What would be the best way to import data from a local Cassandra database for visualization on Grafana?

[zeraeiro]

Hello #community!

I’m wondering what would be the best way to import data from a local Cassandra database into Grafana to be able to build dashboards for TheHive.

I’ve already tried installing the local plugin for Apache Cassandra to extract the data from a local Grafana instance, but was unable to connect, having received the following error:

logger=plugin.hadesarchitect-cassandra-datasource t=2023-05-31T16:25:07.378788856Z level=error msg=“Failed to create Cassandra connection” Message=“cluster.CreateSession: gocql: unable to create session: failed to resolve any of the provided hostnames”

Or, would it be best to try out the cloud option from Grafana, which uses an agent to collect information from Cassandra. And, if you could also please clarify if it’s need anything besides the agent to collect data from Cassandra. I looked at the configuration file and it seemed to require, at least, a Prometheus instance.

Any help would be much appreciated.

[yosiasz]

Welcome @zeraeiro

Could you please show us your cassandra datasource configuration? Where is your grafana installed on in relation to cassandra?

[zeraeiro]

Where is your grafana installed on in relation to cassandra?

It’s in a different subnet but I’m able to nc -v 192.168.xx.xxx 9042 (to the Cassandra instance) from my Grafana instance.

[yosiasz]

could you please show us the error in the grafana log ?

and the user you are using has the proper permissions?

I spun up a local cassandra container and it works fine for me using a user name that has permissions to the keyspace and table

[zeraeiro]

could you please show us the error in the Grafana log ?

logger=plugin.hadesarchitect-cassandra-datasource t=2023-06-01T14:48:30.7733756Z level=error msg=“Failed to create Cassandra connection” Message=“cluster.CreateSession: gocql: unable to create session: failed to resolve any of the provided hostnames”

and the user you are using has the proper permissions?

I’m using the user: cassandra

I didn’t specify a keyspace because I have no idea what that means. Could you please clarify?

Thank you in advance.

[yosiasz]

@zeraeiro

failed to resolve any of the provided hostnames

oops sorry that was in your original post. Anyways keyspace is like database name. but that is the least of your worries now.

The “failed to resolve any of the provided hostnames” indicates some networking issues.

How was this cassandra server installed?

[zeraeiro]

The “failed to resolve any of the provided hostnames” indicates some networking issues.

Like I also stated before, I’m able to netcat to the Cassandra host at port 9042 from the Grafana instance. So it appears that I don’t have any network issues.

How was this cassandra server installed?

Following the steps provide with TheHive 4 installation instructions.

[yosiasz]

@zeraeiro

Following the steps provide with TheHive 4 installation instructions.

Please post these instructions

i used the following compose file

version: '2'

services:
  cassandra:
    image: cassandra
    ports:
      - '7000:7000'
      - '9042:9042'
    volumes:
      - '/podman_volumes/cassandra:/cassandra'
    environment:
      - CASSANDRA_SEEDS=cassandra
      - CASSANDRA_PASSWORD_SEEDER=yes
      - CASSANDRA_PASSWORD=cassandra

[zeraeiro]

Cassandra database[#]

Apache Cassandra is a scalable and high available database. TheHive supports the latest stable version 3.11.x of Cassandra.

Install from repository

DebianRPMOther

1. Add Apache repository references

curl -fsSL https://www.apache.org/dist/cassandra/KEYS | sudo apt-key add -
echo "deb http://www.apache.org/dist/cassandra/debian 311x main" | sudo tee -a /etc/apt/sources.list.d/cassandra.sources.list

2. Install the package

sudo apt update
sudo apt install cassandra

By default, data is stored in /var/lib/cassandra.

Configuration[#]

Start by changing the cluster_name with thp. Run the command cqlsh:

cqlsh localhost 9042

cqlsh> UPDATE system.local SET cluster_name = 'thp' where key='local';

Exit and then run:

nodetool flush

Configure Cassandra by editing /etc/cassandra/cassandra.yaml file.

# content from /etc/cassandra/cassandra.yaml

cluster_name: 'thp'
listen_address: 'xx.xx.xx.xx' # address for nodes
rpc_address: 'xx.xx.xx.xx' # address for clients
seed_provider:
    - class_name: org.apache.cassandra.locator.SimpleSeedProvider
      parameters:
          # Ex: "<ip1>,<ip2>,<ip3>"
          - seeds: 'xx.xx.xx.xx' # self for the first node
data_file_directories:
  - '/var/lib/cassandra/data'
commitlog_directory: '/var/lib/cassandra/commitlog'
saved_caches_directory: '/var/lib/cassandra/saved_caches'
hints_directory: 
  - '/var/lib/cassandra/hints'

Then restart the service:

DebianRPM

service cassandra restart

By default Cassandra listens on 7000/tcp (inter-node), 9042/tcp (client).

Additional configuration[#]

For additional configuration options, refer to:

• [Cassandra documentation page]
• [Datastax documentation page]

Security[#]

To add security measures in Cassandra , refer the the [related administration guide]

Add nodes

To add Cassandra nodes, refer the the [related administration guide

[yosiasz]

https://docs.thehive-project.org/thehive/installation-and-configuration/installation/step-by-step-guide/

I assume it is this one?

[zeraeiro]

It is indeed that one.

[yosiasz]

Can you try the connection with just ip address and port and remove the http?

instead of

[zeraeiro]

That did the trick!

Thank you very much for your kind support!