# Logstash sflow **URL:** \ **Category:** Logstash\ **Created:** [May 17, 2016, 9:34am UTC](https://discuss.elastic.co/t/logstash-sflow/50203 "2016-05-17T09:34:35Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Karl\_Trasschaert](https://avatars.discourse-cdn.com/v4/letter/k/f9ae1b/32.png) [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)\ **Post date:** [May 17, 2016, 9:34am UTC](https://discuss.elastic.co/t/logstash-sflow/50203/1 "2016-05-17T09:34:35Z")
Hi, I've read that it's possible to get sflow logs from switches to logstash. Can yo explain me how to do it ? I've followed that tutorial, but nothing appear in my logs: > **[Logstash and sFlow – Whiskey Alpha Romeo](https://whiskeyalpharomeo.com/2015/06/13/logstash-and-sflow/)** > > I looked high and low for examples of people using Elasticsearch - Logstash - Kibana (ELK) to deal with sFlow, and there just wasn't a lot out there. I ended up having to figure it out myself. Thx ---
**Author:** ![Karl\_Trasschaert](https://avatars.discourse-cdn.com/v4/letter/k/f9ae1b/32.png) [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)\ **Post date:** [May 17, 2016, 9:56am UTC](https://discuss.elastic.co/t/logstash-sflow/50203/2 "2016-05-17T09:56:23Z")
I'v foun dthis codec, but how can i install it ? > **[dkiser/logstash-codec-sflow](https://github.com/dkiser/logstash-codec-sflow/tree/master/lib/logstash)** > > logstash-codec-sflow - sflow codec for Logstash ---
**Author:** ![brayndasilva](https://avatars.discourse-cdn.com/v4/letter/b/2bfe46/32.png) [@brayndasilva](https://discuss.elastic.co/u/brayndasilva)\ **Post date:** [May 17, 2016, 12:47pm UTC](https://discuss.elastic.co/t/logstash-sflow/50203/3 "2016-05-17T12:47:22Z")
Hi, What type of switch are you using? ---
**Author:** ![Karl\_Trasschaert](https://avatars.discourse-cdn.com/v4/letter/k/f9ae1b/32.png) [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)\ **Post date:** [May 17, 2016, 1:00pm UTC](https://discuss.elastic.co/t/logstash-sflow/50203/4 "2016-05-17T13:00:15Z")
Extreme Networks Black diamond 8800 and summit X250 - 450 ---
**Author:** ![Karl\_Trasschaert](https://avatars.discourse-cdn.com/v4/letter/k/f9ae1b/32.png) [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)\ **Post date:** [May 17, 2016, 1:00pm UTC](https://discuss.elastic.co/t/logstash-sflow/50203/5 "2016-05-17T13:00:46Z")
hi, i receive datas, but not really clear 🙂 `\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0001\xAC\u0010\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0018S\xF9\xA9\xFA\u0006\u0000\u0000\u0000\v\u0000\u0000\u0000\u0002\u0000\u0000\u0000l\u0000\u0000E%\u0000\u0000\u0003\xF8\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000X\u0000\u0000\u0003\xF8\u0000\u0000\u0000\a\u0000\u0000\u0000\u0000;\x9A\xCA\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0014YP\x82\xE9\u0010o\t-\u0000\u0006\xB7\u0013\u0000\rU\u001D\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\xA0\xDF[\xCD\xF1\u001E\x9DW\xF4\u0003/\xFF\xD1\u0005s\xB1\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0002\u0000\u0000\u0000l\u0000\u0000E%\u0000\u0000\u0004\v\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000X\u0000\u0000\u0004\v\u0000\u0000\u0000\a\u0000\u0000\u0000\u0000;\x9A\xCA\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0003\u0000\u0000\u0000\b\e\x97\xB6\xD6\t\xF3h \u0000\f\xC9t\u0000\u0019\bq\u0000\u0000\u0000\u0000\u0000\u0000\u0000(\u0000\u0000\u0000\u0000\u0000\u0000\u0000d\u001C\xA8\x9A\xC5\u0012\xF8\xEC\xF2\u00033\xE5\xA2\u0005g\x95N\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0002\u0000\u0000\u0000l\u0000\u0000E%\u0000\u0000\a\xD7\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000X\u0000\u0000\a\xD7\u0000\u0000\u0000\a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\xB9\u0004>\u0000\u0001\xA2\x99c\u0000\u0001\xAF\u0011\u0000\u0014'b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\r\xBE\xB0T\u0006\u0003\b\xFD\xCE\u0000\xDA \x94\u0001x\u001Dx\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0002\u0000\u0000\u0000l\u0000\u0000E%\u0000\u0000\a\xEB\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000X\u0000\u0000\a\xEB\u0000\u0000\u0000\a\u0000\u0000\u0000\u0000\u0005\xF5\xE1\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0001\u000E9\xB8g\u0001Lb+\u0000\u0000\u0006\x9C\u0000\u0000\xAF\x90\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u001A\u0005\xC7]\u0001T\x8A\v\u0003\bh\x9C\u0005\x80s\xE1\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0002\u0000\u0000\u0000l\u0000\u0000E%\u0000\u0000\a\xFF\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000X\u0000\u0000\a\xFF\u0000\u0000\u0000\a\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\` ---
**Author:** ![brayndasilva](https://avatars.discourse-cdn.com/v4/letter/b/2bfe46/32.png) [@brayndasilva](https://discuss.elastic.co/u/brayndasilva)\ **Post date:** [May 17, 2016, 1:38pm UTC](https://discuss.elastic.co/t/logstash-sflow/50203/6 "2016-05-17T13:38:46Z")
What does your Logstash configuration look like? Have you configured it to work with sFlow? ---
**Author:** ![Karl\_Trasschaert](https://avatars.discourse-cdn.com/v4/letter/k/f9ae1b/32.png) [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)\ **Post date:** [May 17, 2016, 1:43pm UTC](https://discuss.elastic.co/t/logstash-sflow/50203/7 "2016-05-17T13:43:34Z")
i've just created a input 🙂 input { udp { port =\> 9999 type =\> "sflow" } } that gave me the log in my previous post. i just add this filter: [https://gist.github.com/whiskeyalpharomeo/92538521bb631dd2db38](https://gist.github.com/whiskeyalpharomeo/92538521bb631dd2db38) then i receive no logs anymore. ---
**Author:** ![brayndasilva](https://avatars.discourse-cdn.com/v4/letter/b/2bfe46/32.png) [@brayndasilva](https://discuss.elastic.co/u/brayndasilva)\ **Post date:** [May 17, 2016, 1:47pm UTC](https://discuss.elastic.co/t/logstash-sflow/50203/8 "2016-05-17T13:47:25Z")
What do you want to do with the data? Just have it on your machine locally or visualize it somewhere like on Kibana? Take a look at [https://github.com/NETWAYS/sflow](https://github.com/NETWAYS/sflow) ---
**Author:** ![Karl\_Trasschaert](https://avatars.discourse-cdn.com/v4/letter/k/f9ae1b/32.png) [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)\ **Post date:** [May 17, 2016, 1:48pm UTC](https://discuss.elastic.co/t/logstash-sflow/50203/9 "2016-05-17T13:48:49Z")
yes, get the data and send it to kibana. To be able to see protocols/sources etc.. ---
**Author:** ![brayndasilva](https://avatars.discourse-cdn.com/v4/letter/b/2bfe46/32.png) [@brayndasilva](https://discuss.elastic.co/u/brayndasilva)\ **Post date:** [May 17, 2016, 2:09pm UTC](https://discuss.elastic.co/t/logstash-sflow/50203/10 "2016-05-17T14:09:26Z")
Alright so I assume you already have Kibana and Elasticsearch configured properly. You're missing an output on your configuration file. Logstash is listening to port 9999 for any sflow, but doesn't know what to do with it afterwards. Here is what my configuration looks like for Syslog [http://pastebin.com/QmrKzwm4](http://pastebin.com/QmrKzwm4) I have an input so Logstash knows where to start and receive data from and a output set to elasticsearch. Not sure how filters work for sFlow! Try to add an output pointing to elasticsearch and see if it comes in, into Kibana. Change the index to whatever suits you ---
