Netflow disable pipeline.yml

Elastic Stack Logstash
1

Hi

Using debian 9.4
logstash 6.3.0-1
kibana 6.3.0
elasticsearch 6.3.0

When I install netflow by comnand it disable all configs via pipeline.yml and all others logstashs output that is under /etc/logstash/conf.d/*,conf stops working.

root@zeus:~# /usr/share/logstash/bin/logstash --modules netflow --setup \

-M "netflow.var.kibana.host=$(hostname -f):5601"
-M "netflow.var.kibana.scheme=https"
-M "netflow.var.kibana.ssl.enabled=true"
-M "netflow.var.kibana.ssl.certificate=/etc/ssl/$(hostname -d)/newcerts/$(hostname -f).crt.pem"
-M "netflow.var.kibana.ssl.key=/etc/ssl/$(hostname -d)/private/$(hostname -f).key.pem"
-M "netflow.var.kibana.ssl.certificate_authority=/etc/ssl/$(hostname -d)/cacert.pem"
-M "netflow.var.elasticsearch.hosts=127.0.0.1:9200"
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[WARN ] 2018-06-28 16:06:50.723 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified

a) Is there a way to use netflow with others logstash arqchives under /etc/logstash/conf/*.conf ?

best regards

2

I am using netflow with elasticflow and it works great!!! You use the pipelines.yml to configure where to find the .conf files and you can put them anywhere. You just install the plugin with this, not install.

3

Hi Dalamar

Using netflow via command or into logstash.yml give me errors...8(

Could you copy adn paste your logstash.yml to see where I wrong?

thanks in advanced

4

Sure thing,

This is the only config I have as far as pipelines and logstash. The conf files I have are the ones from the project page just adjusted for my environment.
- pipeline.id: elastiflow
path.config: "/etc/logstash/elastiflow/conf.d/*.conf"

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.