# Could nprobe pass netflow to logstash?

**URL:** <https://discuss.elastic.co/t/could-nprobe-pass-netflow-to-logstash/124404>\
**Category:** Logstash\
**Created:** [March 17, 2018, 2:14pm UTC](https://discuss.elastic.co/t/could-nprobe-pass-netflow-to-logstash/124404 "2018-03-17T14:14:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [March 17, 2018, 2:14pm UTC](https://discuss.elastic.co/t/could-nprobe-pass-netflow-to-logstash/124404/1 "2018-03-17T14:14:05Z")

</div>

Hi everyone,  
After passing netflow to nprobe, I want to pass the flow(from nprobe) to logstash.  
Is it feasible?  
because I found that logstash support nprobe:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/4/84040280e073e569b19d98aa38e9f4a989038257.png)  
this is my nprobe command:  
`nprobe /c --zmq "tcp://*:2055" -i none -n none --collector-port 5556`

and this is logstash config:  
input{  
tcp{  
host =\> "120.127.XX.XX"  
port =\> 2055  
codec =\> netflow

}  
}  
filter{

}  
output{  
elasticsearch {  
hosts =\> ["120.127.XX.XX:9200"]  
}

}

logstash log:

```
Plugin: <LogStash::Inputs::Tcp host=>"120.127.160.91", port=>2055, codec=><LogStash::Codecs::Netflow id=>"netflow_6fe69269-594e-493c-a8cd-006506690b87", enable_metric=>true, cache_ttl=>4000, target=>"netflow", include_flowset_id=>false, versions=>[5, 9, 10]>, id=>"bc175652476e57de9639925ceb3be12a38e7b9af470bf65d2374bfa8fd247abf", enable_metric=>true, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>>
  Error: Address already in use: bind
  Exception: Java::JavaNet::BindException
  Stack: sun.nio.ch.Net.bind0(Native Method)
sun.nio.ch.Net.bind(sun/nio/ch/Net.java:433)
sun.nio.ch.Net.bind(sun/nio/ch/Net.java:425)
sun.nio.ch.ServerSocketChannelImpl.bind(sun/nio/ch/ServerSocketChannelImpl.java:223)
sun.nio.ch.ServerSocketAdaptor.bind(sun/nio/ch/ServerSocketAdaptor.java:74)
io.netty.channel.socket.nio.NioServerSocketChannel.doBind(io/netty/channel/socket/nio/NioServerSocketChannel.java:125)
io.netty.channel.AbstractChannel$AbstractUnsafe.bind(io/netty/channel/AbstractChannel.java:554)
io.netty.channel.DefaultChannelPipeline$HeadContext.bind(io/netty/channel/DefaultChannelPipeline.java:1258)
io.netty.channel.AbstractChannelHandlerContext.invokeBind(io/netty/channel/AbstractChannelHandlerContext.java:511)
io.netty.channel.AbstractChannelHandlerContext.bind(io/netty/channel/AbstractChannelHandlerContext.java:496)
io.netty.channel.DefaultChannelPipeline.bind(io/netty/channel/DefaultChannelPipeline.java:980)
io.netty.channel.AbstractChannel.bind(io/netty/channel/AbstractChannel.java:250)
io.netty.bootstrap.AbstractBootstrap$2.run(io/netty/bootstrap/AbstractBootstrap.java:363)
io.netty.util.concurrent.SingleThreadEventExecutor.safeExecute(io/netty/util/concurrent/SingleThreadEventExecutor.java:451)
io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(io/netty/util/concurrent/SingleThreadEventExecutor.java:418)
io.netty.channel.nio.NioEventLoop.run(io/netty/channel/nio/NioEventLoop.java:401)
io.netty.util.concurrent.SingleThreadEventExecutor$5.run(io/netty/util/concurrent/SingleThreadEventExecutor.java:877)
io.netty.util.concurrent.DefaultThreadFactory$DefaultRunnableDecorator.run(io/netty/util/concurrent/DefaultThreadFactory.java:144)
java.lang.Thread.run(java/lang/Thread.java:748)
plugin: <LogStash::Inputs::Tcp host=>"120.127.160.91", port=>2055, codec=><LogStash::Codecs::Netflow id=>"netflow_6fe69269-594e-493c-a8cd-006506690b87", enable_metric=>true, cache_ttl=>4000, target=>"netflow", include_flowset_id=>false, versions=>[5, 9, 10]>, id=>"bc175652476e57de9639925ceb3be12a38e7b9af470bf65d2374bfa8fd247abf", enable_metric=>true, mode=>"server", proxy_protocol=>false, ssl_enable=>false, ssl_verify=>true, ssl_key_passphrase=><password>> Error: Address already in use: bind Exception: Java::JavaNet::BindException Stack: sun.nio.ch.Net.bind0(Native Method)sun.nio.ch.Net.bind(sun/nio/ch/Net.java:433)sun.nio.ch.Net.bind(sun/nio/ch/Net.java:425)sun.nio.ch.ServerSocketChannelImpl.bind(sun/nio/ch/ServerSocketChannelImpl.java:223)sun.nio.ch.ServerSocketAdaptor.bind(sun/nio/ch/ServerSocketAdaptor.java:74)io.netty.channel.socket.nio.NioServerSocketChannel.doBind(io/netty/channel/socket/nio/NioServerSocketChannel.java:125)io.netty.channel.AbstractChannel$AbstractUnsafe.bind(io/netty/channel/AbstractChannel.java:554)io.netty.channel.DefaultChannelPipeline$HeadContext.bind(io/netty/channel/DefaultChannelPipeline.java:1258)io.netty.channel.AbstractChannelHandlerContext.invokeBind(io/netty/channel/AbstractChannelHandlerContext.java:511)io.netty.channel.AbstractChannelHandlerContext.bind(io/netty/channel/AbstractChannelHandlerContext.java:496)io.netty.channel.DefaultChannelPipeline.bind(io/netty/channel/DefaultChannelPipeline.java:980)io.netty.channel.AbstractChannel.bind(io/netty/channel/AbstractChannel.java:250)io.netty.bootstrap.AbstractBootstrap$2.run(io/netty/bootstrap/AbstractBootstrap.java:363)io.netty.util.concurrent.SingleThreadEventExecutor.safeExecute(io/netty/util/concurrent/SingleThreadEventExecutor.java:451)io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(io/netty/util/concurrent/SingleThreadEventExecutor.java:418)io.netty.channel.nio.NioEventLoop.run(io/netty/channel/nio/NioEventLoop.java:401)io.netty.util.concurrent.SingleThreadEventExecutor$5.run(io/netty/util/concurrent/SingleThreadEventExecutor.java:877)io.netty.util.concurrent.DefaultThreadFactory$DefaultRunnableDecorator.run(io/netty/util/concurrent/DefaultThreadFactory.java:144)java.lang.Thread.run(java/lang/Thread.java:748)

```

it seems that Address already in use.  
how can I do ?  
thank you in advance

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 14, 2018, 2:14pm UTC](https://discuss.elastic.co/t/could-nprobe-pass-netflow-to-logstash/124404/2 "2018-04-14T14:14:09Z")

</div>

Closed on April 14, 2018, 2:14pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.