# Dont count sources bytes and destinations bytes in filebeat netflow

**URL:** <https://discuss.elastic.co/t/dont-count-sources-bytes-and-destinations-bytes-in-filebeat-netflow/372822>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-monitoring\
**Created:** [January 6, 2025, 2:38am UTC](https://discuss.elastic.co/t/dont-count-sources-bytes-and-destinations-bytes-in-filebeat-netflow/372822 "2025-01-06T02:38:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Komeyl\_Pouya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/komeyl_pouya/32/140491_2.png) [@Komeyl\_Pouya](https://discuss.elastic.co/u/Komeyl_Pouya)\
**Post date:** [January 6, 2025, 2:38am UTC](https://discuss.elastic.co/t/dont-count-sources-bytes-and-destinations-bytes-in-filebeat-netflow/372822/1 "2025-01-06T02:38:58Z")

</div>

hi everyone

PLZ help me

i have ELK 8.17 (elasticsearch-logstech-kibana-filebeat) and send netflow from router to filebeat and recive all of netflow in ELK but dont count sources bytes and destinations bytes!!!  
and just collect source and destinations port!!

 ![netflow-03](https://us1.discourse-cdn.com/elastic/original/3X/2/c/2ca1e148ccd94579fb13587470068f50cf869e7c.jpeg)

---

<div class="post-metadata">

**Author:** ![Komeyl\_Pouya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/komeyl_pouya/32/140491_2.png) [@Komeyl\_Pouya](https://discuss.elastic.co/u/Komeyl_Pouya)\
**Post date:** [January 6, 2025, 3:05am UTC](https://discuss.elastic.co/t/dont-count-sources-bytes-and-destinations-bytes-in-filebeat-netflow/372822/2 "2025-01-06T03:05:15Z")

</div>

why source ip and destination ip have error?

 ![netflow-4](https://us1.discourse-cdn.com/elastic/original/3X/9/e/9eeaa40507997df6c6c2b091c2af8eaf52109603.jpeg)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 6, 2025, 3:42am UTC](https://discuss.elastic.co/t/dont-count-sources-bytes-and-destinations-bytes-in-filebeat-netflow/372822/3 "2025-01-06T03:42:36Z")

</div>

Hi @Komeyl_Pouya Welcome to the community...

First I am curious why are you running Filebeat -\> Logstash -\> Elasticsearch instead of just Filebeat-\>Elasticsearch ?

Are you following 3rd party documentation?

I generally recommend Filebeat-\>Elasticsearch first ... WHY because logstash adds extra complexity (may not add any value) and if you do not do everything right... then the correct mappings and pipelines / parsing are not applied. Then the data and the mappings and dashboards might not work right...

So my suggestion is clean everything up and get Filebeat -\> Elasticsearch working first using the netflow modules

Following the steps in the Filebeat quick start and use the netflow module instead of the ngnix modules

> **[Filebeat quick start: installation and configuration | Filebeat Reference...](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html)**

That is my suggestion...

---

<div class="post-metadata">

**Author:** ![Komeyl\_Pouya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/komeyl_pouya/32/140491_2.png) [@Komeyl\_Pouya](https://discuss.elastic.co/u/Komeyl_Pouya)\
**Post date:** [January 6, 2025, 4:08am UTC](https://discuss.elastic.co/t/dont-count-sources-bytes-and-destinations-bytes-in-filebeat-netflow/372822/4 "2025-01-06T04:08:05Z")

</div>

tank you for advice and quick response,  
i tired output filebeat in filebeat.yml put on Elasticsearch and its workd.

but dont show complete all of box doshboard.

the following is an image of empty graphs.  
[Source (bytes) {filebeat netflow}]

 ![net-flow5](https://us1.discourse-cdn.com/elastic/original/3X/2/0/20da615689ee7e1a730af5fa3e210b33925a5953.jpeg)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 6, 2025, 4:16am UTC](https://discuss.elastic.co/t/dont-count-sources-bytes-and-destinations-bytes-in-filebeat-netflow/372822/5 "2025-01-06T04:16:27Z")

</div>

Did you clean up all the existing indices and run the `setup` command? As shown in the quick start.

Also you will need to look at your raw Netflow logs and check sample documents in Discover... To see if the data is there

Share a sample document.. the full json

Seems like the source bytes are there.. why that one Viz is missing.. perhaps go to edit mode and take a look... Could be a simple bug in those 2 Viz

Hmm I don't even remember what those 2 graphs are supposed to be... I will need to find some sample data tomorrow and take a look