I'm a newbie in ELK, and would like to send Netflow data to ElasticSearch via Filebeat (both on the same server). I'm starting to read all the documentation and configuration guides, but I'm a bit confused about the Filebeat configuration.
It seems like there are 2 ways to configure Netflow input: manually using
filebeat.yml, or using the Netflow module. Am I right to say if I choose to use the filebeat module, I don't have to modify the
filebeat.yml file other than the ES and Kibana portion (setting the
0.0.0.0)? I'll just need to modify
netflow.yml (also setting the
0.0.0.0) and enable it?
My netflow (ipfix) will also include an
app_id field that was added by the vendor. Will the netflow module be able to handle it?