Filebeat netflow port 2055 bound to host

[shaikmuzakkir]

Hi

We are using the filebeat image - docker.elastic.co/beats/filebeat:8.4.3 and see the netflow port 2055 is bound to the host. We are using the below config for netflow as input:

    - type: netflow
      max_message_size: 10MiB
      host: "0.0.0.0:2055"
      protocols: [v5,v9,ipfix]
      expiration_timeout: 30m
      queue_size: 81920
      detect_sequence_reset: true

Once the pod is deployed on kubernetes, we see the port 2055 on container bound to the port 2055 on the host? Is that expected?

[ChrsMark (Chris Mark)]

Hey!

Is Filebeat Pod running with hostNetwork setting enabled? See beats/filebeat-daemonset.yaml at main · elastic/beats · GitHub. If so, this is the reason.

[shaikmuzakkir]

Thanks Chris.