# NetFlow not received in Elasticsearch/Kibana **URL:** \ **Category:** Logstash\ **Created:** [February 16, 2018, 1:48pm UTC](https://discuss.elastic.co/t/netflow-not-received-in-elasticsearch-kibana/120185 "2018-02-16T13:48:29Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![gittinfunky](https://avatars.discourse-cdn.com/v4/letter/g/b5ac83/32.png) [@gittinfunky](https://discuss.elastic.co/u/gittinfunky)\ **Post date:** [February 16, 2018, 1:48pm UTC](https://discuss.elastic.co/t/netflow-not-received-in-elasticsearch-kibana/120185/1 "2018-02-16T13:48:30Z")
I a not receiving any NetFlow information in my ELK Stack and dont know why. ELK Stack setup (version 6.2.1) Cisco 2811 router generating NetFlow info logstash.conf file located in /etc/logstash/conf.d ``` input { udp { host => "localhost" port => 2055 codec => netflow { versions => [5, 9] } type => netflow } output { elasticsearch { hosts => ["localhost:9200"] sniffing => true manage_template => false index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" } } ``` Contents of logstash.yml at /etc/logstash ``` # Settings file in YAML # # Settings can be specified either in hierarchical form, e.g.: # # pipeline: # batch: # size: 125 # delay: 5 # # ------------ Data path ------------------ # # Which directory should be used by logstash and its plugins # for any persistent needs. Defaults to LOGSTASH_HOME/data # path.data: /var/lib/logstash # # ------------ Pipeline Settings -------------- # # The ID of the pipeline. # # pipeline.id: main # # Set the number of workers that will, in parallel, execute the filters+outputs # stage of the pipeline. # # This defaults to the number of the host's CPU cores. # # pipeline.workers: 2 # # How many events to retrieve from inputs before sending to filters+workers # # pipeline.batch.size: 125 # # How long to wait in milliseconds while polling for the next event # before dispatching an undersized batch to filters+outputs # # pipeline.batch.delay: 50 # # Force Logstash to exit during shutdown even if there are still inflight # events in memory. By default, logstash will refuse to quit until all # received events have been pushed to the outputs. # # WARNING: enabling this can lead to data loss during shutdown # # pipeline.unsafe_shutdown: false # # ------------ Pipeline Configuration Settings -------------- # # Where to fetch the pipeline configuration for the main pipeline # #path.config: /etc/logstash/elastiflow/conf.d # # Pipeline configuration string for the main pipeline # # config.string: # # At startup, test if the configuration is valid and exit (dry run) # # config.test_and_exit: false # # Periodically check if the configuration has changed and reload the pipeline # This can also be triggered manually through the SIGHUP signal # # config.reload.automatic: false # # How often to check if the pipeline configuration has changed (in seconds) # # config.reload.interval: 3s # # Show fully compiled configuration as debug log message # NOTE: --log.level must be 'debug' # # config.debug: false # # When enabled, process escaped characters such as \n and \" in strings in the # pipeline configuration files. # # config.support_escapes: false # # ------------ Module Settings --------------- # Define modules here. Modules definitions must be defined as an array. # The simple way to see this is to prepend each `name` with a `-`, and keep # all associated variables under the `name` they are associated with, and # above the next, like this: # # modules: # - name: MODULE_NAME # var.PLUGINTYPE1.PLUGINNAME1.KEY1: VALUE # var.PLUGINTYPE1.PLUGINNAME1.KEY2: VALUE # var.PLUGINTYPE2.PLUGINNAME1.KEY1: VALUE # var.PLUGINTYPE3.PLUGINNAME3.KEY1: VALUE # # Module variable names must be in the format of # # var.PLUGIN_TYPE.PLUGIN_NAME.KEY # # modules: # # ------------ Metrics Settings -------------- # # Bind address for the metrics REST endpoint # # http.host: "127.0.0.1" # # Bind port for the metrics REST endpoint, this option also accept a range # (9600-9700) and logstash will pick up the first available ports. # # http.port: 9600-9700 # # ------------ Debugging Settings -------------- # # Options for log.level: # * fatal # * error # * warn # * info (default) # * debug # * trace # # log.level: info path.logs: /var/log/logstash # # ------------ Other Settings -------------- # # Where to find custom plugins # path.plugins: [] ``` Errors at /var/log/logstash From the logfile ES and logstash appear to start but then later on fails to connect to ES when it tries on 127.0.0.1 event though I have used localhost in my config files Starting server on port: 5044 Pipelines running {:count=\>1, :pipelines=\>["main"]} Elasticsearch pool URLs updated {:changes=\>{:removed=\>[[http://localhost:9200/](http://localhost:9200/)], :added=\>[[http://127.0.0.1:9200/](http://127.0.0.1:9200/)]}} Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://127.0.0.1:9200/](http://127.0.0.1:9200/), :path=\>"/"} Restored connection to ES instance {:url=\>"[http://127.0.0.1:9200/](http://127.0.0.1:9200/)"} SIGTERM received. Shutting down. [2018-02-15T22:49:31,029][WARN][logstash.outputs.elasticsearch] Marking url as dead. Last error: [LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError] Elasticsearch Unreachable: [[http://127.0.0.1:9200/](http://127.0.0.1:9200/)][Manticore::ClientProtocolException] 127.0.0.1:9200 failed to respond {:url=\>[http://127.0.0.1:9200/](http://127.0.0.1:9200/), :error\_message=\>"Elasticsearch Unreachable: [[http://127.0.0.1:9200/](http://127.0.0.1:9200/)] Any ideas on how to why my Netflow data is not appearing in Kibana/ES thanks in advance ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 16, 2018, 1:48pm UTC](https://discuss.elastic.co/t/netflow-not-received-in-elasticsearch-kibana/120185/2 "2018-03-16T13:48:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.