# Logstash netflow and beats input
**URL:** https://discuss.elastic.co/t/logstash-netflow-and-beats-input/119618
**Category:** Logstash
**Created:** [February 13, 2018, 11:25am UTC](https://discuss.elastic.co/t/logstash-netflow-and-beats-input/119618 "2018-02-13T11:25:29Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@h\_foxit](https://discuss.elastic.co/u/h_foxit)
#### Post date: [February 13, 2018, 11:25am UTC](https://discuss.elastic.co/t/logstash-netflow-and-beats-input/119618/1 "2018-02-13T11:25:29Z")
hi, I want to configure logstash to read from both beats and netflow input .. but what i get is only the beats input that works .. I did check that my router is sending logs on port 555.
any idea why
input {
udp {
port =\> 555
codec =\> netflow {
versions =\> [5,9]
}
type =\> netflow
}
beats {
port =\> 5044
host =\> "0.0.0.0"
ssl =\> true
ssl\_certificate =\> "/etc/logstash/logstash.crt"
ssl\_key =\> "/etc/logstash/logstash.key"
}
}
---
### Author:  [@paz](https://discuss.elastic.co/u/paz)
#### Post date: [February 13, 2018, 1:55pm UTC](https://discuss.elastic.co/t/logstash-netflow-and-beats-input/119618/2 "2018-02-13T13:55:59Z")
Ports below 1024 are the so-called privileged ports, meaning you need to run Logstash under a user with sudo access to have sufficient rights to listen on that port.
You can either try and invoke Logstash as a root user or change the listener (and the appropriate appliance configuration) to a port higher than 1024 and see if that resolves the issue.
---
### Author:  [@h\_foxit](https://discuss.elastic.co/u/h_foxit)
#### Post date: [February 13, 2018, 2:21pm UTC](https://discuss.elastic.co/t/logstash-netflow-and-beats-input/119618/3 "2018-02-13T14:21:49Z")
hi, I did use sudo and a root account .. but nothing happen when I try to ..
I did try the netflow input only and every things is work fine .. any other idea ..
---
### Author:  [@paz](https://discuss.elastic.co/u/paz)
#### Post date: [February 13, 2018, 2:29pm UTC](https://discuss.elastic.co/t/logstash-netflow-and-beats-input/119618/4 "2018-02-13T14:29:25Z")
Hmm, there is (probably) no reason for Netflow input to work alone and not in conjunction with a second input.
Are there any relevant errors in the Logstash logfile? How did you pinpoint that the problem is the input itself?
---
### Author:  [@h\_foxit](https://discuss.elastic.co/u/h_foxit)
#### Post date: [February 13, 2018, 2:40pm UTC](https://discuss.elastic.co/t/logstash-netflow-and-beats-input/119618/5 "2018-02-13T14:40:44Z")
well when I run both inputes I see data comming from beats but nothing from the netflow .. all I see in log file or the debug mode is logstash processing data comming from beats ..
here some
12:02:39.616 [[main]\>worker5] DEBUG logstash.p ipeline - output received {"event"=\>{"xlate\_ty pe"=\>"dynamic", "src\_interface"=\>"B", "src\_xlated\_port"=\>"8074", "source"= \>"some.log", "type"=\>"router", "src\_xlated\_ip"=\>"10.10.8.9", "syslog\_sever ity"=\>"notice", "src\_ip"=\>"10.8.9.9", "p rotocol"=\>"TCP", "syslog\_timestamp"=\>"Feb 13 1 2:01:11", "@version"=\>"1", "beat"=\>{"hostname" =\>"LINUX", "name"=\>"LINUX", "ver sion"=\>"5.5.2"}, "host"=\>"LINUX", "acti on"=\>"Built", "src\_geoip"=\>{}, "ip.device"=\>"10.8.9.90", "syslog\_severity\_code"=\>5, "offset"
when I did switch to netflow only
5:18:55.153 [\[:uint32, :conn\_id]}
---
### Author:  [@h\_foxit](https://discuss.elastic.co/u/h_foxit)
#### Post date: [February 13, 2018, 4:32pm UTC](https://discuss.elastic.co/t/logstash-netflow-and-beats-input/119618/6 "2018-02-13T16:32:40Z")
logstash have nothing to do with this .. it was my fault.. I did analyse the traffic comming from my router the only thing i found is templates .. no input ..
thx for your help .. sorry
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 13, 2018, 4:32pm UTC](https://discuss.elastic.co/t/logstash-netflow-and-beats-input/119618/7 "2018-03-13T16:32:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.