# Kibana default netflow dashboards

**URL:** <https://discuss.elastic.co/t/kibana-default-netflow-dashboards/133258>\
**Category:** Kibana\
**Created:** [May 25, 2018, 6:04am UTC](https://discuss.elastic.co/t/kibana-default-netflow-dashboards/133258 "2018-05-25T06:04:50Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![venki522](https://avatars.discourse-cdn.com/v4/letter/v/90db22/32.png) [@venki522](https://discuss.elastic.co/u/venki522)\
**Post date:** [May 25, 2018, 6:04am UTC](https://discuss.elastic.co/t/kibana-default-netflow-dashboards/133258/1 "2018-05-25T06:04:51Z")

</div>

```
iam using netflow module for elk stack.iam not able to see the default dashboard in kibana for netflow .Any idea,can some one help on this.

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/9/f9f154b22f72bc8253f0e2632a132f459be9874e.png)

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [May 25, 2018, 9:18am UTC](https://discuss.elastic.co/t/kibana-default-netflow-dashboards/133258/2 "2018-05-25T09:18:24Z")

</div>

Hello,

Did you start Logstash with the --setup flag in order to install the Netflow dashboards in Kibana?  
`bin/logstash --modules netflow --setup -M netflow.var.input.udp.port=NNNN`  
[https://www.elastic.co/guide/en/logstash/current/netflow-module.html](https://www.elastic.co/guide/en/logstash/current/netflow-module.html)

---

<div class="post-metadata">

**Author:** ![venki522](https://avatars.discourse-cdn.com/v4/letter/v/90db22/32.png) [@venki522](https://discuss.elastic.co/u/venki522)\
**Post date:** [May 25, 2018, 9:19am UTC](https://discuss.elastic.co/t/kibana-default-netflow-dashboards/133258/3 "2018-05-25T09:19:51Z")

</div>

it is already started and i see in the discover tab the data but only dashboards are not displayed

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [May 25, 2018, 9:21am UTC](https://discuss.elastic.co/t/kibana-default-netflow-dashboards/133258/4 "2018-05-25T09:21:04Z")

</div>

You can get netflow data even without the --setup flag, that flag only installs the dashboards.

---

<div class="post-metadata">

**Author:** ![venki522](https://avatars.discourse-cdn.com/v4/letter/v/90db22/32.png) [@venki522](https://discuss.elastic.co/u/venki522)\
**Post date:** [May 25, 2018, 9:28am UTC](https://discuss.elastic.co/t/kibana-default-netflow-dashboards/133258/5 "2018-05-25T09:28:50Z")

</div>

.Thanks..so do we need to run that command and stop it or run it in the background

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [May 25, 2018, 9:30am UTC](https://discuss.elastic.co/t/kibana-default-netflow-dashboards/133258/6 "2018-05-25T09:30:28Z")

</div>

if you run it just once, it should be enough to get the dashboards set up and keep your command running that just ingests the Netflow data.

---

<div class="post-metadata">

**Author:** ![venki522](https://avatars.discourse-cdn.com/v4/letter/v/90db22/32.png) [@venki522](https://discuss.elastic.co/u/venki522)\
**Post date:** [May 25, 2018, 9:34am UTC](https://discuss.elastic.co/t/kibana-default-netflow-dashboards/133258/7 "2018-05-25T09:34:44Z")

</div>

so the command need to run continuously to ingest netflow data.So i stop the command the data shown in the dashboard will be stopped.

is there any other way so that netflow data is seen on the dashboard

---

<div class="post-metadata">

**Author:** ![venki522](https://avatars.discourse-cdn.com/v4/letter/v/90db22/32.png) [@venki522](https://discuss.elastic.co/u/venki522)\
**Post date:** [May 25, 2018, 9:36am UTC](https://discuss.elastic.co/t/kibana-default-netflow-dashboards/133258/8 "2018-05-25T09:36:10Z")

</div>

iam also getting this error

[INFO] 2018-05-25 09:35:46.616 [[module-netflow]\<udp] udp - Starting UDP listener {:address=\>"0.0.0.0:2055"}  
[WARN] 2018-05-25 09:35:46.618 [[module-netflow]\<udp] udp - UDP listener died {:exception=\>#\<Errno::EADDRINUSE: Address already in use - bind - Address already in use\>, :backtrace=\>["org/jruby/ext/socket/RubyUDPSocket.java:190:in `bind'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-udp-3.2.1/lib/logstash/inputs/udp.rb:95:in`udp\_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-udp-3.2.1/lib/logstash/inputs/udp.rb:56:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:516:in`inputworker'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:509:in `block in start\_input'"]}

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [May 25, 2018, 9:36am UTC](https://discuss.elastic.co/t/kibana-default-netflow-dashboards/133258/9 "2018-05-25T09:36:35Z")

</div>

You can keep running the command like you were running it before, as long as it was run at least once with the setup flag. Logstash has to run to ingest data and it has to run at least once with `--setup` for the Netflow module dashboards to be installed. After that, the dashboards are there to stay.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 22, 2018, 9:36am UTC](https://discuss.elastic.co/t/kibana-default-netflow-dashboards/133258/10 "2018-06-22T09:36:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
