/logstash/blob/master/LICENSE), [kibana](https://github.com/elasticsearch/kibana/blob/master/LICENSE.md), [docker](https://github.com/docker/docker/blob/master/LICENSE), [elasticsearch-head](https://github.com/mobz/elasticsearch-head/blob/master/LICENCE)
-<br>MIT license: [ciscoasa](https://github.com/Cymmetria/ciscoasa_honeypot/blob/master/LICENSE), [ddospot](https://github.com/aelth/ddospot/blob/master/LICENSE), [glutton](https://github.com/mushorg/glutton/blob/master/LICENSE), [hellpot](https://github.com/yunginnanet/HellPot/blob/master/LICENSE)
+<br>Apache 2 License: [cyberchef](https://github.com/gchq/CyberChef/blob/master/LICENSE), [dicompot](https://github.com/nsmfoo/dicompot/blob/master/LICENSE), [elasticsearch](https://github.com/elasticsearch/elasticsearch/blob/master/LICENSE.txt), [logstash](https://github.com/elasticsearch/logstash/blob/master/LICENSE), [kibana](https://github.com/elasticsearch/kibana/blob/master/LICENSE.md), [docker](https://github.com/docker/docker/blob/master/LICENSE)
+<br>MIT license: [ciscoasa](https://github.com/Cymmetria/ciscoasa_honeypot/blob/master/LICENSE), [ddospot](https://github.com/aelth/ddospot/blob/master/LICENSE), [elasticvue](https://github.com/cars10/elasticvue/blob/master/LICENSE), [glutton](https://github.com/mushorg/glutton/blob/master/LICENSE), [hellpot](https://github.com/yunginnanet/HellPot/blob/master/LICENSE)
 <br> Unlicense: [endlessh](https://github.com/skeeto/endlessh/blob/master/UNLICENSE)
 <br> Other: [citrixhoneypot](https://github.com/MalwareTech/CitrixHoneypot#licencing-agreement-malwaretech-public-licence), [cowrie](https://github.com/micheloosterhof/cowrie/blob/master/LICENSE.md), [mailoney](https://github.com/awhitehatter/mailoney), [Debian licensing](https://www.debian.org/legal/licenses/), [Elastic License](https://www.elastic.co/licensing/elastic-license)
 <br> AGPL-3.0: [honeypots](https://github.com/qeeqbox/honeypots/blob/main/LICENSE)
@ -527,7 +525,7 @@ Without open source and the fruitful development community (we are proud to be a
 * [docker](https://github.com/docker/docker/graphs/contributors)
 * [elasticpot](https://gitlab.com/bontchev/elasticpot/-/project_members)
 * [elasticsearch](https://github.com/elastic/elasticsearch/graphs/contributors)
-* [elasticsearch-head](https://github.com/mobz/elasticsearch-head/graphs/contributors)
+* [elasticvue](https://github.com/cars10/elasticvue/graphs/contributors)
 * [endlessh](https://github.com/skeeto/endlessh/graphs/contributors)
 * [ewsposter](https://github.com/armedpot/ewsposter/graphs/contributors)
 * [fatt](https://github.com/0x4D31/fatt/graphs/contributors)
--- a/docker/deprecated/head/Dockerfile
+++ b/docker/deprecated/head/Dockerfile
--- a/docker/deprecated/head/docker-compose.yml
+++ b/docker/deprecated/head/docker-compose.yml
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@ -179,11 +179,6 @@ services:
    build: elk/logstash/.
    image: "dtagdevsec/logstash:2203"

