Feature Request Flowbeat!

(Steve Kelley) #1

Love the packet beat analyzer! Is there future plans for analyzing flows? IE: S-Flow, Netflow?

(Tudor Golubenco) #2

Yes, a beat for flows (flowbeat or something) would make sense to me.


and IPFIX :slight_smile:

(Tanya Bragin) #4

For now, there is also a way to get Netflow data into Elasticsearch via Logstash using the UDP input and a Netflow codec:

(Paul Monson) #5

This would be great

(Robert Harris) #6

I would like to see this feature.

(Horst Birne) #7

Something like http://www.pmacct.net/ with direct elasticsearch integration would be great!

(Fabian) #8

Take a look at: https://github.com/FStelzer/flowbeat
It's still a prototype and not all available sflow data is parsed yet but for collecting network metrics from my brocade routers it works rather well.
Feel free to add parsers to the underlying sflow lib :slightly_smiling:

Please be aware that the exported data format will change! Currently it shoves the on-wire data structure directly into elasticsearch which makes metrics on certain fields rather hard.

(Tudor Golubenco) #9

Cool, @FStelzer! You might want to open a pull request to add it https://github.com/elastic/beats/blob/master/libbeat/docs/communitybeats.asciidoc

I can also add it for you if you prefer.

(Mark Jan deJong) #10

I know it's an old thread... I've been using PMACCT for SFlow and NetFlow capture. It has a module to integrate with RabbitMQ. Logstash pulls from RabbitMQ and forwards on to Elastic. The fields are setup by PMACCT so the whole transaction is pretty simple and straight-forward. http://www.pmacct.net/

(Jeremy Foran) #11

Good luck, have you tried using it? Almost ever posting about it is the exact same:

[2017-06-27T18:50:42,504][WARN ][logstash.codecs.netflow ] No matching template for flow id 34237

(gkdlhkdgh) #13

The suggestions for this information are very interesting.