# Filebeat Netflow not getting to Kibana

**URL:** <https://discuss.elastic.co/t/filebeat-netflow-not-getting-to-kibana/237044>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 15, 2020, 1:39am UTC](https://discuss.elastic.co/t/filebeat-netflow-not-getting-to-kibana/237044 "2020-06-15T01:39:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pradeepan](https://avatars.discourse-cdn.com/v4/letter/p/a9a28c/32.png) [@Pradeepan](https://discuss.elastic.co/u/Pradeepan)\
**Post date:** [June 15, 2020, 1:39am UTC](https://discuss.elastic.co/t/filebeat-netflow-not-getting-to-kibana/237044/1 "2020-06-15T01:39:53Z")

</div>

Hi Techs

Filebeat not getting the Netflow logs from Cisco. Not sure where to check. Using Filebeat 7.7.1 ELK also 7.7.1.Filebat , Kibana , Logstash and Elasticserach are running without errors.

Cisco Netflow config is correct.

File beat:  
filebeat.inputs:  
paths:  
- /var/log/\*.log  
- /var/log/syslog

/etc/filebeat/modules.d$ sudo cat netflow.yml

- module: netflow  
log:  
enabled: true  
var:  
netflow\_host: 0.0.0.0  
netflow\_port: 2055

Logstash output  
hosts: ["localhost:5044"]

Logstash:  
/etc/logstash/conf.d$  
02-beats-input.conf 10-syslog-filter.conf 30-elasticsearch-output.conf

---

<div class="post-metadata">

**Author:** ![Pradeepan](https://avatars.discourse-cdn.com/v4/letter/p/a9a28c/32.png) [@Pradeepan](https://discuss.elastic.co/u/Pradeepan)\
**Post date:** [June 15, 2020, 1:44am UTC](https://discuss.elastic.co/t/filebeat-netflow-not-getting-to-kibana/237044/2 "2020-06-15T01:44:23Z")

</div>

![Screen Shot 2020-06-15 at 11.42.29](https://us1.discourse-cdn.com/elastic/original/3X/8/d/8d501a3c95547b69f216f956432d15ef2cb783e3.png) ![Screen Shot 2020-06-15 at 11.41.58](https://us1.discourse-cdn.com/elastic/original/3X/5/1/512e9ec760be61e21a24f6cbf9a2379f4c75d9e8.png) ![Screen Shot 2020-06-15 at 11.41.42](https://us1.discourse-cdn.com/elastic/original/3X/d/1/d1553df73b2ac591fef9306a3a6bcfa2f89b10a8.png) ![Screen Shot 2020-06-15 at 11.41.27](https://us1.discourse-cdn.com/elastic/original/3X/f/e/feb6f1adbf9390e5190620333c62e8cccd9d9de7.png) ![Screen Shot 2020-06-15 at 11.43.56](https://us1.discourse-cdn.com/elastic/original/3X/b/3/b3550bfd6dd4ad1a49209018b0baebb796002e5b.png)

---

<div class="post-metadata">

**Author:** ![Pradeepan](https://avatars.discourse-cdn.com/v4/letter/p/a9a28c/32.png) [@Pradeepan](https://discuss.elastic.co/u/Pradeepan)\
**Post date:** [June 15, 2020, 4:41am UTC](https://discuss.elastic.co/t/filebeat-netflow-not-getting-to-kibana/237044/3 "2020-06-15T04:41:19Z")

</div>

I added 3 files under /etc/logstash/conf.d$ . not sure those are required  
02-beats-input.conf 10-syslog-filter.conf 30-elasticsearch-output.conf

---

<div class="post-metadata">

**Author:** ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)\
**Post date:** [June 15, 2020, 8:39am UTC](https://discuss.elastic.co/t/filebeat-netflow-not-getting-to-kibana/237044/4 "2020-06-15T08:39:50Z")

</div>

Can you check if it's your logstash conf by removing it completely and setting up Filebeat output directly to Elasticsearch? Then, if you see events there, you can confirm that you need to work in the logstash config.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 13, 2020, 10:39am UTC](https://discuss.elastic.co/t/filebeat-netflow-not-getting-to-kibana/237044/5 "2020-07-13T10:39:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.