IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« nats module Nginx module »
Elastic Docs ›Filebeat Reference [7.3] ›Modules

NetFlow module

edit

NetFlow module

edit

This is a module for receiving NetFlow and IPFIX flow records over UDP. This input supports NetFlow versions 1, 5, 6, 7, 8 and 9, as well as IPFIX. For NetFlow versions older than 9, fields are mapped automatically to NetFlow v9.

This module wraps the netflow input to enrich the flow records with geolocation information about the IP endpoints by using Elasticsearch Ingest Node.

Set up and run the module

edit

Before doing these steps, verify that Elasticsearch and Kibana are running and that Elasticsearch is ready to receive data from Filebeat.

If you’re running our hosted Elasticsearch Service on Elastic Cloud, or you’ve enabled security in Elasticsearch and Kibana, you need to specify additional connection information before setting up and running the module. See Quick start: modules for common log formats for the complete setup.

To set up and run the module:

  1. Enable the module:

    deb and rpm:

    filebeat modules enable netflow

    mac:

    ./filebeat modules enable netflow

    brew:

    filebeat modules enable netflow

    linux:

    ./filebeat modules enable netflow

    win:

    PS > .\filebeat.exe modules enable netflow

    This command enables the module config defined in the modules.d directory. See Specify which modules to run for other ways to enable modules.

    To see a list of enabled and disabled modules, run:

    deb and rpm:

    filebeat modules list

    mac:

    ./filebeat modules list

    brew:

    filebeat modules list

    linux:

    ./filebeat modules list

    win:

    PS > .\filebeat.exe modules list

  2. Set up the initial environment:

    deb and rpm:

    filebeat setup -e

    mac:

    ./filebeat setup -e

    linux:

    ./filebeat setup -e

    brew:

    filebeat setup -e

    win:

    PS > .\filebeat.exe setup -e

    The setup command loads the recommended index template for writing to Elasticsearch and deploys the sample dashboards (if available) for visualizing the data in Kibana. This is a one-time setup step.

    The -e flag is optional and sends output to standard error instead of syslog.

    The ingest pipelines used to parse log lines are set up automatically the first time you run the module, assuming the Elasticsearch output is enabled. If you’re sending events to Logstash, or plan to use Beats central management, also see Load ingest pipelines manually.

  3. Run Filebeat.

    If your logs aren’t in the default location, see Configure the module, then run Filebeat after you’ve set the paths variable.

    deb and rpm:

    service filebeat start

    mac:

    ./filebeat -e

    brew:

    filebeat -e

    linux:

    ./filebeat -e

    win:

    PS > Start-Service filebeat

    If the module is configured correctly, you’ll see INFO Harvester started messages for each file specified in the config.

    Depending on how you’ve installed Filebeat, you might see errors related to file ownership or permissions when you try to run Filebeat modules. See Config File Ownership and Permissions in the Beats Platform Reference for more information.

Configure the module

edit

You can further refine the behavior of the netflow module by specifying variable settings in the modules.d/netflow.yml file, or overriding settings at the command line.

Variable settings

edit

Each fileset has separate variable settings for configuring the behavior of the module. If you don’t specify variable settings, the netflow module uses the defaults.

For more information, see Specify variable settings. Also see Advanced settings.

When you specify a setting at the command line, remember to prefix the setting with the module name, for example, netflow.log.var.paths instead of log.var.paths.

log fileset settings

edit

The fileset is by default configured to listen for UDP traffic on localhost:2055. For most uses cases you will want to set the netflow_host variable to allow the input bind to all interfaces so that it can receive traffic from network devices.

- module: netflow
  log:
    enabled: true
    var:
      netflow_host: 0.0.0.0
      netflow_port: 2055
var.netflow_host
Address to find to. Defaults to localhost.
var.netflow_port
Port to listen on. Defaults to 2055.
var.max_message_size
The maximum size of the message received over UDP. The default is 10KiB.
var.expiration_timeout
The time before an idle session or unused template is expired. Only applicable to v9 and IPFIX protocols. A value of zero disables expiration.
var.queue_size
The maximum number of packets that can be queued for processing. Use this setting to avoid packet-loss when dealing with occasional bursts of traffic.

Fields

edit

For a description of each field in the module, see the exported fields section.

« nats module Nginx module »