Run netflow moudules failed

Elastic Stack Logstash
1

I have tried to using "bin/logstash --modules netlfow --setup" to start the netflow module.But it does not work.The error log is like:

[ERROR] 2017-12-12 13:39:52.658 [LogStash::Runner] kibanaclient - Error when executing Kibana client request {:error=>#<Manticore::SocketException: Connection refused (Connection refused)>}
[ERROR] 2017-12-12 13:39:52.672 [LogStash::Runner] kibanaclient - Error when executing Kibana client request {:error=>#<Manticore::SocketException: Connection refused (Connection refused)>}
[FATAL] 2017-12-12 13:39:52.691 [LogStash::Runner] runner - An unexpected error occurred! {:error=>#<LogStash::ConfigLoadingError: Failed to import module configurations to Elasticsearch and/or Kibana. Module: netflow has Elasticsearch hosts: ["localhost:9200"] and Kibana hosts: ["localhost:5601"]>, :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:97:in pipeline_configs'", "org/jruby/RubyArray.java:1613:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:56:in pipeline_configs'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:276:inexecute'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:in run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:204:inrun'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132:in run'", "/usr/share/logstash/lib/bootstrap/environment.rb:71:in(root)'"]}

And my configuration of logstash.yml is just like

modules:

  • name: netflow
    var.input.udp.port: 9996
    var.elasticsearch.hosts: "10.62.18.141:9200"
    var.kibana.host: "10.62.18.141:5601"

Is there anyone who can help me ?

2

anyone can help me ?

3

It seems you are unable to connect to Kibana.

Are you certain of the IP address and port? If so, do you have a firewall blocking access?

4

yes i am sure that this ip address and port is correct

image
image.png897×114 4.85 KB

And it seems that it's strange because i set this two ip address as
image

But from the error , it shows that the logstash intend to connect to "localhost:9200" instead of "10.62.18.141:9200"

5

Try enclosing the IP-and-port string in double or single quotes. You have a colon in the string, which can be interpreted in YAML parsing.

6

i wll try that and feedback~

7

still the same .

image
image.png864×189 9.18 KB

i have stopped the logstash and then restart it.
Now i can start the logstash,but the listening port is incorrect.
First of all,i have changed the "http.host" in the logstash.yml.The configuration is as below:
image
image.png908×312 7.36 KB

but the listening port is still 127.0.0.1 instead of 10.71.59.119
Secondary,the netflow port is incorrect,the listening port is now 2055,but my configuration is
image
The last one is , i can not see any netflow index in my elasticsearch..
image
image.png880×53 3.9 KB

Can you help me ?

8

Oops. I forgot. The answer is simple: Remove —modules from your command line. It ignores the modules block in your configuration file when you specify that flag at the command line.

9

if i do not specify the netflow module,i can not use --set parameter,and how can i import the kibana panel or elasticserach ? will it generate the pertinent modules automatically?

10

—setup should still be used, just not —modules

11

I've tried that , but i found some questions
1.if you remove the --modules and using "bin/logstash --setup",it doesn't work and shows like below

image
image.png1147×170 8.93 KB

2.So i've tried to create a sample conf.d file.
image
Then i start the logstash

image
image.png1185×177 7.68 KB

the logstash start successfully,but i can not see any netflow listening port.....

12

Then you’ll have to put those options as command line flags for the setup phase, and after that, you won’t have to do that again.

13

Hi @theuntergeek,

Can you help me? I got some error when setup netflow module.
here is my post https://discuss.elastic.co/t/run-setup-netflow-module-when-ls-is-a-service-was-install-netflow-module-error/109166/16

Thanks so much!

14

Yes , if i using the command line flags as the way,it does work!!!!
Thank you so much,but it seems that in logstash 5.x version, i can not using the netflow module and syslog input as the same time because this is now supported in this version , even if i change the pipeline.workers in the logstash.yml , is that correct ?

15

Yes, that is correct.

16

this is noted , thanks so much , it's been a big help,thank you~

17

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.