Closed fkocharli closed 4 years ago
Hello Rob.
I have installed elk 7 on new machine. The same issue. Can you advise something?
I don't see any obvious issue. Which OS are you using?
Commenting out the user and password of the elasticsearch output should make no difference. It would good to know what logs you are seeing if you start an unmodified version of the logstash pipeline.
I am using CentOS 7.
There is no any errors in logs, which you can see on my other topic regarding the same issue on Logstash 6.7: https://github.com/robcowart/elastiflow/issues/298
If you are using Netflow v9 or IPFIX you should see logs telling you that it can't decode the flows. These should appear until the devices send a template record. The fact that you don't get any such logs leads me to believe that the packets aren't making it to Logstash. This would lead me to suspect an OS-level issue.
To determine if there is some other issue I would need a PCAP. You can capture this using tcpdump
. You will need to ensure that it collects long enough to also capture template records from the devices sending data.
The only other thing I can think of is the local firewall. You can try disabling this with...
sudo systemctl stop firewalld
Otherwise I am closing as I have no additional information to troubleshoot further.
Hello Rob.
I am already 1 month cant fix this issue. Think only you can help. Will be really thankful if you can advise sollution.
I am running Elastickseach, Logstash and Kibana on the same host. I have reinstalled Logstash 6.7.2 and Elastiflow 3.4.2. The only difference I made that I have commented out 'username' and 'password' lines and replaced '127.0.0.1' with 'localhost' in my variables and 30_output_10_single.logstash.conf. Without this changes Logstash hangs and does not start at all.
From tcpdump output I can confirm that I receive data on 2055 port:
Below output shows that logstash listens 2055 port:
My log file has not any errors:
List of my variables. I have disabled most of them.
My pipelines.yml:
My elastiflow/conf.d directory:
My 10_input_netflow_ipv4.logstash.conf file:
My 30_output_10_single.logstash.conf file: