Closed fkocharli closed 5 years ago
The likely issue is that you have disabled a required file:
-rw-rw-r--. 1 root root 2593 Apr 23 15:11 20_filter_10_begin.logstash.conf.disabled
No. I have disabled it for troubleshooting purposes. It is the same when file is enabled. I have all indexes except elasti.
[root@elk ~]# curl 'localhost:9200/_cat/indices?v'
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
yellow open network-2019.05.01 oJl1CshqR3a2itLxxue9kw 5 1 2804 0 859kb 859kb
green open .kibana_task_manager no-P1rc_Rg6-8iCupsxHIQ 1 0 2 0 13.2kb 13.2kb
yellow open winlogbeat-6.7.1-2019.05.02 bUEfIzahSVSOkvELJJOjow 5 1 5819 0 5.2mb 5.2mb
yellow open network-2019.04.30 SyX6oGH9RV6JKhi9UdfTuA 5 1 3566 0 817.9kb 817.9kb
yellow open winlogbeat-6.7.1-2019.04.26 cAh-B2d9Sz6mDjU5zj0qTg 5 1 21565 0 17.2mb 17.2mb
yellow open winlogbeat-6.7.1-2019.04.29 avPTL1xKT1qPVVuuAkS3QA 5 1 21252 0 17mb 17mb
green open .kibana_1 HJseSurIQjipIoKkpJC_hA 1 0 350 1 326.6kb 326.6kb
yellow open network-2019.04.27 Arge_TjeTryD87wSGACM8g 5 1 1986 0 658.5kb 658.5kb
yellow open network-2019.04.24 -DEWU5cAS_GVRXvnFrlmAw 5 1 850 0 588.4kb 588.4kb
yellow open logstash-vsphere-syslog-esxi-2019.04.25 1vz4VaAcS3-S6KKwqZEisQ 5 1 1203 0 2.3mb 2.3mb
yellow open %{[@metadata][beat]}-%{[@metadata][version]}-2019.04.25 y1kXBwmqShC_e7yIuE4eiA 5 1 58 0 261.4kb 261.4kb
yellow open winlogbeat-6.7.1-2019.04.27 wCdeaUHiS-eZlLQJfaEp2Q 5 1 19814 0 15.6mb 15.6mb
yellow open winlogbeat-6.7.1-2019.04.30 pJKxCwPzQB2uGWkB7yqqYw 5 1 22070 0 17.9mb 17.9mb
yellow open winlogbeat-6.7.1-2019.04.23 kmh0pomMS8OCS2Xn9DZMSQ 5 1 18987 0 15.5mb 15.5mb
yellow open winlogbeat-6.7.1-2019.04.28 Fs4awzxOSOSpiwP4F4nx3Q 5 1 19835 0 15.6mb 15.6mb
yellow open network-2019.04.26 RSB4Uj1cQQiz9RNNCH-6xA 5 1 2038 0 775.7kb 775.7kb
yellow open winlogbeat-6.7.1-2019.05.01 jHNBLQMaR7yZ7IqbJ27Isw 5 1 22014 0 17.7mb 17.7mb
yellow open winlogbeat-6.7.1-2019.04.24 ASXdS9eOQjysEL1HICYd9g 5 1 21391 0 17mb 17mb
yellow open winlogbeat-6.7.1-2019.04.25 tn7azpQDTwiCkMcQ-HOM-Q 5 1 22472 0 18.2mb 18.2mb
yellow open network-2019.04.25 dhrGCq0zTlSvr8c2eCtK6w 5 1 2450 0 862.5kb 862.5kb
yellow open network-2019.04.28 -e219JgFQx6Ul_toh3kuFw 5 1 1974 0 771.7kb 771.7kb
yellow open network-2019.05.02 t5i66l7aSRKLg9E4T9FCag 5 1 1412 0 948.3kb 948.3kb
yellow open network-2019.04.29 J-F1WasOSbiBUovvkheI2A 5 1 2044 0 677.5kb 677.5kb
Can you send me a PCAP of some of your flows so I can investigate?
How can I get this?
Use tcpdump, wireshark or similar.
Closing this issue as it is a duplicate of #311. Please focus all comments on #311.
I have Elastic Stack 6.7 running on the same host. It runs several pipelines to get logs from cisco devices (syslog), vmware (syslog) and windows (winlogbeat). I've installed Elastiflow following installation guide to receive Netflow data. When I start service I have not any errors in logs. It listens 2055 port. With tcpdump I can see that I receive data on that port. But my Kibana has not any data. Can this happen because I have 6.7 version instead of 6.6?
It listens 2055:
My /var/log/logstash/logstash-plain.log
My pipelines.yml:
My elastiflow/conf.d directory (I have disabled all files for sflow and ipfix):