# Setup logstash module netflow

**URL:** <https://discuss.elastic.co/t/setup-logstash-module-netflow/279528>\
**Category:** Logstash\
**Created:** [July 24, 2021, 10:54am UTC](https://discuss.elastic.co/t/setup-logstash-module-netflow/279528 "2021-07-24T10:54:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Muhammed\_Ibrahim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muhammed_ibrahim/32/78264_2.png) [@Muhammed\_Ibrahim](https://discuss.elastic.co/u/Muhammed_Ibrahim)\
**Post date:** [July 24, 2021, 10:54am UTC](https://discuss.elastic.co/t/setup-logstash-module-netflow/279528/1 "2021-07-24T10:54:56Z")

</div>

Dears,  
I need to install netflow dashboard as it's shown in elastic guide by this command :

` sudo bin/logstash --modules netflow --setup --path.settings /etc/logstash/`

but appears this error below :

```auto
Using bundled JDK: /usr/share/logstash/jdk
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
[2021-07-24T10:43:27,176][INFO][logstash.runner] Log4j configuration path used is: /etc/logstash/log4j2.properties
[2021-07-24T10:43:27,189][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"7.13.4", "jruby.version"=>"jruby 9.2.16.0 (2.5.7) 2021-03-03 f82228dc32 OpenJDK 64-Bit Server VM 11.0.11+9 on 11.0.11+9 +indy +jit [linux-x86_64]"}
[2021-07-24T10:43:27,518][INFO][logstash.config.source.modules] Both command-line and logstash.yml modules configurations detected. Using command-line module configuration to override logstash.yml module configuration.
[2021-07-24T10:43:27,527][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2021-07-24T10:43:28,074][INFO][logstash.config.source.modules] Both command-line and logstash.yml modules configurations detected. Using command-line module configuration to override logstash.yml module configuration.
[2021-07-24T10:43:28,160][INFO][logstash.config.modulescommon] Setting up the netflow module
[2021-07-24T10:43:28,362][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
[2021-07-24T10:43:28,659][WARN][logstash.modules.kibanaclient] SSL explicitly disabled; other SSL settings will be ignored
[2021-07-24T10:43:28,802][ERROR][logstash.modules.kibanaclient] Error when executing Kibana client request {:error=>#<Manticore::ResolutionFailure: elktst10: Temporary failure in name resolution>}
[2021-07-24T10:43:29,034][ERROR][logstash.modules.kibanaclient] Error when executing Kibana client request {:error=>#<Manticore::ResolutionFailure: elktst10>}
[2021-07-24T10:43:29,103][ERROR][logstash.config.sourceloader] Could not fetch all the sources {:exception=>LogStash::ConfigLoadingError, :message=>"Failed to import module configurations to Elasticsearch and/or Kibana. Module: netflow has Elasticsearch hosts: [\"localhost:9200\"] and Kibana hosts: [\"elktst10:5601\"]", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:124:in `block in pipeline_configs'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:70:in `pipeline_configs'", "/usr/share/logstash/logstash-core/lib/logstash/config/source/modules.rb:29:in `pipeline_configs'", "/usr/share/logstash/logstash-core/lib/logstash/config/source_loader.rb:76:in `block in fetch'", "org/jruby/RubyArray.java:2572:in `collect'", "/usr/share/logstash/logstash-core/lib/logstash/config/source_loader.rb:75:in `fetch'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:188:in `converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:126:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:409:in `block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}
[2021-07-24T10:43:29,108][ERROR][logstash.agent] An exception happened when converging configuration {:exception=>RuntimeError, :message=>"Could not fetch the configuration, message: Failed to import module configurations to Elasticsearch and/or Kibana. Module: netflow has Elasticsearch hosts: [\"localhost:9200\"] and Kibana hosts: [\"elktst10:5601\"]"}
[2021-07-24T10:43:29,183][INFO][logstash.runner] Logstash shut down.
[2021-07-24T10:43:29,191][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
        at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.16.0.jar:?]
        at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.16.0.jar:?]
        at usr.share.logstash.lib.bootstrap.environment.<main>(/usr/share/logstash/lib/bootstrap/environment.rb:89) ~[?:?]

