Enable netflow module in filebeat on Rasberry PI

Elastic Stack Beats
1

I am running filebeat 7.3 on a Raspberry PI (running buster) shipping to Elastic cloud 7.3. I compiled filebeat from source following instructions from @andig.

It is already successfuly shipping syslog and nginx logs.

I am having trouble enabling the netflow module (or any module in x-pack for that matter).

This is the result when I try to enable the module:

~/go/src/github.com/elastic/beats/filebeat $ sudo ./filebeat modules enable netflow

Module netflow doesn't exist!

The x-pack modules are located in ~/go/src/github.com/elastic/beats/x-pack/filebeat/module and ~/go/src/github.com/elastic/beats/x-pack/filebeat/modules.d

I have tried the same with the googlecloud module, and have the same problem.

How should x-pack modules be enabled?

2

x-pack is licensed differently, so to include the x-pack modules when building from source you need to build in the x-pack directory:

cd x-pack/filebeat
make mage
mage build

At that point ./filebeat modules enable netflow should work.

3

Thank you. It worked!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.