Anyone using IPFIX?

Elastic Stack Logstash
1

I'm attempting to setup logstash(1.5.2) to accept netflow(ipfix) data from a Barracuda Network Gateway (F280). When i fire up logstash, I get the following warnings over and over.

←[33mIgnoring Netflow version v10 {:level=>:warn}←[0m

my configuration file looks like this

input {
udp {
port => 9995
codec => netflow
}
}
output {
stdout { }
elasticsearch { host => "127.0.0.1" }
}

appreciate any guidance that the community can provide.

2

The "netflow" codec is for decoding Netflow v5/v9 flows.

See Netflow codec plugin | Logstash Reference [8.11] | Elastic

3

Is there an IPFIX codec that is available?

4

Did you ever find a solution for IPFIX?

5

Yes, the latest versions of the codec can handle (some) ipfix data. You’ll just need to give it a shot for yours. Here’s a simple config.

input {

udp {

port => 9996

codec => netflow {

  versions => [10]

    target => "ipfix"

}

type => ipfix

}

}

output {

Output to file rolling by day

file { path => "logs/netflow_events-%{+YYYY-MM-dd}.log" }

Output to ElasticSearch

elasticsearch {

index => "logstash-netflow-%{+YYYY.MM.dd}"

hosts => ["192.168.100.24:9200","192.168.100.24:9201"]

}

}

6

Thank you. This was very helpful and I'm happy to finally get this up and running.