# Cisco ASA Netflow

**URL:** <https://discuss.elastic.co/t/cisco-asa-netflow/194107>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 6, 2019, 9:38pm UTC](https://discuss.elastic.co/t/cisco-asa-netflow/194107 "2019-08-06T21:38:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmitriy.y](https://avatars.discourse-cdn.com/v4/letter/d/4da419/32.png) [@dmitriy.y](https://discuss.elastic.co/u/dmitriy.y)\
**Post date:** [August 6, 2019, 9:38pm UTC](https://discuss.elastic.co/t/cisco-asa-netflow/194107/1 "2019-08-06T21:38:28Z")

</div>

I am using latest 7.3 ELK stack with filebeat.  
Configured netflow with the filebeat netflow plugin to monitor my ASA.  
For network.direction i am getting "unknown"  
For network.bytes i am getting just "-"

Any tips would be helpful to troubleshoot.

---

<div class="post-metadata">

**Author:** ![Lantsel](https://avatars.discourse-cdn.com/v4/letter/l/c77e96/32.png) [@Lantsel](https://discuss.elastic.co/u/Lantsel)\
**Post date:** [August 7, 2019, 4:42pm UTC](https://discuss.elastic.co/t/cisco-asa-netflow/194107/2 "2019-08-07T16:42:35Z")

</div>

The issues seems to be due to running ASA version 9.6+  
See the following thread:

> <https://github.com/logstash-plugins/logstash-codec-netflow/issues/112>

Basically modify the  
/usr/share/logstash/modules/netflow/configuration/logstash/netflow.conf.erb  
Line 184 starts.. # Populate bytes transferred in the flow.  
add to the bottom of it  
}  
else if [netflow][fwd\_flow\_delta\_bytes] {  
mutate {  
id =\> "netflow-v9-normalize-bytes-from-fwd\_flow\_bytes"  
rename =\> { "[netflow][fwd\_flow\_delta\_bytes]" =\> "[netflow][bytes]" }  
}  
}  
else if [netflow][rev\_flow\_delta\_bytes] {  
mutate {  
id =\> "netflow-v9-normalize-bytes-from-rev\_flow-bytes"  
rename =\> { "[netflow][rev\_flow\_delta\_bytes]" =\> "[netflow][bytes]" }  
}  
}

This will give you ability to see some packets?  
As for the direction, I have no idea.

That's a partial fix on logstash for filebeat i do not know how to fix it..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2019, 4:42pm UTC](https://discuss.elastic.co/t/cisco-asa-netflow/194107/3 "2019-09-04T16:42:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.