# Netflow module interface information missing - Elasticsearch 7.3.2 , installed ELK setup ( elasticsearch, Logstash & Kibana)

**URL:** https://discuss.elastic.co/t/netflow-module-interface-information-missing-elasticsearch-7-3-2-installed-elk-setup-elasticsearch-logstash-kibana/224642
**Category:** Logstash
**Created:** [March 23, 2020, 10:10am UTC](https://discuss.elastic.co/t/netflow-module-interface-information-missing-elasticsearch-7-3-2-installed-elk-setup-elasticsearch-logstash-kibana/224642 "2020-03-23T10:10:29Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Yuva](https://avatars.discourse-cdn.com/v4/letter/y/4af34b/32.png) [@Yuva](https://discuss.elastic.co/u/Yuva)
#### Post date: [March 23, 2020, 10:10am UTC](https://discuss.elastic.co/t/netflow-module-interface-information-missing-elasticsearch-7-3-2-installed-elk-setup-elasticsearch-logstash-kibana/224642/1 "2020-03-23T10:10:30Z")

</div>

installed elasticsearch 7.3.2 for storing logs  
and installed logstash 7.3.2 for both shipping as well as processing.  
and installed kibana for visualization tool  
all these three components installed on same machine and enabled netflow module to capture the flow logs from routers and switches to analyze the bandwidth and trafffic flow,

i am able to get successfully all the traffic, except the interface information , like which interface that packet is captured example Gi0/0 or E1/1 or serial or either interface description of the interface atleast,

Added below entries in “/etc/logstash/logstash.yml” ( to enable netflow module on ELK server)

```auto
modules:
  - name: netflow
   	 var.input.udp.port: 9995
 	   var.elasticsearch.hosts: http://127.0.0.1:9200
   	 var.elasticsearch.ssl.enabled: false
   	 var.kibana.host: 127.0.0.1:5601
   	 var.kibana.scheme: http
   	 var.kibana.ssl.enabled: false
   	 var.kibana.ssl.verification_mode: disable

```

to start the netflow module,  
./bin/logstash --path.settings /etc/logstash --modules netflow –setup &

``````auto
configuration enabled on router/switch
flow exporter FLOW_ESLOKB
 destination xx.xx.xx.xx
 source GigabitEthernet0/0
 transport udp 9995
 export-protocol netflow-v5

flow monitor FLOW_MON
 exporter FLOW_ESLOKB
 cache timeout active 60
 record netflow-original
!
interface Gi0/0
ip flow monitor FLOW_MON input
ip flow monitor FLOW_MON output
`````

Regards,
Elaya Raja
``````

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 20, 2020, 10:10am UTC](https://discuss.elastic.co/t/netflow-module-interface-information-missing-elasticsearch-7-3-2-installed-elk-setup-elasticsearch-logstash-kibana/224642/2 "2020-04-20T10:10:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.