# Filbeat with netflow as input and elastic output for oss elastic 7.6.1

**URL:** <https://discuss.elastic.co/t/filbeat-with-netflow-as-input-and-elastic-output-for-oss-elastic-7-6-1/320421>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 4, 2022, 6:26am UTC](https://discuss.elastic.co/t/filbeat-with-netflow-as-input-and-elastic-output-for-oss-elastic-7-6-1/320421 "2022-12-04T06:26:58Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![shaikmuzakkir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaikmuzakkir/32/114202_2.png) [@shaikmuzakkir](https://discuss.elastic.co/u/shaikmuzakkir)\
**Post date:** [December 4, 2022, 6:26am UTC](https://discuss.elastic.co/t/filbeat-with-netflow-as-input-and-elastic-output-for-oss-elastic-7-6-1/320421/1 "2022-12-04T06:26:58Z")

</div>

Elastic cluster we have is of open source 7.6.1 version. We need filebeat to have netflow as input and elastic as output to write to our cluster. With filebeat open source, netflow is not enabled as input

ERROR instance/beat.go:971 Exiting: Failed to start crawler: starting input failed: Error while initializing input: Error creating input. No such input type exist: 'netflow'  
Exiting: Failed to start crawler: starting input failed: Error while initializing input: Error creating input. No such input type exist: 'netflow'

and with filebeat licensed, it’s looking for /\_license endpoint.

Connection marked as failed because the onConnect callback failed: cannot retrieve the elasticsearch license from the /\_license endpoint, Filebeat requires the default distribution of Elasticsearch. Please make the endpoint accessible to Filebeat so it can verify the license.: could not retrieve the license information from the cluster: 500 Internal Server Error: {"error":{"root\_cause":[{"type":"security\_exception","reason":"Unexpected exception indices:admin/get"}],"type":"security\_exception","reason":"Unexpected exception indices:admin/get"},"status":500}

Could you please let me know what version/edition of filebeat can help read netflow data and write to elastic opensource?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 5, 2022, 12:35am UTC](https://discuss.elastic.co/t/filbeat-with-netflow-as-input-and-elastic-output-for-oss-elastic-7-6-1/320421/2 "2022-12-05T00:35:43Z")

</div>

FYI 7.6 is very much [EOL](https://www.elastic.co/support/eol) and you should be looking to upgrade as a matter of urgency.

> [@shaikmuzakkir](#):
>
> With filebeat open source, netflow is not enabled as input

Correct, this is not an open source module.

---

<div class="post-metadata">

**Author:** ![shaikmuzakkir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaikmuzakkir/32/114202_2.png) [@shaikmuzakkir](https://discuss.elastic.co/u/shaikmuzakkir)\
**Post date:** [December 5, 2022, 10:36am UTC](https://discuss.elastic.co/t/filbeat-with-netflow-as-input-and-elastic-output-for-oss-elastic-7-6-1/320421/3 "2022-12-05T10:36:27Z")

</div>

Hi @warkolm ,

Thanks for your response. Do you know if the non oss version or the licensed version of filebeat can write to opensource elastic? If yes can you please help identify the appropriate version of filebeat that can read from netflow and write to opensource elastic 7 .6.1?

Thanks,  
Muzakkir

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 5, 2022, 7:56pm UTC](https://discuss.elastic.co/t/filbeat-with-netflow-as-input-and-elastic-output-for-oss-elastic-7-6-1/320421/4 "2022-12-05T19:56:41Z")

</div>

Please see [Support Matrix | Elastic](https://www.elastic.co/support/matrix).

---

<div class="post-metadata">

**Author:** ![shaikmuzakkir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaikmuzakkir/32/114202_2.png) [@shaikmuzakkir](https://discuss.elastic.co/u/shaikmuzakkir)\
**Post date:** [December 6, 2022, 7:09am UTC](https://discuss.elastic.co/t/filbeat-with-netflow-as-input-and-elastic-output-for-oss-elastic-7-6-1/320421/5 "2022-12-06T07:09:25Z")

</div>

Hi @warkolm ,

Thanks for the reponsne. I have used filebeat 7.12.x, 7.11.x version of filebeat - [beats/filebeat:7.12.1 | Docker @ Elastic](https://www.docker.elastic.co/r/beats/filebeat:7.12.1) to write to elastic oss 7.6.1 but see the error:

```auto
Connection marked as failed because the onConnect callback failed: cannot retrieve the elasticsearch license from the /_license endpoint, Filebeat requires the default distribution of Elasticsearch. Please make the endpoint accessible to Filebeat so it can verify the license.: could not retrieve the license information from the cluster: 500 Internal Server Error: {"error":{"root_cause":[{"type":"security_exception","reason":"Unexpected exception indices:admin/get"}],"type":"security_exception","reason":"Unexpected exception indices:admin/get"},"status":500}

```

Can you please let me know how to overcome this issue?

Thanks,  
Muzakkir

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2023, 9:10am UTC](https://discuss.elastic.co/t/filbeat-with-netflow-as-input-and-elastic-output-for-oss-elastic-7-6-1/320421/6 "2023-01-03T09:10:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.