```

and these are shown when issue command systemctl status logastash.service ::

```auto
Jul 24 10:59:08 ubuntu logstash[16924]: [2021-07-24T10:59:08,079][WARN][logstash.codecs.netflow][module-netflow][f03e49b4b79a5bf12c79499ad1889168892625b5ce9a759a6029c1f702d354c6] Can't (yet) decode flowset id 260 from source id 2193, because no template to decode it w
Jul 24 10:59:08 ubuntu logstash[16924]: [2021-07-24T10:59:08,157][WARN][logstash.codecs.netflow][module-netflow][f03e49b4b79a5bf12c79499ad1889168892625b5ce9a759a6029c1f702d354c6] Can't (yet) decode flowset id 260 from source id 2193, because no template to decode it w
Jul 24 10:59:08 ubuntu logstash[16924]: [2021-07-24T10:59:08,201][WARN][logstash.codecs.netflow][module-netflow][f03e49b4b79a5bf12c79499ad1889168892625b5ce9a759a6029c1f702d354c6] Can't (yet) decode flowset id 260 from source id 2193, because no template to decode it w
Jul 24 10:59:08 ubuntu logstash[16924]: [2021-07-24T10:59:08,263][WARN][logstash.codecs.netflow][module-netflow][f03e49b4b79a5bf12c79499ad1889168892625b5ce9a759a6029c1f702d354c6] Can't (yet) decode flowset id 260 from source id 2193, because no template to decode it w
Jul 24 10:59:08 ubuntu logstash[16924]: [2021-07-24T10:59:08,317][WARN][logstash.codecs.netflow][module-netflow][f03e49b4b79a5bf12c79499ad1889168892625b5ce9a759a6029c1f702d354c6] Can't (yet) decode flowset id 260 from source id 2193, because no template to decode it w
Jul 24 10:59:08 ubuntu logstash[16924]: [2021-07-24T10:59:08,324][INFO][logstash.outputs.elasticsearch][module-netflow] Elasticsearch version determined (7.13.4) {:es_version=>7}
Jul 24 10:59:08 ubuntu logstash[16924]: [2021-07-24T10:59:08,341][WARN][logstash.outputs.elasticsearch][module-netflow] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
Jul 24 10:59:35 ubuntu logstash[16924]: [2021-07-24T10:59:35,466][WARN][logstash.codecs.netflow][module-netflow][f03e49b4b79a5bf12c79499ad1889168892625b5ce9a759a6029c1f702d354c6] Can't (yet) decode flowset id 257 from source id 1, because no template to decode it with
Jul 24 10:59:51 ubuntu logstash[16924]: [2021-07-24T10:59:51,607][WARN][logstash.codecs.netflow][module-netflow][f03e49b4b79a5bf12c79499ad1889168892625b5ce9a759a6029c1f702d354c6] Can't (yet) decode flowset id 257 from source id 1, because no template to decode it with
Jul 24 10:59:56 ubuntu logstash[16924]: [2021-07-24T10:59:56,600][WARN][logstash.codecs.netflow][module-netflow][f03e49b4b79a5bf12c79499ad1889168892625b5ce9a759a6029c1f702d354c6] Can't (yet) decode flowset id 257 from source id 1, because no template to decode it with

```

I'm using 7.13.4

how can I solve it and install netflow dashboard

Thanks

---

<div class="post-metadata">

**Author:** ![cknz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cknz/32/9640_2.png) [@cknz](https://discuss.elastic.co/u/cknz)\
**Post date:** [August 9, 2021, 8:16am UTC](https://discuss.elastic.co/t/setup-logstash-module-netflow/279528/2 "2021-08-09T08:16:46Z")

</div>

The Netflow support in Logstash is deprecated; replaced by similar functionality within Filebeat

[Logstash Netflow Module | Logstash Reference [7.14] | Elastic](https://www.elastic.co/guide/en/logstash/current/netflow-module.html#:~:text=The%20Logstash%20Netflow%20Module%20has,Elastic%20Common%20Schema%20(ECS).&text=Where%20NNNN%20is%20the%20UDP,on%20port%202055%20by%20default).

Remember that Filebeat can easily send to Logstash, so you don't need to disregard Logstash if you don't want to.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 6, 2021, 8:17am UTC](https://discuss.elastic.co/t/setup-logstash-module-netflow/279528/3 "2021-09-06T08:17:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.