Filebeat Netflow not getting to Kibana

[Pradeepan (Robert)]

Hi Techs

Filebeat not getting the Netflow logs from Cisco. Not sure where to check. Using Filebeat 7.7.1 ELK also 7.7.1.Filebat , Kibana , Logstash and Elasticserach are running without errors.

Cisco Netflow config is correct.

File beat:
filebeat.inputs:
paths:
- /var/log/*.log
- /var/log/syslog

/etc/filebeat/modules.d$ sudo cat netflow.yml

• module: netflow
  log:
  enabled: true
  var:
  netflow_host: 0.0.0.0
  netflow_port: 2055

Logstash output
hosts: ["localhost:5044"]

Logstash:
/etc/logstash/conf.d$
02-beats-input.conf 10-syslog-filter.conf 30-elasticsearch-output.conf

[Pradeepan (Robert)]

[Pradeepan (Robert)]

I added 3 files under /etc/logstash/conf.d$ . not sure those are required
02-beats-input.conf 10-syslog-filter.conf 30-elasticsearch-output.conf

[Mario_Castro]

Can you check if it's your logstash conf by removing it completely and setting up Filebeat output directly to Elasticsearch? Then, if you see events there, you can confirm that you need to work in the logstash config.