**Author:** ![Karl\_Trasschaert](https://avatars.discourse-cdn.com/v4/letter/k/f9ae1b/32.png) [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)\ **Post date:** [May 17, 2016, 2:16pm UTC](https://discuss.elastic.co/t/logstash-sflow/50203/11 "2016-05-17T14:16:12Z")
logstash is already working for syslog. i'm bloked here on this process:[https://github.com/NETWAYS/sflow](https://github.com/NETWAYS/sflow) 🙂 sudo bundle exec ./bin/sflow.rb Connecting to Logstash: localhost:9300 Getting switch interface names 2016-05-17 15:16:49 +0100 no name for 10.9.8.3 /usr/lib/ruby/1.9.1/resolv.rb:128:in `getname' /etc/logstash/conf.d/sflow/lib/sflow/snmp/iface_names.rb:8:in`block in initialize' /etc/logstash/conf.d/sflow/lib/sflow/snmp/iface\_names.rb:7:in `each_key' /etc/logstash/conf.d/sflow/lib/sflow/snmp/iface_names.rb:7:in`each' /etc/logstash/conf.d/sflow/lib/sflow/snmp/iface\_names.rb:7:in `initialize' /etc/logstash/conf.d/sflow/lib/sflow/collector.rb:54:in`new' /etc/logstash/conf.d/sflow/lib/sflow/collector.rb:54:in `start_collector' /etc/logstash/conf.d/sflow/bin/sflow.rb:7:in`\' /var/lib/gems/1.9.1/gems/bundler-1.12.4/lib/bundler/cli/exec.rb:63:in `load' /var/lib/gems/1.9.1/gems/bundler-1.12.4/lib/bundler/cli/exec.rb:63:in`kernel\_load' /var/lib/gems/1.9.1/gems/bundler-1.12.4/lib/bundler/cli/exec.rb:24:in `run' /var/lib/gems/1.9.1/gems/bundler-1.12.4/lib/bundler/cli.rb:304:in`exec' /var/lib/gems/1.9.1/gems/bundler-1.12.4/lib/bundler/vendor/thor/lib/thor/command.rb:27:in `run' /var/lib/gems/1.9.1/gems/bundler-1.12.4/lib/bundler/vendor/thor/lib/thor/invocation.rb:126:in`invoke\_command' /var/lib/gems/1.9.1/gems/bundler-1.12.4/lib/bundler/vendor/thor/lib/thor.rb:359:in `dispatch' /var/lib/gems/1.9.1/gems/bundler-1.12.4/lib/bundler/vendor/thor/lib/thor/base.rb:440:in`start' /var/lib/gems/1.9.1/gems/bundler-1.12.4/lib/bundler/cli.rb:11:in `start' /var/lib/gems/1.9.1/gems/bundler-1.12.4/exe/bundle:27:in`block in \' /var/lib/gems/1.9.1/gems/bundler-1.12.4/lib/bundler/friendly\_errors.rb:98:in `with_friendly_errors' /var/lib/gems/1.9.1/gems/bundler-1.12.4/exe/bundle:19:in`\' /usr/local/bin/bundle:23:in `load' /usr/local/bin/bundle:23:in`' bundler: failed to load command: ./bin/sflow.rb (./bin/sflow.rb) RuntimeError: unable to start sflow collector /etc/logstash/conf.d/sflow/lib/sflow/collector.rb:63:in `rescue in start_collector' /etc/logstash/conf.d/sflow/lib/sflow/collector.rb:42:in`start\_collector' /etc/logstash/conf.d/sflow/bin/sflow.rb:7:in `\' ---
**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Post date:** [September 23, 2016, 12:25pm UTC](https://discuss.elastic.co/t/logstash-sflow/50203/12 "2016-09-23T12:25:13Z")
HI karl , Did you fix this issue. Even am facing the same issue.Any inputs from anyone? bundle exec ./bin/sflow.rb Connecting to Logstash: localhost:6543 Getting switch interface names 2016-09-23 13:58:32 +0200 no name for 1.2.3.4 /usr/lib/ruby/2.1.0/resolv.rb:128:in `getname' /home/raj/sflow/lib/sflow/snmp/iface_names.rb:8:in`block in initialize' /home/raj/sflow/lib/sflow/snmp/iface\_names.rb:7:in `each_key' /home/raj/sflow/lib/sflow/snmp/iface_names.rb:7:in`each' /home/raj/sflow/lib/sflow/snmp/iface\_names.rb:7:in `initialize' /home/raj/sflow/lib/sflow/collector.rb:54:in`new' /home/raj/sflow/lib/sflow/collector.rb:54:in `start_collector' /home/raj/sflow/bin/sflow.rb:7:in`\' /var/lib/gems/2.1.0/gems/bundler-1.13.1/lib/bundler/cli/exec.rb:74:in `load' /var/lib/gems/2.1.0/gems/bundler-1.13.1/lib/bundler/cli/exec.rb:74:in`kernel\_load' /var/lib/gems/2.1.0/gems/bundler-1.13.1/lib/bundler/cli/exec.rb:27:in `run' /var/lib/gems/2.1.0/gems/bundler-1.13.1/lib/bundler/cli.rb:332:in`exec' /var/lib/gems/2.1.0/gems/bundler-1.13.1/lib/bundler/vendor/thor/lib/thor/command.rb:27:in `run' /var/lib/gems/2.1.0/gems/bundler-1.13.1/lib/bundler/vendor/thor/lib/thor/invocation.rb:126:in`invoke\_command' /var/lib/gems/2.1.0/gems/bundler-1.13.1/lib/bundler/vendor/thor/lib/thor.rb:359:in `dispatch' /var/lib/gems/2.1.0/gems/bundler-1.13.1/lib/bundler/cli.rb:20:in`dispatch' /var/lib/gems/2.1.0/gems/bundler-1.13.1/lib/bundler/vendor/thor/lib/thor/base.rb:440:in `start' /var/lib/gems/2.1.0/gems/bundler-1.13.1/lib/bundler/cli.rb:11:in`start' /var/lib/gems/2.1.0/gems/bundler-1.13.1/exe/bundle:34:in `block in ' /var/lib/gems/2.1.0/gems/bundler-1.13.1/lib/bundler/friendly_errors.rb:100:in`with\_friendly\_errors' /var/lib/gems/2.1.0/gems/bundler-1.13.1/exe/bundle:26:in `' /usr/local/bin/bundle:22:in`load' /usr/local/bin/bundle:22:in `
' bundler: failed to load command: ./bin/sflow.rb (./bin/sflow.rb) RuntimeError: unable to start sflow collector /home/raj/sflow/lib/sflow/collector.rb:63:in`rescue in start\_collector' /home/raj/sflow/lib/sflow/collector.rb:42:in `start_collector' /home/raj/sflow/bin/sflow.rb:7:in`\' Thanks, Raj ---
**Author:** ![drolfe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drolfe/32/14993_2.png) [@drolfe](https://discuss.elastic.co/u/drolfe)\ **Post date:** [January 29, 2017, 9:50am UTC](https://discuss.elastic.co/t/logstash-sflow/50203/13 "2017-01-29T09:50:17Z")
We were using this for a few years until we seen this native codec [https://www.elastic.co/guide/en/logstash/current/plugins-codecs-sflow.html](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-sflow.html) ---
**Author:** ![drolfe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drolfe/32/14993_2.png) [@drolfe](https://discuss.elastic.co/u/drolfe)\ **Post date:** [February 6, 2017, 4:05pm UTC](https://discuss.elastic.co/t/logstash-sflow/50203/14 "2017-02-06T16:05:53Z")
However The native sflow codec seems to bork the udp input [https://discuss.elastic.co/t/logstash-inputs-udp-eoferror-end-of-file-reached/73212](https://discuss.elastic.co/t/logstash-inputs-udp-eoferror-end-of-file-reached/73212) I can't really find anyway to get sflow though logstash these days on ELK 5.2 If anyone has this working, please share ---
**Author:** ![valeech](https://avatars.discourse-cdn.com/v4/letter/v/b77776/32.png) [@valeech](https://discuss.elastic.co/u/valeech)\ **Post date:** [February 6, 2017, 10:43pm UTC](https://discuss.elastic.co/t/logstash-sflow/50203/15 "2017-02-06T22:43:42Z")
I just did a fresh install on ubuntu 16.04 of ELK 5.2 and have sflow data in Kibana. After installing the .deb pkgs I installed the sflow codec by running this: /usr/share/logstash/bin/logstash-plugin install logstash-codec-sflow Then I configured logstash. Here is my /etc/logstash/logstash.yaml [http://pastebin.com/4uysTEsb](http://pastebin.com/4uysTEsb) Here is my /etc/logstash/conf.d/logstash-sflow.conf [http://pastebin.com/v4LWWZaT](http://pastebin.com/v4LWWZaT) restarted the services and data is flowing. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:28am UTC](https://discuss.elastic.co/t/logstash-sflow/50203/16 "2017-07-06T04:28:51Z")