# Netflow data ingested but not showing under SIEM | Network

**URL:** <https://discuss.elastic.co/t/netflow-data-ingested-but-not-showing-under-siem-network/188897>\
**Category:** SIEM\
**Created:** [July 4, 2019, 11:05am UTC](https://discuss.elastic.co/t/netflow-data-ingested-but-not-showing-under-siem-network/188897 "2019-07-04T11:05:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![involuntary-pretzel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/involuntary-pretzel/32/45404_2.png) [@involuntary-pretzel](https://discuss.elastic.co/u/involuntary-pretzel)\
**Post date:** [July 4, 2019, 11:05am UTC](https://discuss.elastic.co/t/netflow-data-ingested-but-not-showing-under-siem-network/188897/1 "2019-07-04T11:05:48Z")

</div>

Hi

I have a fresh install of logstash 7.2 with netflow configure following the /home/tutorial/netflow tutorial, and its pushing data to elastic.cloud (7.2) sucessfully. The Dashboard Netflow: Overview work great and no missing data across visuals.

When I go to SIEM | Overview I notice there is count next to Filebeat Netflow, and SIEM | Network data is empty.

Any idea how I get this to show under SIEM | Network?

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [July 4, 2019, 11:46am UTC](https://discuss.elastic.co/t/netflow-data-ingested-but-not-showing-under-siem-network/188897/2 "2019-07-04T11:46:37Z")

</div>

Unfortunately the Netflow module in Logstash doesn't currently use [ECS](https://github.com/elastic/ecs) fields, which makes it incompatible with the SIEM app.

If it is possible in your setup, we recommend using the Filebeat Netflow input and module instead. That one is fully ECS compatible.

---

<div class="post-metadata">

**Author:** ![involuntary-pretzel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/involuntary-pretzel/32/45404_2.png) [@involuntary-pretzel](https://discuss.elastic.co/u/involuntary-pretzel)\
**Post date:** [July 4, 2019, 12:30pm UTC](https://discuss.elastic.co/t/netflow-data-ingested-but-not-showing-under-siem-network/188897/3 "2019-07-04T12:30:35Z")

</div>

Thanks @tudor, that cleared up the confusion. Switched over to Filebeat:netflow module and data is reporting correctly.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 1, 2019, 12:35pm UTC](https://discuss.elastic.co/t/netflow-data-ingested-but-not-showing-under-siem-network/188897/4 "2019-08-01T12:35:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.