-## Elasticsearch-head service
-  head:
-    build: elk/head/.
-    image: "dtagdevsec/head:2203"
-
 # Ewsposter service
  ewsposter:
    build: ews/.
--- a/docker/elk/docker-compose.yml
+++ b/docker/elk/docker-compose.yml
@ -57,16 +57,3 @@ services:
    volumes:
     - /data:/data
 #     - /root/tpotce/docker/elk/logstash/dist/logstash.conf:/etc/logstash/conf.d/logstash.conf
-
-## Elasticsearch-head service
-  head:
-    build: head/.
-    container_name: head
-    restart: always
-    depends_on:
-      elasticsearch:
-        condition: service_healthy
-    ports:
-     - "127.0.0.1:64302:9100"
-    image: "dtagdevsec/head:2203"
-    read_only: true
--- a/docker/heimdall/Dockerfile
+++ b/docker/heimdall/Dockerfile
@ -39,12 +39,14 @@ RUN apk -U --no-cache add \
    php7 artisan key:generate && \
 #
 ## Add previously configured content
-    mkdir -p /var/lib/nginx/html/storage/app/public/backgrounds/ && \
+    mkdir -p /var/lib/nginx/html/storage/app/public/backgrounds/ \
+             /var/lib/nginx/html/esvue && \
+    tar xvfz /root/dist/esvue.tgz -C /var/lib/nginx/html/esvue && \
    cp /root/dist/app/bg1.jpg /var/lib/nginx/html/public/img/bg1.jpg && \
    cp /root/dist/app/t-pot.png /var/lib/nginx/html/public/img/heimdall-icon-small.png && \
    cp /root/dist/app/app.sqlite /var/lib/nginx/html/database/app.sqlite && \
    cp /root/dist/app/cyberchef.png /var/lib/nginx/html/storage/app/public/icons/ZotKKZA2QKplZhdoF3WLx4UdKKhLFamf3lSMcLkr.png && \
-    cp /root/dist/app/eshead.png /var/lib/nginx/html/storage/app/public/icons/77KqFv4YIshXUDLDoOvZ1NUbsKDtsMAjJvg4sYqN.png && \
+    cp /root/dist/app/esvue.png /var/lib/nginx/html/storage/app/public/icons/3aLDl0Kq42sTHSpIrJtmrOTThpvHoL0Zk2Ay13YT.png && \
    cp /root/dist/app/tsec.png /var/lib/nginx/html/storage/app/public/icons/RHwXCfCeGNDdhYgzlShL9o4NBFL2LHZWajgyeL0a.png && \
    cp /root/dist/app/spiderfoot.png /var/lib/nginx/html/storage/app/public/icons/s7uPe1frJqjv76oI6SNqNbWUsgU1GHYqRALMlwYb.png && \
    cp /root/dist/html/*.html /var/lib/nginx/html/public/ && \
--- a/docker/heimdall/dist/app/app.sqlite
+++ b/docker/heimdall/dist/app/app.sqlite
--- a/docker/heimdall/dist/app/eshead.png
+++ b/docker/heimdall/dist/app/eshead.png
--- a/docker/heimdall/dist/app/esvue.png
+++ b/docker/heimdall/dist/app/esvue.png
--- a/docker/heimdall/dist/conf/tpotweb.conf
+++ b/docker/heimdall/dist/conf/tpotweb.conf
@ -96,6 +96,12 @@ server {
        try_files $uri $uri/ /index.php?$query_string;
    }

+    location ^~ /elasticvue {
+        index index.html;
+        alias /var/lib/nginx/html/esvue;
+        try_files $uri $uri/ /index.html?$args;
+    }
+
    location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass 127.0.0.1:64304;
@ -120,12 +126,6 @@ server {
        rewrite /es/(.*)$ /$1 break;
    }

