# CheckPoint Netflow and Elasticsearch

**URL:** <https://discuss.elastic.co/t/checkpoint-netflow-and-elasticsearch/99993>\
**Category:** Logstash\
**Created:** [September 11, 2017, 4:01am UTC](https://discuss.elastic.co/t/checkpoint-netflow-and-elasticsearch/99993 "2017-09-11T04:01:17Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [September 11, 2017, 4:01am UTC](https://discuss.elastic.co/t/checkpoint-netflow-and-elasticsearch/99993/1 "2017-09-11T04:01:17Z")

</div>

Hi Guys,

Is anyone here able to successfully configured netflow on checkpoint with elasticssearch? Is there any such use case? If any one can you help me with logstash configuration?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 12, 2017, 4:04am UTC](https://discuss.elastic.co/t/checkpoint-netflow-and-elasticsearch/99993/2 "2017-09-12T04:04:07Z")

</div>

If you are having problems, then sharing those will help us help you 🙂

---

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [September 13, 2017, 4:43am UTC](https://discuss.elastic.co/t/checkpoint-netflow-and-elasticsearch/99993/3 "2017-09-13T04:43:59Z")

</div>

This is the config I use for my netflow.

```auto
input {
   udp {
     port => 9995
	type => "netflow"
	codec => netflow {
	versions => [9]
}
}
}

filter {
  mutate {
    add_field => {
      "[netflow][ipv4_dst_host]" => "%{[netflow][ipv4_dst_addr]}"
      "[netflow][ipv4_src_host]" => "%{[netflow][ipv4_src_addr]}"
    }
  }

  if ([netflow][l4_dst_port]) {
   mutate {
     add_field => {
      "[netflow][l4_dst_port_translation]" => "%{[netflow][l4_dst_port]}"
     }
   } 
  }

  translate {
    dictionary_path => '/etc/logstash/port_translation.yaml'
    field => "[netflow][l4_dst_port_translation]"
    override => true
    destination => "[netflow][l4_dst_port_translation]"
  }

  dns {
    action => 'replace'
    reverse => "[netflow][ipv4_dst_host]"
  }

  dns {
  action => 'replace'
  reverse => "[netflow][ipv4_src_host]"
  }
}

output {
if [type] == "netflow" {
elasticsearch {
hosts => localhost
user => logstash_internal
password => logstash
index => "netflow-%{+YYYY.MM.dd}"
}
}
}
```

Not pretty but it works. It also performs a reverse look up on IP's and matches port numbers to a dictionary file so on my dashboard I see HTTP/HTTP/DNS etc. instead of the port number.

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [September 13, 2017, 5:32am UTC](https://discuss.elastic.co/t/checkpoint-netflow-and-elasticsearch/99993/4 "2017-09-13T05:32:35Z")

</div>

@Sjaak Does this work with Check Point? Did you try that with Any Netflow or sFlow.

---

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [September 13, 2017, 5:53am UTC](https://discuss.elastic.co/t/checkpoint-netflow-and-elasticsearch/99993/5 "2017-09-13T05:53:59Z")

</div>

I've used that config for pfSense and Fortigate. It should work for every device that can export netflow data.

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [September 13, 2017, 5:55am UTC](https://discuss.elastic.co/t/checkpoint-netflow-and-elasticsearch/99993/6 "2017-09-13T05:55:38Z")

</div>

Cool...let me try that with my ELK statck and what about template?

---

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [September 13, 2017, 6:03am UTC](https://discuss.elastic.co/t/checkpoint-netflow-and-elasticsearch/99993/7 "2017-09-13T06:03:21Z")

</div>

The logstash netflow codec should generate that. If you look at the logs might see see some mismatched template errors but as far as I can tell that never really affected my data.

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [September 17, 2017, 2:08am UTC](https://discuss.elastic.co/t/checkpoint-netflow-and-elasticsearch/99993/8 "2017-09-17T02:08:47Z")

</div>

And what should be port\_translation.yml file? under /etc/logstash

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [September 17, 2017, 12:38pm UTC](https://discuss.elastic.co/t/checkpoint-netflow-and-elasticsearch/99993/9 "2017-09-17T12:38:34Z")

</div>

Well how about geo\_point? I am unable to generate geo point using that logstash file and netflow-index.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 15, 2017, 12:49pm UTC](https://discuss.elastic.co/t/checkpoint-netflow-and-elasticsearch/99993/10 "2017-10-15T12:49:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.