# Netflow - Flow data reaching server, Logstash zero output **URL:** \ **Category:** Logstash\ **Created:** [August 16, 2018, 7:15pm UTC](https://discuss.elastic.co/t/netflow-flow-data-reaching-server-logstash-zero-output/144774 "2018-08-16T19:15:12Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![taking-care-of-busin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/taking-care-of-busin/32/34595_2.png) [@taking-care-of-busin](https://discuss.elastic.co/u/taking-care-of-busin)\ **Post date:** [August 16, 2018, 7:15pm UTC](https://discuss.elastic.co/t/netflow-flow-data-reaching-server-logstash-zero-output/144774/1 "2018-08-16T19:15:12Z")
Hello, I have installed an ELK Stack on a Ubuntu 18.04 LXC/Container. I am sending Netflow v9 flows from a Cisco ASR9000 node to Logstash (end purpose is to use Elastiflow), and the flows are getting to the server (confirmed via tcpdump), however I am stuck with having Logstash not being able reading the data. My Logstash configuration is as basic as I could make it: > ``` > root@lxc-ELKNetflow:/etc/logstash/conf.d# more netflow.conf > input { > udp { > port => 9995 > codec => netflow > } > } > output { > stdout { codec => rubydebug } > file { path => "/tmp/netflow.txt" } > } > root@lxc-ELKNetflow:/etc/logstash/conf.d# > > ``` And I am I am not seeing anything being populated in the /tmp/netflow.txt file or in the syslog log. > -rwxrwxrwx 1 logstash root 0 Aug 16 14:13 netflow.txt Here is a snippet of logstash-plain.log > [2018-08-16T14:58:31,576][WARN][logstash.runner] SIGTERM received. Shutting down. > [2018-08-16T14:58:33,775][INFO][logstash.pipeline] Pipeline has terminated {:pipeline\_id=\>"main", :thread=\>"#\"} > [2018-08-16T14:58:50,409][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.3.2"} > [2018-08-16T14:58:53,993][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>8, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50} > [2018-08-16T14:58:54,110][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\"} > [2018-08-16T14:58:54,122][INFO][logstash.inputs.udp] Starting UDP listener {:address=\>"0.0.0.0:9995"} > [2018-08-16T14:58:54,170][INFO][logstash.inputs.udp] UDP listener started {:address=\>"0.0.0.0:9995", :receive\_buffer\_bytes=\>"106496", :queue\_size=\>"2000"} > [2018-08-16T14:58:54,180][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>} > [2018-08-16T14:58:54,477][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} > root@lxc-ELKNetflow-HOTComm:/var/log/logstash# As mentioned, flows are reaching the server: > root@lxc-ELKNetflow:/var/log/logstash# tcpdump -ni eth0 > tcpdump: verbose output suppressed, use -v or -vv for full protocol decode > listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes > 15:13:55.902463 IP 192.168.1.250.11602 \> 172.29.74.8.9995: UDP, length 1324 > 15:13:55.904977 IP 192.168.1.250.11602 \> 172.29.74.8.9995: UDP, length 1392 > 15:13:55.904986 IP 192.168.1.250.11602 \> 172.29.74.8.9995: UDP, length 1392 > 15:13:55.904989 IP 192.168.1.250.11602 \> 172.29.74.8.9995: UDP, length 1260 > 15:13:55.904992 IP 192.168.1.250.11602 \> 172.29.74.8.9995: UDP, length 416 > 15:13:55.904995 IP 192.168.1.250.11602 \> 172.29.74.8.9995: UDP, length 416 > 15:13:55.904997 IP 192.168.1.250.11602 \> 172.29.74.8.9995: UDP, length 352 > 15:13:55.905000 IP 192.168.1.250.11602 \> 172.29.74.8.9995: UDP, length 92 > ^C > 8 packets captured > 13 packets received by filter > 5 packets dropped by kernel > root@lxc-ELKNetflow:/var/log/logstash# ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 16, 2018, 7:28pm UTC](https://discuss.elastic.co/t/netflow-flow-data-reaching-server-logstash-zero-output/144774/2 "2018-08-16T19:28:16Z")
I would try explicitly binding the IP, rather than using 0.0.0.0. ---
