Netflow input and output

Elastic Stack Logstash
1

Hi all

I need to receive netflow data and output it to multiple destinations (just testing with single destination for now)

Im running logstash 7.15.2 under windows

I made the following logstash config file but it crashes when netflow data is received:

input {
  udp {
    port  => 2055
    codec => netflow
  }
}

output {
  
udp {
    port  => 2055
    codec => netflow
    host => "10.2.0.6"
  }

file {
     path => "c:\netflow\netflow.txt"
  }
}

If I remove the UDP output (leave the file output in) it works fine, I can see netflow data output to a txt file.

Does anyone have any ideas about what is wrong with my netflow output? I cant find any exampls online

Thanks in advance

2

The documentation says the codec is used to decode netflow packets. The code does not have an encode method, so I am not surprised that an exception occurs. I am surprised at what that exception is :smiley: (A stack overflow!)

There is an open issue requesting support for use of the codec on an output.

In short, you cannot use the codec on an output.

3

Just use samplicator to send the UDP packets to multiple destinations.

If it is useful, the ElastiFlow team makes a samplicator docker container available here.

https://hub.docker.com/r/elastiflow/samplicator

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.