Hi guys , im very exited about watching netflow data on elk. My elk is already working, I added metricbeat and can see nice graphics. Then with similar methods , installed filebeat and enable netflow module following this docs: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-insta…

Ok , this is working now. I change the exporter device and now I can see data on neflow dashboard. I dont know why original exporter didnt work with filebeat netflow module. Same data is propperly parsed with nfcapd. Thanks @stephenb for your help. Leandro.

Some update. Move from centos7 to ubuntu server. Fresh server ... 8Gb RAM.- Same result ... "No results found" on all kibana dashboards. Any idea ?

@leostereo Lets make sure you are getting data Go to Discover and select filebeat-* as the index pattern and make sure you have the time picker set to the correct time range and see if you see the data there. Also in Dev Tools run GET _cat/indices?v You should see filebeat indices listed.

[image] stephenb: GET _cat/indices?v Hi , @stephenb : Please take a look: [Captura de pantalla de 2020-08-30 20-05-29] There is nothing related to netflow here ... perhaps there is the problem.

[image] stephenb: Go to Discover and select filebeat-* as the index pattern and make sure you have the time picker set to the correct time range and see if you see the data there. I think everything looks fine here. I can also see some events related to netflow input. [Captura de pantalla …

Netflow data will end up in filebeat index. That is not netflow though that looks Syslog. Post your: /etc/filebeat/modules.d/netflow.yml Did you configure and enable that? And filebeat.yml Please format them with the </> https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-…

Module is enabled, double checked: tecnetadmin@ubuntu-elk:~$ sudo filebeat modules list [sudo] password for tecnetadmin: Enabled: netflow system tecnetadmin@ubuntu-elk:~$ ls -altr /etc/filebeat/modules.d/netflow.yml -rw-r--r-- 1 root root 212 Aug 30 16:22 /etc/filebeat/modules.d/netflow.yml Mi n…

EDIT that suggestion was not correct...let me look a little more... @leostereo Yes try taking out the netflow input section from the filebeat.yml and just leave the netflow.yml module.

[image] leostereo: Regarding, filter returns: **event.dataset : netflow** doesn't match any options Where did you enter that, in Discover in the search bar just enter event.dataset : netflow

[image] stephenb: Yes try taking out the netflow input section from the filebeat.yml and just leave the netflow.yml module. MMM ...didn work. Removed the input section (keeping the -type: log) And restart filebeat, kibana and elasticsearch. Still can not see the index. I will try removing…

Yes good idea (take everything out but netflow module) that will help isolate then you can see if filebeat is shipping any data.. And you are sure the netflow devices are pointing to this box with filebeat on it?

Filebeat + netflow module , there is nothing to visualize on kibana

Elastic Stack Beats

leostereo (Leostereo) August 30, 2020, 11:04pm 4

Hi , @stephenb:
Please take a look:

There is nothing related to netflow here ... perhaps there is the problem.

Topic		Replies	Views
Netflow data not appears in Elastic search/Kibana Kibana	6	1709	March 8, 2023
Netflow data not appears in Elastic search/Kibana Kibana	2	463	February 8, 2023
Netflow Mikrotik no data in elasticsearch Elasticsearch	21	2045	July 29, 2023
Can't get filebeat Netflow Module to work Beats filebeat	5	2863	January 25, 2021
Unable to upload netflow data to Elasticsearch with filebeat netflow module Beats filebeat	9	2826	February 24, 2020

Filebeat + netflow module , there is nothing to visualize on kibana

Related topics