**Author:** ![taking-care-of-busin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/taking-care-of-busin/32/34595_2.png) [@taking-care-of-busin](https://discuss.elastic.co/u/taking-care-of-busin)\ **Post date:** [August 16, 2018, 7:36pm UTC](https://discuss.elastic.co/t/netflow-flow-data-reaching-server-logstash-zero-output/144774/3 "2018-08-16T19:36:33Z")
Committed the change, no difference ☹ > root@lxc-ELKNetflow:/etc/logstash/conf.d# cat netflow.conf > input { > udp { > host =\> "172.29.74.8" > port =\> 9995 > codec =\> netflow > } > } > output { > stdout { codec =\> rubydebug } > file { path =\> "/tmp/netflow.txt" } > } > root@lxc-ELKNetflow:/etc/logstash/conf.d# Output from logstash-plain.log: > [2018-08-16T15:30:14,637][WARN][logstash.runner] SIGTERM received. Shutting down. > [2018-08-16T15:30:16,308][INFO][logstash.pipeline] Pipeline has terminated {:pipeline\_id=\>"main", :thread=\>"#\"} > [2018-08-16T15:30:36,005][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.3.2"} > [2018-08-16T15:30:36,486][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, } at line 3, column 21 (byte 37) after input {\n udp {\n host\t\t =\> 172.29", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in `compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:167:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:305:in `block in converge\_state'"]} > [2018-08-16T15:30:36,769][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} > [2018-08-16T15:31:28,439][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.3.2"} > [2018-08-16T15:31:32,437][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>8, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50} > [2018-08-16T15:31:32,710][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\"} > [2018-08-16T15:31:32,738][INFO][logstash.inputs.udp] Starting UDP listener {:address=\>"172.29.74.8:9995"} > [2018-08-16T15:31:32,783][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>} > [2018-08-16T15:31:32,792][INFO][logstash.inputs.udp] UDP listener started {:address=\>"172.29.74.8:9995", :receive\_buffer\_bytes=\>"106496", :queue\_size=\>"2000"} > [2018-08-16T15:31:32,984][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} > root@lxc-ELKNetflow:/etc/logstash/conf.d# Regrettably, no log from syslog or anything being populated on /tmp/netflow.txt: > -rwxrwxrwx 1 logstash root 0 Aug 16 14:13 netflow.txt ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 16, 2018, 7:47pm UTC](https://discuss.elastic.co/t/netflow-flow-data-reaching-server-logstash-zero-output/144774/4 "2018-08-16T19:47:46Z")
I am wondering if the netflow codec is deciding that flowset.records is empty. Try taking the codec off the input. Just to see if it is getting the packets. There are lots of paths where the [decode](https://github.com/logstash-plugins/logstash-codec-netflow/blob/f131bcf0a2202b7ddba22897dfa52dc014bdf0d8/lib/logstash/codecs/netflow.rb#L104) would not reach the yield which creates an event. ---
**Author:** ![taking-care-of-busin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/taking-care-of-busin/32/34595_2.png) [@taking-care-of-busin](https://discuss.elastic.co/u/taking-care-of-busin)\ **Post date:** [August 16, 2018, 8:00pm UTC](https://discuss.elastic.co/t/netflow-flow-data-reaching-server-logstash-zero-output/144774/5 "2018-08-16T20:00:22Z")
Still no difference ☹ > root@lxc-ELKNetflow:/tmp# cat /etc/logstash/conf.d/netflow.conf > input { > udp { > host =\> "172.29.74.8" > port =\> 9995 > } > } > output { > stdout { codec =\> rubydebug } > file { path =\> "/tmp/netflow.txt" } > } > root@lxc-ELKNetflow:/tmp# > root@lxc-ELKNetflow:/tmp# tail -F /var/log/syslog > Aug 16 19:54:32 lxc-ELKNetflow systemd[1]: logstash.service: Failed to reset devices.list: Operation not permitted > Aug 16 19:54:32 lxc-ELKNetflow systemd[1]: Started logstash. > Aug 16 19:54:49 lxc-ELKNetflow logstash[11676]: Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties > Aug 16 19:54:51 lxc-ELKNetflow logstash[11676]: [2018-08-16T15:54:51,296][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.3.2"} > Aug 16 19:54:54 lxc-ELKNetflow logstash[11676]: [2018-08-16T15:54:54,225][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>8, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50} > Aug 16 19:54:54 lxc-ELKNetflow logstash[11676]: [2018-08-16T15:54:54,337][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\"} > Aug 16 19:54:54 lxc-ELKNetflow logstash[11676]: [2018-08-16T15:54:54,369][INFO][logstash.inputs.udp] Starting UDP listener {:address=\>"172.29.74.8:9995"} > Aug 16 19:54:54 lxc-ELKNetflow logstash[11676]: [2018-08-16T15:54:54,416][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>} > Aug 16 19:54:54 lxc-ELKNetflow logstash[11676]: [2018-08-16T15:54:54,416][INFO][logstash.inputs.udp] UDP listener started {:address=\>"172.29.74.8:9995", :receive\_buffer\_bytes=\>"106496", :queue\_size=\>"2000"} > Aug 16 19:54:54 lxc-ELKNetflow logstash[11676]: [2018-08-16T15:54:54,609][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} > > ^C > root@lxc-ELKNetflow:/tmp# > root@lxc-ELKNetflow:/tmp# ls -al /tmp/netflow.txt > -rwxrwxrwx 1 logstash root 0 Aug 16 14:13 /tmp/netflow.txt > root@lxc-ELKNetflow:/tmp# Must be a silly issue. I installed the container today specifically for this purpose. I mean, no FW rules at all: > root@lxc-ELKNetflow:/tmp# iptables -L -nv > Chain INPUT (policy ACCEPT 201K packets, 44M bytes) > pkts bytes target prot opt in out source destination > > Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) > pkts bytes target prot opt in out source destination > > Chain OUTPUT (policy ACCEPT 201K packets, 47M bytes) > pkts bytes target prot opt in out source destination > root@lxc-ELKNetflow:/tmp# ---
**Author:** ![taking-care-of-busin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/taking-care-of-busin/32/34595_2.png) [@taking-care-of-busin](https://discuss.elastic.co/u/taking-care-of-busin)\ **Post date:** [August 17, 2018, 2:08pm UTC](https://discuss.elastic.co/t/netflow-flow-data-reaching-server-logstash-zero-output/144774/6 "2018-08-17T14:08:51Z")
I made progress. I think there are issues when 2 NIC's are being used. In this case, I had one NIC strictly used for listening for Netflow traffic (Logstash was configured to listen to this subnet) and the other NIC to reach Kibana from a Management subnet. When I removed the management subnet from the picture and configured Kibana to listen on the same subnet as the Netflow traffic, Logstash started to see Netflow traffic in the RubyDebug output. Very strange and silly issue. Oh well. Perhaps I overlooked something on the configuration of the ELK Stack?? Hopefully this write up helps others. Spent at least a week on this (on and off). ---
**Author:** ![taking-care-of-busin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/taking-care-of-busin/32/34595_2.png) [@taking-care-of-busin](https://discuss.elastic.co/u/taking-care-of-busin)\ **Post date:** [August 17, 2018, 7:09pm UTC](https://discuss.elastic.co/t/netflow-flow-data-reaching-server-logstash-zero-output/144774/7 "2018-08-17T19:09:21Z")
Another observation is that flapping the interface that listens to the Netflow traffic is needed. Not sure why. Again .. I hope this helps the next person that runs into this issue. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 14, 2018, 7:09pm UTC](https://discuss.elastic.co/t/netflow-flow-data-reaching-server-logstash-zero-output/144774/8 "2018-09-14T19:09:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.