-    ### head standalone 
-    location /myhead/ {
-        proxy_pass http://127.0.0.1:64302/;
-        rewrite /myhead/(.*)$ /$1 break;
-    }
-
    ### CyberChef
    location /cyberchef {
        proxy_pass http://127.0.0.1:64299;
--- a/docker/heimdall/dist/esvue.tgz
+++ b/docker/heimdall/dist/esvue.tgz
--- a/docker/heimdall/docker-compose.yml
+++ b/docker/heimdall/docker-compose.yml
@ -27,7 +27,7 @@ services:
     - "64297:64297"
     - "127.0.0.1:64304:64304"
    image: "dtagdevsec/nginx:2203"
-    read_only: true
+    #    read_only: true
    volumes:
     - /data/nginx/cert/:/etc/nginx/cert/:ro
     - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro
--- a/docker/honeypots/Dockerfile
+++ b/docker/honeypots/Dockerfile
@ -28,8 +28,8 @@ RUN apk -U add \
    mkdir -p /opt \
             /var/log/honeypots && \
    cd /opt/ && \
-    #git clone https://github.com/qeeqbox/honeypots && \
-    git clone https://github.com/t3chn0m4g3/honeypots && \
+    git clone https://github.com/qeeqbox/honeypots && \
+    #git clone https://github.com/t3chn0m4g3/honeypots && \
    cd honeypots && \
    #git checkout 7c654a3ef2c564ae6f1247bf302d652037080163 && \
    pip3 install --upgrade pip && \
@ -61,4 +61,4 @@ RUN apk -U add \
 STOPSIGNAL SIGINT
 USER honeypots:honeypots
 WORKDIR /opt/honeypots/
-CMD python3 -m honeypots --setup all --config config.json
+CMD python3 -E -m honeypots --setup all --config config.json
--- a/docker/honeypots/dist/config.json
+++ b/docker/honeypots/dist/config.json
@ -1,144 +1,219 @@
 {
-    "logs":"file,terminal",
-    "logs_location":"/var/log/honeypots/",
-    "honeypots": {
-        "dns": {
-            "port": 53,
-            "ip": "0.0.0.0",
-            "username": "administrator",
-            "password": "123456"
-            },
-        "ftp": {
-            "port": 21,
-            "ip": "0.0.0.0",
-            "username": "ftp",
-            "password": "anonymous"
-            },
-        "httpproxy": {
-            "port": 8080,
-            "ip": "0.0.0.0",
-            "username": "admin",
-            "password": "admin"
-            },
-        "http": {
-            "port": 80,
-            "ip": "0.0.0.0",
-            "username": "admin",
-            "password": "admin"
-            },
-        "https": {
-            "port": 443,
-            "ip": "0.0.0.0",
-            "username": "admin",
-            "password": "admin"
-            },
-        "imap": {
-            "port": 143,
-            "ip": "0.0.0.0",
-            "username": "root",
-            "password": "123456"
-            },
-        "mysql": {
-            "port": 3306,
-            "ip": "0.0.0.0",
-            "username": "root",
-            "password": "123456"
-            },
-        "pop3": {
-            "port": 110,
-            "ip": "0.0.0.0",
-            "username": "root",
-            "password": "123456"
-            },
-        "postgres": {
-            "port": 5432,
-            "ip": "0.0.0.0",
-            "username": "postgres",
-            "password": "123456"
-            },
-        "redis": {
-            "port": 6379,
-            "ip": "0.0.0.0",
-            "username": "root",
-            "password": ""
-            },
-        "smb": {
-            "port": 445,
-            "ip": "0.0.0.0",
-            "username": "administrator",
-            "password": "123456"
-            },
-        "smtp": {
-            "port": 25,
-            "ip": "0.0.0.0",
-            "username": "root",
-            "password": "123456"
-            },
-        "socks5": {
-            "port": 1080,
-            "ip": "0.0.0.0",
-            "username": "admin",
-            "password": "admin"
-            },
-        "ssh": {
-            "port": 22,
-            "ip": "0.0.0.0",
-            "username": "root",
-            "password": "123456"
-            },
-        "telnet": {
-            "port": 23,
-            "ip": "0.0.0.0",
-            "username": "root",
-            "password": "123456"
-            },
-        "vnc": {
-            "port": 5900,
-            "ip": "0.0.0.0",
-            "username": "administrator",
-            "password": "123456"
-            },
-        "elastic": {
-            "port": 9200,
-            "ip": "0.0.0.0",
-            "username": "elastic",
-            "password": "123456"
-            },
-        "mssql": {
-            "port": 1433,
-            "ip": "0.0.0.0",
-            "username": "sa",
-            "password": ""
-            },
-        "ldap": {
-            "port": 389,
-            "ip": "0.0.0.0",
-            "username": "administrator",
-            "password": "123456"
-            },
-        "ntp": {
-            "port": 123,
-            "ip": "0.0.0.0",
-            "username": "administrator",
-            "password": "123456"
-            },
-        "memcache": {
-            "port": 11211,
-            "ip": "0.0.0.0",
-            "username": "admin",
-            "password": "123456"
-            },
-        "oracle": {
-            "port": 1521,
-            "ip": "0.0.0.0",
-            "username": "bi",
