Listening to multiple ports for Netflow traffic

Elastic Stack Beats
1

Hi,

My filebeat 7.14.0 is currently listening on UDP port 1234 for Netflow packets using the Netflow module. Can I configure my netflow.yml to listen to multiple UDP ports for Netflow packets?

E.g. (netflow.yml)

- module: netflow
  log:
    enabled: true
    var:
      netflow_host: 0.0.0.0
      netflow.port: [1234, 1235, 1236]
      queue_size: 8192

I know the [...] syntax is not accepted by filebeat when specifying the ports, so is there a way to listen to multiple ports in a single filebeat instance, or do I have to run an instance per port? If the latter, can all the filebeat instances output to the same Elasticsearch index?

Thank you.

2

You can do something like

- module: netflow
  log:
    enabled: true
    var:
      netflow_host: 0.0.0.0
      netflow.port: 1234
      queue_size: 8192
- module: netflow
  log:
    enabled: true
    var:
      netflow_host: 0.0.0.0
      netflow.port: 1235
      queue_size: 8192
...
3 Likes
3

So in this case, I would only be running one instance of filebeat, but listening on multiple ports?

4

Correct

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.