My filebeat 7.14.0 is currently listening on UDP port 1234 for Netflow packets using the Netflow module. Can I configure my
netflow.yml to listen to multiple UDP ports for Netflow packets?
- module: netflow log: enabled: true var: netflow_host: 0.0.0.0 netflow.port: [1234, 1235, 1236] queue_size: 8192
I know the
[...] syntax is not accepted by filebeat when specifying the ports, so is there a way to listen to multiple ports in a single filebeat instance, or do I have to run an instance per port? If the latter, can all the filebeat instances output to the same Elasticsearch index?