# Netflow Setup Broken? **URL:** \ **Category:** Logstash\ **Created:** [November 16, 2017, 9:22pm UTC](https://discuss.elastic.co/t/netflow-setup-broken/108024 "2017-11-16T21:22:16Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Hank42](https://avatars.discourse-cdn.com/v4/letter/h/94ad74/32.png) [@Hank42](https://discuss.elastic.co/u/Hank42)\ **Post date:** [November 16, 2017, 9:22pm UTC](https://discuss.elastic.co/t/netflow-setup-broken/108024/1 "2017-11-16T21:22:17Z")
Succesfully configured logstash 5.6 with netflow setup for remote Kibana and remote Elasticsearch server as follows: bin/logstash --path.settings /etc/logstash --modules netflow --setup -M netflow.var.input.udp.port=7000 -M var.elasticsearch.hosts="xxx.xxx.xxx.134:5601" -M var.kibana.host="xxx.xxx.xx.133:9200" and in my /etc/logstash.yml file: # var.PLUGIN\_TYPE.PLUGIN\_NAME.KEY modules: - name: netflow var.input.udp.port: 7000 var.elasticsearch.hosts: "xxx.xxx.xxx.134:9200" var.kibana.host: "xxx.xxx.xxx.133:5601" Tried to install a second instance on a new machine, but with freshly downloaded logstash 6.0: bin/logstash --path.settings /etc/logstash --modules netflow --setup -M netflow.var.input.udp.port=7000 -M var.elasticsearch.hosts="xxx.xxx.xxx.134:5601" -M var.kibana.host="xxx.xxx.xx.133:9200" Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties ERROR: Settings 'path.config' (-f) or 'config.string' (-e) can't be used in conjunction with (--modules) or the "modules:" block in the logstash.yml file. usage: bin/logstash -f CONFIG\_PATH [-t] [-r] [] [-w COUNT] [-l LOG] bin/logstash --modules MODULE\_NAME [-M "MODULE\_NAME.var.PLUGIN\_TYPE.PLUGIN\_NAME.VARIABLE\_NAME=VALUE"] [-t] [-w COUNT] [-l LOG] bin/logstash -e CONFIG\_STR [-t] [--log.level fatal|error|warn|info|debug|trace] [-w COUNT] [-l LOG] bin/logstash -i SHELL [--log.level fatal|error|warn|info|debug|trace] bin/logstash -V [--log.level fatal|error|warn|info|debug|trace] bin/logstash --help The error appears to be a bug - if I manually try setting the netflow vars on the command line: bin/logstash --modules netflow --setup -M "var.kibana.host=xxx.xxx.xxx.133:5601" -M "var.elasticsearch.hosts=xxx.xxx.xxx.134:9200" WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console [ERROR] 2017-11-16 16:20:38.744 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] kibanaclient - Error when executing Kibana client request {:error=\>#\} [ERROR] 2017-11-16 16:20:38.758 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] kibanaclient - Error when executing Kibana client request {:error=\>#\} [ERROR] 2017-11-16 16:20:38.785 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] sourceloader - Could not fetch all the sources {:exception=\>LogStash::ConfigLoadingError, :message=\>"Failed to import module configurations to Elasticsearch and/or Kibana. Module: netflow has Elasticsearch hosts: ["localhost:9200"] and Kibana hosts: ["localhost:5601"]", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/config/modules\_common.rb:99:in `block in pipeline_configs'", "org/jruby/RubyArray.java:1734:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/config/modules\_common.rb:56:in `pipeline_configs'", "/usr/share/logstash/logstash-core/lib/logstash/config/source/modules.rb:16:in`pipeline\_configs'", "/usr/share/logstash/logstash-core/lib/logstash/config/source\_loader.rb:59:in `block in fetch'", "org/jruby/RubyArray.java:2481:in`collect'", "/usr/share/logstash/logstash-core/lib/logstash/config/source\_loader.rb:58:in `fetch'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:148:in`converge\_state\_and\_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:362:in`block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]} [ERROR] 2017-11-16 16:20:38.786 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] agent - An exception happened when converging configuration {:exception=>RuntimeError, :message=>"Could not fetch the configuration, message: Failed to import module configurations to Elasticsearch and/or Kibana. Module: netflow has Elasticsearch hosts: [\"localhost:9200\"] and Kibana hosts: [\"localhost:5601\"]", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/agent.rb:155:in`converge\_state\_and\_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:362:in`block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]} It assumes localhost and -obviously- fails. Help? ---
**Author:** ![bgeiger](https://avatars.discourse-cdn.com/v4/letter/b/b19c9b/32.png) [@bgeiger](https://discuss.elastic.co/u/bgeiger)\ **Post date:** [November 18, 2017, 8:04pm UTC](https://discuss.elastic.co/t/netflow-setup-broken/108024/2 "2017-11-18T20:04:29Z")
I just ran into this and eventually figured it out: Comment out the following line in your /etc/logstash/logstash.yml: path.config : /etc/logstash/conf.d/\*.conf Logstash ships with that enabled, but it [apparently] breaks the modules. BG ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 18, 2017, 10:11pm UTC](https://discuss.elastic.co/t/netflow-setup-broken/108024/3 "2017-11-18T22:11:29Z")
Please format your code using the `` button, or markdown style back ticks, it's really hard to read as is 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 16, 2017, 10:11pm UTC](https://discuss.elastic.co/t/netflow-setup-broken/108024/4 "2017-12-16T22:11:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.