# Netflow support for Brocade Vyatta routers

**URL:** <https://discuss.elastic.co/t/netflow-support-for-brocade-vyatta-routers/83547>\
**Category:** Logstash\
**Created:** [April 25, 2017, 10:47am UTC](https://discuss.elastic.co/t/netflow-support-for-brocade-vyatta-routers/83547 "2017-04-25T10:47:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Amir\_Gohar](https://avatars.discourse-cdn.com/v4/letter/a/e56c9b/32.png) [@Amir\_Gohar](https://discuss.elastic.co/u/Amir_Gohar)\
**Post date:** [April 25, 2017, 10:47am UTC](https://discuss.elastic.co/t/netflow-support-for-brocade-vyatta-routers/83547/1 "2017-04-25T10:47:43Z")

</div>

can logstash plugin for netflow support vyatta routers as well ?  
i am able see my CISCO devices data on elk stack but not able to see the vyatta routers related data, i am aware of the supported exporters list that netflow plugin supports.

Currently VYATTA isn't supported, how hard it is to add support for VYATTA devices or what steps should be taken in order to support it ?

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [April 25, 2017, 5:13pm UTC](https://discuss.elastic.co/t/netflow-support-for-brocade-vyatta-routers/83547/2 "2017-04-25T17:13:22Z")

</div>

There were issues with older versions of the netflow codec, due to the MPLS Label Stack Octet related fields that are part of the Flow record sent by Vyatta (and VyOS) routers. It has worked fine since around November of last year. I use it with two VyOS routers as well as a Ubiquiti EdgeRouter (also a Vyatta community fork). What version of Logstash, or rather the netflow codec, are you using?

Rob

---

<div class="post-metadata">

**Author:** ![Amir\_Gohar](https://avatars.discourse-cdn.com/v4/letter/a/e56c9b/32.png) [@Amir\_Gohar](https://discuss.elastic.co/u/Amir_Gohar)\
**Post date:** [April 26, 2017, 3:14pm UTC](https://discuss.elastic.co/t/netflow-support-for-brocade-vyatta-routers/83547/3 "2017-04-26T15:14:02Z")

</div>

here are the logs i am seeing : [http://dpaste.com/1YCGDTM](http://dpaste.com/1YCGDTM)  
using this image [https://hub.docker.com/r/sebp/elk/](https://hub.docker.com/r/sebp/elk/)

$ docker images  
sebp/elk latest ffd5c3b7cb7d 7 days ago 970.7 MB

Latest is ELK 5.3.0.

here are the configs i used to enable netflow on my gateway:

```auto
set system flow-accounting netflow sampling-rate '250'
set system flow-accounting netflow server {host_ip} port {netflow_port}
set system flow-accounting netflow timeout expiry-interval '60'
set system flow-accounting netflow timeout flow-generic '10'
set system flow-accounting netflow timeout icmp '10'
set system flow-accounting netflow timeout max-active-life '10'
set system flow-accounting netflow timeout tcp-fin '10'
set system flow-accounting netflow timeout tcp-generic '10'
set system flow-accounting netflow timeout tcp-rst '10'
set system flow-accounting netflow timeout udp '10'
set system flow-accounting netflow version '9'
set system flow-accounting syslog-facility 'daemon'

```

I am also able to see the data as well using:  
`tcpdump port 9995`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 24, 2017, 3:19pm UTC](https://discuss.elastic.co/t/netflow-support-for-brocade-vyatta-routers/83547/4 "2017-05-24T15:19:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.