# Sflow plugin dont work

**URL:** <https://discuss.elastic.co/t/sflow-plugin-dont-work/233469>\
**Category:** Logstash\
**Created:** [May 20, 2020, 6:30am UTC](https://discuss.elastic.co/t/sflow-plugin-dont-work/233469 "2020-05-20T06:30:10Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![ahiyaz](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@ahiyaz](https://discuss.elastic.co/u/ahiyaz)\
**Post date:** [May 20, 2020, 6:30am UTC](https://discuss.elastic.co/t/sflow-plugin-dont-work/233469/1 "2020-05-20T06:30:11Z")

</div>

hi im new here  
just install logstash as shipper toward [Logz.io](http://Logz.io)  
ive install the sflow input plugin but i dont see logstash listening in any port.  
i have filebeat installed on this agent as well for syslog collecting.  
appreciate any help

thanks

netstat -unlp  
Active Internet connections (only servers)  
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name  
udp 0 0 127.0.0.53:53 0.0.0.0:\* 957/systemd-resolve  
udp 0 0 172.16.0.31:68 0.0.0.0:\* 937/systemd-network  
udp6 0 0 :::9000 :::\* 2851/filebeat

netstat -tnlp  
Active Internet connections (only servers)  
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name  
tcp 0 0 127.0.0.53:53 0.0.0.0:\* LISTEN 957/systemd-resolve  
tcp 0 0 0.0.0.0:22 0.0.0.0:\* LISTEN 2444/sshd  
tcp6 0 0 :::22 :::\* LISTEN 2444/sshd

this is my logstash.yml

" input {  
sflow {  
}  
}  
filter {

# ...

# ...

mutate {  
add\_field =\> { "token" =\> "token" }  
}  
}

output {  
lumberjack {  
hosts =\> ["listener"]  
port =\> 5006  
ssl\_certificate =\> "/usr/share/logstash/keys/TrustExternalCARoot.crt"  
codec =\> "json\_lines"  
}  
} "

---

<div class="post-metadata">

**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\
**Post date:** [May 20, 2020, 7:38am UTC](https://discuss.elastic.co/t/sflow-plugin-dont-work/233469/2 "2020-05-20T07:38:06Z")

</div>

sflow is a codec plugin , not an input plugin. you will need a relevant input plugin. for example, using udp on port 5140

```
input {
  udp {
    port => 5140
    codec => sflow 
  }
}
```

---

<div class="post-metadata">

**Author:** ![ahiyaz](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@ahiyaz](https://discuss.elastic.co/u/ahiyaz)\
**Post date:** [May 20, 2020, 8:15am UTC](https://discuss.elastic.co/t/sflow-plugin-dont-work/233469/3 "2020-05-20T08:15:55Z")

</div>

thanks  
ill try that.  
it just that in "sflow plugin" document [https://www.elastic.co/guide/en/logstash/5.2/plugins-codecs-sflow.html#\_synopsis\_179](https://www.elastic.co/guide/en/logstash/5.2/plugins-codecs-sflow.html#_synopsis_179)

they say that

sflow {  
}

is a Required configuration options

---

<div class="post-metadata">

**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\
**Post date:** [May 20, 2020, 9:29am UTC](https://discuss.elastic.co/t/sflow-plugin-dont-work/233469/4 "2020-05-20T09:29:10Z")

</div>

yeah sorry, you’re right on the sflow config part so it should be

```
input {
  udp {
    port => 5140
    codec => sflow {
                      }
  }
}

```

you will still need input plugin to receive data, then use appropriate codec to decode the incoming data

---

<div class="post-metadata">

**Author:** ![ahiyaz](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@ahiyaz](https://discuss.elastic.co/u/ahiyaz)\
**Post date:** [May 20, 2020, 2:10pm UTC](https://discuss.elastic.co/t/sflow-plugin-dont-work/233469/5 "2020-05-20T14:10:05Z")

</div>

> [@ptamba](#):
>
> input { udp { port =\> 5140 codec =\> sflow { } } }

Hi

still dont work

my logstash.yaml look like this (by the way ive just added all these lines to the bottom of the file)

input {  
udp {  
port =\> 6344  
codec =\> sflow {  
}  
}  
}  
filter {

# ...

# ...

mutate {  
add\_field =\> { "token" =\> "token" }  
}  
}

output {  
lumberjack {  
hosts =\> ["listener"]  
port =\> 5006  
ssl\_certificate =\> "/usr/share/logstash/keys/TrustExternalCARoot.crt"  
codec =\> "json\_lines"  
}  
}

the sflow codec was installed with:  
bin/logstash-plugin install logstash-codec-sflow

thanks for your help

---

<div class="post-metadata">

**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\
**Post date:** [May 20, 2020, 2:22pm UTC](https://discuss.elastic.co/t/sflow-plugin-dont-work/233469/6 "2020-05-20T14:22:28Z")

</div>

are you receiving traffic in port 6344? you can verify it using tcpdump. also check any error messages in logstash

---

<div class="post-metadata">

**Author:** ![ahiyaz](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@ahiyaz](https://discuss.elastic.co/u/ahiyaz)\
**Post date:** [May 20, 2020, 2:58pm UTC](https://discuss.elastic.co/t/sflow-plugin-dont-work/233469/7 "2020-05-20T14:58:07Z")

</div>

> [@ptamba](#):
>
> 6344

hi  
the port is udp 6343 i had a typo in my logstash file  
yes ive verified with tcpdump and do get  
but still the logstash doesn't listen on this port  
whats wired to me is that i see data in debug logstah i get many lines that indicates i get sflow data.