-            "password": "123456"
-            },
-        "snmp": {
-            "port": 161,
-            "ip": "0.0.0.0",
-            "username": "privUser",
-            "password": "123456"
-            }
-        }
+  "logs": "file,terminal,json,tpot",
+  "logs_location":"/var/log/honeypots/",
+  "syslog_address": "",
+  "syslog_facility": 0,
+  "postgres": "",
+  "db_options": [],
+  "filter": "",
+  "interface": "",
+  "honeypots": {
+    "dns": {
+      "port": 53,
+      "ip": "0.0.0.0",
+      "username": "administrator",
+      "password": "123456",
+      "log_file_name": "dns.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "ftp": {
+      "port": 21,
+      "ip": "0.0.0.0",
+      "username": "ftp",
+      "password": "anonymous",
+      "log_file_name": "ftp.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "httpproxy": {
+      "port": 8080,
+      "ip": "0.0.0.0",
+      "username": "admin",
+      "password": "admin",
+      "log_file_name": "httpproxy.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "http": {
+      "port": 80,
+      "ip": "0.0.0.0",
+      "username": "admin",
+      "password": "admin",
+      "log_file_name": "http.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "https": {
+      "port": 443,
+      "ip": "0.0.0.0",
+      "username": "admin",
+      "password": "admin",
+      "log_file_name": "https.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "imap": {
+      "port": 143,
+      "ip": "0.0.0.0",
+      "username": "root",
+      "password": "123456",
+      "log_file_name": "imap.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "mysql": {
+      "port": 3306,
+      "ip": "0.0.0.0",
+      "username": "root",
+      "password": "123456",
+      "log_file_name": "mysql.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "pop3": {
+      "port": 110,
+      "ip": "0.0.0.0",
+      "username": "root",
+      "password": "123456",
+      "log_file_name": "pop3.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "postgres": {
+      "port": 5432,
+      "ip": "0.0.0.0",
+      "username": "postgres",
+      "password": "123456",
+      "log_file_name": "postgres.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "redis": {
+      "port": 6379,
+      "ip": "0.0.0.0",
+      "username": "root",
+      "password": "",
+      "log_file_name": "redis.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "smb": {
+      "port": 445,
+      "ip": "0.0.0.0",
+      "username": "administrator",
+      "password": "123456",
+      "log_file_name": "smb.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "smtp": {
+      "port": 25,
+      "ip": "0.0.0.0",
+      "username": "root",
+      "password": "123456",
+      "log_file_name": "smtp.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "socks5": {
+      "port": 1080,
+      "ip": "0.0.0.0",
+      "username": "admin",
+      "password": "admin",
+      "log_file_name": "socks5.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "ssh": {
+      "port": 22,
+      "ip": "0.0.0.0",
+      "username": "root",
+      "password": "123456",
+      "log_file_name": "ssh.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "telnet": {
+      "port": 23,
+      "ip": "0.0.0.0",
+      "username": "root",
+      "password": "123456",
+      "log_file_name": "telnet.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "vnc": {
+      "port": 5900,
+      "ip": "0.0.0.0",
+      "username": "administrator",
+      "password": "123456",
+      "log_file_name": "vnc.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "elastic": {
+      "port": 9200,
+      "ip": "0.0.0.0",
+      "username": "elastic",
+      "password": "123456",
+      "log_file_name": "elastic.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "mssql": {
+      "port": 1433,
+      "ip": "0.0.0.0",
+      "username": "sa",
+      "password": "",
+      "log_file_name": "mssql.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "ldap": {
+      "port": 389,
+      "ip": "0.0.0.0",
+      "username": "administrator",
+      "password": "123456",
+      "log_file_name": "ldap.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "ntp": {
+      "port": 123,
+      "ip": "0.0.0.0",
+      "username": "administrator",
+      "password": "123456",
+      "log_file_name": "ntp.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "memcache": {
+      "port": 11211,
+      "ip": "0.0.0.0",
+      "username": "admin",
+      "password": "123456",
+      "log_file_name": "memcache.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "oracle": {
+      "port": 1521,
+      "ip": "0.0.0.0",
+      "username": "bi",
+      "password": "123456",
+      "log_file_name": "oracle.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    },
+    "snmp": {
+      "port": 161,
+      "ip": "0.0.0.0",
+      "username": "privUser",
+      "password": "123456",
+      "log_file_name": "snmp.log",
+      "max_bytes": 10000,
+      "backup_count": 10
+    }
+  }
 }
--- a/etc/compose/collector.yml
+++ b/etc/compose/collector.yml
@ -175,18 +175,6 @@ services:
    volumes:
     - /data:/data

