# No netflow data in elasticsearch for mikrotik router (fleet agent)

**URL:** <https://discuss.elastic.co/t/no-netflow-data-in-elasticsearch-for-mikrotik-router-fleet-agent/346171>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 1, 2023, 5:29am UTC](https://discuss.elastic.co/t/no-netflow-data-in-elasticsearch-for-mikrotik-router-fleet-agent/346171 "2023-11-01T05:29:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![skestle](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skestle/32/55901_2.png) [@skestle](https://discuss.elastic.co/u/skestle)\
**Post date:** [November 1, 2023, 5:29am UTC](https://discuss.elastic.co/t/no-netflow-data-in-elasticsearch-for-mikrotik-router-fleet-agent/346171/1 "2023-11-01T05:29:39Z")

</div>

I cannot get my mikrotik router Traffic Flow data to appear in elasticstack with my fleet elastic-agent.

Wireshark shows that the data is coming in (and fails when elastic-agent is restarting).  
`sudo softflowd -v 5 -D -i <mikrotik-connected-interface> -t maxlife=1 -p udp -n <my-ip>:2055` works

I've tried:

- changing mikrotik traffic-flow settings to have `src-address` on same subnet, and `version=5/ipfix` (as well as the default 9 that is [not listed as supported](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-netflow.html))
- `netflow_host=0.0.0.0`
- setting my netflow `internal_networks` to "0.0.0.0/0"

---

<div class="post-metadata">

**Author:** ![skestle](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skestle/32/55901_2.png) [@skestle](https://discuss.elastic.co/u/skestle)\
**Post date:** [November 1, 2023, 8:46pm UTC](https://discuss.elastic.co/t/no-netflow-data-in-elasticsearch-for-mikrotik-router-fleet-agent/346171/2 "2023-11-01T20:46:50Z")

</div>

(softflowd is a software traffic sniffer that emits a netflow compatible stream - I'm using it to verify that the beat is working)

---

<div class="post-metadata">

**Author:** ![skestle](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skestle/32/55901_2.png) [@skestle](https://discuss.elastic.co/u/skestle)\
**Post date:** [November 2, 2023, 2:12am UTC](https://discuss.elastic.co/t/no-netflow-data-in-elasticsearch-for-mikrotik-router-fleet-agent/346171/3 "2023-11-02T02:12:00Z")

</div>

After turning agent debug logging on I get messages like

```auto
{"log.level":"debug","@timestamp":"2023-11-02T02:07:26.008Z","message":"PublishEvents: 16 events have been published to elasticsearch in 27.847913ms.","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"netflow-default","type":"netflow"},"log":{"source":"netflow-default"},"service.name":"filebeat","ecs.version":"1.6.0","log.logger":"elasticsearch","log.origin":{"file.line":264,"file.name":"elasticsearch/client.go"},"ecs.version":"1.6.0"}

```

and the Agent Metrics dashboard does indeed show that the events are streaming in (I had syslogs on before, making things difficult to see).

Now I just need to figure out what's happening in the elastic store to hide/drop these events...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 30, 2023, 4:12am UTC](https://discuss.elastic.co/t/no-netflow-data-in-elasticsearch-for-mikrotik-router-fleet-agent/346171/4 "2023-11-30T04:12:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.