# Netflow Asa & routers **URL:** \ **Category:** Logstash\ **Created:** [October 3, 2016, 7:26pm UTC](https://discuss.elastic.co/t/netflow-asa-routers/62103 "2016-10-03T19:26:25Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![mrognone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrognone/32/16034_2.png) [@mrognone](https://discuss.elastic.co/u/mrognone)\ **Post date:** [October 3, 2016, 7:26pm UTC](https://discuss.elastic.co/t/netflow-asa-routers/62103/1 "2016-10-03T19:26:25Z")
Hi all, I have multiples indexes receiving information from Cisco ASAs & Cisco routers. I created different dashboards with useful information to my company, but i have the same issue in all of these dashboards " bandwidth/time" * * * Cisco ASAs sent the information with the new format of flows {fwd\_netflow\_bytes & rev\_netflow\_bytes) In these cases i created the following visualization in Kibana: Here is the Logstash Configuration of one Asa: ``` input { udp { port => 9933 codec => netflow { versions => [9] } } } filter { if [host] == "xxxxxxxx" { grok { match => { "host" => "xxxxx" } } geoip { add_tag => ["geoip"] database => "/opt/logstash/vendor/geoip/GeoLiteCity.dat" ### Change me to location of GeoLiteCity.dat file source => "ipv4_dst_addr" } if [geoip][city_name] == "" { mutate { remove_field => "[geoip][city_name]" } } if [geoip][continent_code] == "" { mutate { remove_field => "[geoip][continent_code]" } } if [geoip][country_code2] == "" { mutate { remove_field => "[geoip][country_code2]" } } if [geoip][country_code3] == "" { mutate { remove_field => "[geoip][country_code3]" } } if [geoip][country_name] == "" { mutate { remove_field => "[geoip][country_name]" } } if [geoip][latitude] == "" { mutate { remove_field => "[geoip][latitude]" } } if [geoip][longitude] == "" { mutate { remove_field => "[geoip][longitude]" } } if [geoip][postal_code] == "" { mutate { remove_field => "[geoip][postal_code]" } } if [geoip][region_name] == "" { mutate { remove_field => "[geoip][region_name]" } } if [geoip][time_zone] == "" { mutate { remove_field => "[geoip][time_zone]" } } } } output { if [host] == "xxxxxx" { stdout { codec => rubydebug } elasticsearch { manage_template => false index => "logstash-xxxxx_ba%{+YYYY.MM.dd}" hosts => "xxxxxxxx:9200" } } } ``` * * * For Cisco Routers I configured Netflow 9 Format ( the template have Out\_bytes, but logstash did not receive nothing from "out" , only in\_bytes ) anyway I created this visualization in kibana: As an example here is the logstash configuration for one of the routers: ``` input { udp { port => 9912 codec => netflow { ######################definitions => "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-2.1.1/lib/logstash/cod$ versions => [5] } } } output { if [host] == "xxxxxx" { stdout { codec => rubydebug } elasticsearch { manage_template => false index => "logstash-xxxxxx%{+YYYY.MM.dd}" hosts => "xxxxxxxl" sniffing => true } } } ``` * * * * * * Question ASA: - The graphic does not match with the ASDM Cisco Asa Dashboard. Initially I believed that this didn't match for the difference in time between processing time (logstash, elasticsearch, and so on) and ASA. What am I doing wrong? Am I at least on the right path? * * * * * * Question Routers: - Why the netflow V9 and also V5 not sent anything about out\_bytes ??? I created new templates in Elasticsearch, also checked the logstash-codec-netflow, but its seems like the Routers directly not send anything about out\_bytes, because I have the fields out\_bytes & out\_packets in the indexes wihtout information. [I have the Egress & ingress flow configured in the interface that i need to look] \*About In\_bytes The same issue as the Cisco Asa, the graphic does not match with Cacti or Mrtg or directly with the Cache flow in the router. * * * Finally i want to express you that I reviewed all the post that i found about this, i tried multiples configurations, differents templates, differents codecs in logstash, and nothing... Maybe Im on the wrong path with this. Thanks in Advance. ---
**Author:** ![mrognone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrognone/32/16034_2.png) [@mrognone](https://discuss.elastic.co/u/mrognone)\ **Post date:** [October 3, 2016, 7:28pm UTC](https://discuss.elastic.co/t/netflow-asa-routers/62103/2 "2016-10-03T19:28:48Z")
Here are the Visualizations, i need to put them separately because the 5000 characters permitted 🙂 ASA Kibana Visualization: ``` { "index": "logstash-asa_netflow_xxxxx*", "query": { "query_string": { "analyze_wildcard": true, "query": "*" } }, "filter": [] } { "vis": { "legendOpen": true, "colors": { "Sum of netflow.rev_flow_delta_bytes": "#1F78C1", "Sum of netflow.fwd_flow_delta_bytes": "#EA6460", "Input": "#0A50A1", "Output": "#E24D42", "Average netflow.rev_flow_delta_bytes": "#0A437C", "Average netflow.fwd_flow_delta_bytes": "#E24D42" } } } { "title": "xxxxxxx", "type": "line", "params": { "shareYAxis": true, "addTooltip": true, "addLegend": true, "showCircles": true, "smoothLines": false, "interpolate": "linear", "scale": "linear", "drawLinesBetweenPoints": true, "radiusRatio": 9, "times": [], "addTimeMarker": false, "defaultYExtents": false, "setYExtents": false, "yAxis": {} }, "aggs": [ { ``` Router Kibana Visualization: ``` { "index": "logstash-mpls_router_xxxx*", "query": { "query_string": { "query": "*", "analyze_wildcard": true } }, "filter": [] } { "title": "xxxxxxx_In_Bytes", "type": "area", "params": { "shareYAxis": true, "addTooltip": true, "addLegend": true, "smoothLines": false, "scale": "linear", "interpolate": "linear", "mode": "stacked", "times": [], "addTimeMarker": false, "defaultYExtents": false, "setYExtents": false, "yAxis": {} }, "aggs": [ { "id": "1", "type": "sum", ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:36am UTC](https://discuss.elastic.co/t/netflow-asa-routers/62103/3 "2017-07-06T04:36:02Z")