Unable to upload netflow data to Elasticsearch with filebeat netflow module

According to the log, only 3 IPFIX packets are received, these 3 packets contain templates (options template template 256 and flow template 335), but no flows, so there is nothing to send to Elasticsearch.

[ipfix] Packet from:10.8.69.21:11170 src:768 seq:2895000
[ipfix] Session 10.8.69.21:11170 reset (sequence=2895000 last=0)
[ipfix] FlowSet ID 3 length 16
[ipfix] state 0xc00015d5c0 addTemplate 256 0xc00015d6c0
Stats total:[ packets=1 dropped=0 flows=0 queue_len=0 ] delta:[ packets/s=1 dropped/s=0 flows/s=0 queue_len/s=+0 ]
[ipfix] Packet from:10.8.69.21:11170 src:768 seq:2895000
[ipfix] FlowSet ID 2 length 16
[ipfix] state 0xc00015d5c0 addTemplate 335 0xc00015d700
Stats total:[ packets=2 dropped=0 flows=0 queue_len=0 ] delta:[ packets/s=1 dropped/s=0 flows/s=0 queue_len/s=+0 ]
[ipfix] Packet from:10.8.69.21:11170 src:768 seq:2895000
[ipfix] FlowSet ID 3 length 16
[ipfix] state 0xc00015d5c0 addTemplate 256 0xc00056fc80
Stats total:[ packets=3 dropped=0 flows=0 queue_len=0 ] delta:[ packets/s=1 dropped/s=0 flows/s=0 queue_len/s=+0 ]

The fact that the sequence number (seq:NNNNNN) doesn't change between packets (always 2895000) is also an indicator that no flows have been sent by the exporter.

You need to review the configuration of your device. It's either not processing any traffic or applying some kind of filtering to the flows.

I recommend you use Wireshark, configure the CFLOW/IPFIX protocol to decode port 2057 and you will be able to see if the packets contain flows: [Data:NNN], or templates: [Data-Template:NNN] and [Options-Template:NNN], as shown below:

For a device operating correctly you should see as in the image, lots of Data packets and a few packets containing templates in between.

1 Like