# Filebeat with a combination of netflow and iis

**URL:** <https://discuss.elastic.co/t/filebeat-with-a-combination-of-netflow-and-iis/267131>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 13, 2021, 1:37am UTC](https://discuss.elastic.co/t/filebeat-with-a-combination-of-netflow-and-iis/267131 "2021-03-13T01:37:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\
**Post date:** [March 13, 2021, 1:37am UTC](https://discuss.elastic.co/t/filebeat-with-a-combination-of-netflow-and-iis/267131/1 "2021-03-13T01:37:14Z")

</div>

Hi everyone,

I have an ELK stack running on Ubuntu 20.04 server which is currently ingesting Filebeat IIS logs from a Windows machine.

When I run the filebeat setup command from the Linux server to install the dashboards, index and so on, they install without errors, however when I click on the IIS dashboard or any visualisation nothing is showing up.

Once I run the filebeat command from the Windows machine which is sending the logs everything is fine.

Now, I have enabled netflow module on the Linux server hosting the ELK and the netflow data is coming in. I am afraid to run the filebeat setup from the server to install the dashboards because I take it the working IIS dashboards will get wiped and will stop working?

I don't see any clear instructions on what to do in this case

Thanks

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 13, 2021, 11:58pm UTC](https://discuss.elastic.co/t/filebeat-with-a-combination-of-netflow-and-iis/267131/2 "2021-03-13T23:58:21Z")

</div>

Hi @VamPikmin

I am not sure why you think the IIS dashboards will get wiped out, did you observe that behavior? They should not be by just running setup elsewhere.

If you are concerned,

On the Linux server run

`filebeat modules enable iis`

`filebeat modules enable netflow`

`filebeat setup -e`

Perhaps I am misunderstanding...

---

<div class="post-metadata">

**Author:** ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\
**Post date:** [March 15, 2021, 7:21am UTC](https://discuss.elastic.co/t/filebeat-with-a-combination-of-netflow-and-iis/267131/3 "2021-03-15T07:21:22Z")

</div>

Hi @stephenb

I had some issues with the setup originally. Kibana was only running on localhost and I couldn't install IIS dashboard from filebeat on the server as it was running Linux. Wish I had written down the specifics.

It seems to be okay now

I had to run filebeat setup -e --dashboards /etc/filebeat/filebeat.yml

In filebeat.yml I had to change these

```auto
kibana
  host: "https://192.168.131.140"
  ssl.certificate_authorities: ["/etc/kibana/certs/ca.pem"]

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["192.168.131.140:9200"]
  protocol: "https"
  username: "elastic"
  password: ${ES_PWD}
  ssl.certificate_authorities: ["/etc/kibana/certs/ca.pem"]

```

Thanks for your help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 12, 2021, 9:22am UTC](https://discuss.elastic.co/t/filebeat-with-a-combination-of-netflow-and-iis/267131/4 "2021-04-12T09:22:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.