-## Elasticsearch-head service
-  head:
-    container_name: head
-    restart: always
-    depends_on:
-      elasticsearch:
-        condition: service_healthy
-    ports:
-     - "127.0.0.1:64302:9100"
-    image: "dtagdevsec/head:2203"
-    read_only: true
-
 # Ewsposter service
  ewsposter:
    container_name: ewsposter
--- a/etc/compose/hive.yml
+++ b/etc/compose/hive.yml
@ -76,18 +76,6 @@ services:
    volumes:
     - /data:/data

-## Elasticsearch-head service
-  head:
-    container_name: head
-    restart: always
-    depends_on:
-      elasticsearch:
-        condition: service_healthy
-    ports:
-     - "127.0.0.1:64302:9100"
-    image: "dtagdevsec/head:2203"
-    read_only: true
-
 # Nginx service
  nginx:
    container_name: nginx
--- a/etc/compose/industrial.yml
+++ b/etc/compose/industrial.yml
@ -382,18 +382,6 @@ services:
    volumes:
     - /data:/data

-## Elasticsearch-head service
-  head:
-    container_name: head
-    restart: always
-    depends_on:
-      elasticsearch:
-        condition: service_healthy
-    ports:
-     - "127.0.0.1:64302:9100"
-    image: "dtagdevsec/head:2203"
-    read_only: true
-
 # Ewsposter service
  ewsposter:
    container_name: ewsposter
--- a/etc/compose/log4j.yml
+++ b/etc/compose/log4j.yml
@ -165,18 +165,6 @@ services:
    volumes:
     - /data:/data

-## Elasticsearch-head service
-  head:
-    container_name: head
-    restart: always
-    depends_on:
-      elasticsearch:
-        condition: service_healthy
-    ports:
-     - "127.0.0.1:64302:9100"
-    image: "dtagdevsec/head:2203"
-    read_only: true
-
 # Ewsposter service
  ewsposter:
    container_name: ewsposter
--- a/etc/compose/medical.yml
+++ b/etc/compose/medical.yml
@ -159,18 +159,6 @@ services:
    volumes:
     - /data:/data

-## Elasticsearch-head service
-  head:
-    container_name: head
-    restart: always
-    depends_on:
-      elasticsearch:
-        condition: service_healthy
-    ports:
-     - "127.0.0.1:64302:9100"
-    image: "dtagdevsec/head:2203"
-    read_only: true
-
 # Ewsposter service
  ewsposter:
    container_name: ewsposter
--- a/etc/compose/mini.yml
+++ b/etc/compose/mini.yml
@ -184,18 +184,6 @@ services:
    volumes:
     - /data:/data

-## Elasticsearch-head service
-  head:
-    container_name: head
-    restart: always
-    depends_on:
-      elasticsearch:
-        condition: service_healthy
-    ports:
-     - "127.0.0.1:64302:9100"
-    image: "dtagdevsec/head:2203"
-    read_only: true
-
 # Ewsposter service
  ewsposter:
    container_name: ewsposter
--- a/etc/compose/nextgen.yml
+++ b/etc/compose/nextgen.yml
@ -525,18 +525,6 @@ services:
    volumes:
     - /data:/data

-## Elasticsearch-head service
-  head:
-    container_name: head
-    restart: always
-    depends_on:
-      elasticsearch:
-        condition: service_healthy
-    ports:
-     - "127.0.0.1:64302:9100"
-    image: "dtagdevsec/head:2203"
-    read_only: true
-
 # Ewsposter service
  ewsposter:
    container_name: ewsposter
--- a/etc/compose/standard.yml
+++ b/etc/compose/standard.yml
@ -558,18 +558,6 @@ services:
    volumes:
     - /data:/data

-## Elasticsearch-head service
-  head:
-    container_name: head
-    restart: always
-    depends_on:
-      elasticsearch:
-        condition: service_healthy
-    ports:
-     - "127.0.0.1:64302:9100"
-    image: "dtagdevsec/head:2203"
-    read_only: true
-
 # Ewsposter service
  ewsposter:
    container_name: ewsposter