[DEBUG] 2020-05-20 14:34:16.762 [\<udp.2] sflow - sample: {:sample\_entreprise=\>0, :sample\_format=\>1, :sample\_length=\>184, :sample\_data=\>{:flow\_sequence\_number=\>25988, :source\_id\_type=\>0, :source\_id\_index=\>56, :sampling\_rate=\>3000, :sample\_pool=\>77967000, :drops=\>0, :input\_interface=\>29, :output\_interface=\>56, :record\_count=\>1, :records=\>[{:record\_entreprise=\>0, :record\_format=\>1, :record\_length=\>144, :record\_data=\>{:protocol=\>1, :frame\_length=\>218, :stripped=\>4, :header\_size=\>128, :sample\_header=\>{:eth\_dst=\>"80:5e:c0:81:b0:97", :eth\_src=\>"00:09:0f:09:64:12", :eth\_type=\>2048, :eth\_data=\>{:ip\_version=\>4, :ip\_header\_length=\>5, :ip\_dscp=\>24, :ip\_ecn=\>0, :ip\_total\_length=\>200, :ip\_identification=\>33834, :ip\_flags=\>2, :ip\_fragment\_offset=\>0, :ip\_ttl=\>53, :ip\_protocol=\>17, :ip\_checksum=\>38331, :src\_ip=\>"95.179.244.94", :dst\_ip=\>"192.168.22.37", :ip\_data=\>{:src\_port=\>31464, :dst\_port=\>12560, :udp\_length=\>180, :udp\_checksum=\>48750, :data=\>642118823766955424167041796107550112135980852360753918315576936389400020387895746999260112657623053835706227941401018769756421331875833725747028020138910592819586463669544349370893188122784133375678226544550}}}}}]}}  
{  
"sample\_pool" =\> "77967000",  
"eth\_dst" =\> "80:5e:c0:81:b0:97",  
"ip\_protocol" =\> "17",  
"ip\_version" =\> "4",  
"stripped" =\> "4",  
"dst\_port" =\> "12560",  
"frame\_length" =\> "218",  
"agent\_ip" =\> "172.16.0.1",  
"@timestamp" =\> 2020-05-20T14:34:16.769Z,  
"@version" =\> "1",  
"frame\_length\_times\_sampling\_rate" =\> 654000,  
"host" =\> "172.16.0.1",  
"dst\_ip" =\> "192.168.22.37",  
"input\_interface" =\> "29",  
"drops" =\> "0",  
"eth\_src" =\> "00:09:0f:09:64:12",  
"source\_id\_type" =\> "0",  
"src\_port" =\> "31464",  
"eth\_type" =\> "2048",  
"sflow\_type" =\> "flow\_sample",  
"sub\_agent\_id" =\> "0",  
"sampling\_rate" =\> "3000",  
"uptime\_in\_ms" =\> "3407960366",  
"source\_id\_index" =\> "56",  
"output\_interface" =\> "56",  
"protocol" =\> "1",  
"src\_ip" =\> "95.179.244.94"  
}

how can it be??

by the way i get a warning regarding using java ver 11.

---

<div class="post-metadata">

**Author:** ![ahiyaz](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@ahiyaz](https://discuss.elastic.co/u/ahiyaz)\
**Post date:** [May 20, 2020, 3:00pm UTC](https://discuss.elastic.co/t/sflow-plugin-dont-work/233469/8 "2020-05-20T15:00:14Z")

</div>

> [@ptamba](#):
>
> also check any error messages in logstash

ooh  
and i dont have any logs under /var/log/logstash.  
what did you meant by look for errors in logstash?

---

<div class="post-metadata">

**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\
**Post date:** [May 20, 2020, 3:07pm UTC](https://discuss.elastic.co/t/sflow-plugin-dont-work/233469/9 "2020-05-20T15:07:56Z")

</div>

so your logstash is receiving logs. whats the issue then?

---

<div class="post-metadata">

**Author:** ![ahiyaz](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@ahiyaz](https://discuss.elastic.co/u/ahiyaz)\
**Post date:** [May 20, 2020, 3:14pm UTC](https://discuss.elastic.co/t/sflow-plugin-dont-work/233469/10 "2020-05-20T15:14:50Z")

</div>

> [@ptamba](#):
>
> so your logstash is receiving logs. whats the issue then?

you are right  
i was stack on that i cant see it listening to the port (that it is wired)  
but the bottom line it get the data!

now ill go and check my output, due to that i cant see the data on my [logz.io](http://logz.io) account.

thank you for your help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 17, 2020, 3:14pm UTC](https://discuss.elastic.co/t/sflow-plugin-dont-work/233469/11 "2020-06-17T15:14:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.