Logstash 6.2.4 netflow module no packets no bytes

Elastic Stack Logstash
1

Hi,

I am running an ELK stack 6.2 on Ubuntu 16.04. I have netflow configured on my cisco ASA 5515 to come to the server. I can see from tshark that the packets are coming. When I debug logstash I can see it is getting the data. But when I go to Kibana and look at any of the dashboards, I am not getting bytes or packets. I get flow counts, cities, destination IP, source IP etc. I have another product on a windows machine gathering the data from the ASA and it goes through perfectly and shows me the bytes and everything. What am I missing?

2

You should use ElastiFlow...

The Logstash Netflow module was based on ElastiFlow v1.0.0 and is quite dated. Currently ElastiFlow is at v2.1.0 and includes A LOT more functionality. Most important in your case is support for ASA bi-directional flows. This is most likely the reason you don't get bytes and packets.

Rob

Robert Cowart (rob@koiossian.com)
www.koiossian.com
True Turnkey SOLUTIONS for the Elastic Stack

3

Rob,

I am trying to get the ElastiFlow working. I figured I would see what I could get with netflow in the mean time.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.