# Filebeat netflow module application-table
**URL:** https://discuss.elastic.co/t/filebeat-netflow-module-application-table/234862
**Category:** Beats
**Tags:** filebeat
**Created:** [May 29, 2020, 5:51am UTC](https://discuss.elastic.co/t/filebeat-netflow-module-application-table/234862 "2020-05-29T05:51:09Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@adilias3](https://discuss.elastic.co/u/adilias3)
#### Post date: [May 29, 2020, 5:51am UTC](https://discuss.elastic.co/t/filebeat-netflow-module-application-table/234862/1 "2020-05-29T05:51:09Z")
Hi All,
I'm sending flexible netflow with nbar application recognition from a cisco ios router to filebeat netflow module, which stores direct to elasticsearch (not via logstash)
The netflow data arrives something like:
```
action: network_flow
netflow.source_ipv4_address: 10.1.1.5
netflow.source_transport_port : 2048
netflow.destination_ipv4_address: 10.2.1.6
netflow.destination_transport_port: 443
netflow.application_id : 3, 0, 1, 187
network.bytes : 200
```
You can see here that nbar has given the flow the application\_id "3, 0, 1, 187", which doesn't really help me when reporting.
Occasionally the router will send it's application-table, which shows up as:
```
action: netflow_option
netflow.options.application_id: 3, 0, 1, 187
netflow.options.application_name: secure-http
netflow.options.application_description: Secured HTTP
```
How do I go about getting a report like sum(network.bytes) per 'application\_description'
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 26, 2020, 5:51am UTC](https://discuss.elastic.co/t/filebeat-netflow-module-application-table/234862/2 "2020-06-26T05:51:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.