- Packetbeat Reference: other versions:
- Overview
- Getting Started With Packetbeat
- Upgrading Packetbeat
- Configuring Packetbeat
- Configuration Options (Reference)
- Network Device Configuration
- Flows Configuration
- Transaction Protocols Configuration
- Monitored Processes Configuration
- General Configuration
- Elasticsearch Output Configuration
- Logstash Output Configuration
- Kafka Output Configuration
- Redis Output Configuration
- File Output Configuration
- Console Output Configuration
- SSL Configuration
- Paths Configuration
- Logging Configuration
- Run Options Configuration
- Processors
- Filtering and Enhancing the Exported Data
- Configuring Packetbeat to Use Ingest Node
- Exporting GeoIP Information
- Configuring Packetbeat to Use Logstash
- Using Environment Variables in the Configuration
- Setting Traffic Capturing Options
- Configuring Thrift-RPC Support
- Maintaining the Real-Time State of the Network Topology
- YAML Tips and Gotchas
- Configuration Options (Reference)
- Exported Fields
- AMQP Fields
- Beat Fields
- Cassandra Fields
- Cloud Provider Metadata Fields
- Common Fields
- DNS Fields
- Flow Event Fields
- HTTP Fields
- ICMP Fields
- Memcache Fields
- MongoDb Fields
- MySQL Fields
- NFS Fields
- PostgreSQL Fields
- Raw Fields
- Redis Fields
- Thrift-RPC Fields
- Transaction Event Fields
- Measurements (Transactions) Fields
- Securing Packetbeat
- Visualizing Packetbeat Data in Kibana
- Troubleshooting
- Developer Guide: Adding a New Protocol
WARNING: Version 5.2 of Packetbeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Flows Configuration
editFlows Configuration
editThe flows section of the packetbeat.yml config file contains configuration options for bidirectional network
flows. If section is missing from configuration file, network flows are
disabled.
packetbeat.flows: timeout: 30s period: 10s
Options
editYou can specify the following options in the flows section of the packetbeat.yml config file:
enabled
editEnables flows support if set to true. Set to false to disable network flows support without having to delete or comment out the flows section. The default value is true.
timeout
editTimeout configures the lifetime of a flow. If no packets have been received for a flow within the timeout time window, the flow is killed and reported. The default value is 30s.
period
editConfigure the reporting interval. All flows are reported at the very same point in time. Periodical reporting can be disabled by setting the value to -1. If disabled, flows are still reported once being timed out. The default value is 10s.