2022-09-14T20:42:22,343][WARN ][logstash.outputs.elasticsearch][elastiflow] Detected a 6.x and above cluster: the `type` event field won’t be
used to determine the document _type {:es_version=>7}
[2022-09-14T20:42:22,462][INFO ][logstash.outputs.elasticsearch][elastiflow] Config is not compliant with data streams. `data_stream => auto` resolved to `false`
[2022-09-14T20:42:22,471][INFO ][logstash.outputs.elasticsearch][elastiflow] Config is not compliant with data streams. `data_stream => auto` resolved to `false`
[2022-09-14T20:42:22,582][INFO ][logstash.outputs.elasticsearch][elastiflow] Using mapping template from {:path=>”/etc/logstash/elastiflow/templates/elastiflow.template.json”}
[2022-09-14T20:42:22,849][INFO ][logstash.outputs.elasticsearch][elastiflow] Installing Elasticsearch template {:name=>”elastiflow-4.0.1″}

Quanto ao import do arquivo @elastiflow.index_pattern.json vi uma discussão no Github dizendo o seguinte:

As the instructions state here… elastiflow.index_pattern.json is for 6.4.x and earlier. Even for 6.4.x and earlier that file is installed using
the provided curl command, not the Kibana UI. If you are using Elastic Stack 6.6.x, you need only elastiflow.kibana.6.6.x.json which is installed
via the Kibana UI.

A etapa de import do arquivo elastiflow.index_pattern.json para criação dos índices eu pulei (parece que essa etapa prejudica o restante do processo)

Somente importei o arquivo elastiflow.kibana.7.8.x.ndjson via web > management > saved objects
https://raw.githubusercontent.com/robcowart/elastiflow/master/kibana/elastiflow.kibana.7.8.x.ndjson
conforme instruções do robcowart

Coletando netflow perfeitamente

https://ibb.co/album/Q9rbHn

Qual a versão dos “objetos” pro Kibana você utilizou? porque só tem disponível a versão 7.0.
Os dashboards ficam sem dados para exibir (como se não tivesse coletando).
Já tentei na vesão: 7.3.0; 7.6.1 e na atual 7.9.1 e NADA. Já to fazendo o tutorial no modo automático rsrs… gravei rs

Teria como dá um Help você/alguém rs.. ? abÇ

[INFO ][logstash.config.source.local.configpathloader] No config files found in path {:path=>”/etc/logstash/conf.d/*.conf”}

Pra mim funcionou quando configurei um mikrotik, mas quando tentei colocar um Huawei tive o mesmo problema que voces

So alterar o parametro para esse valo: Environment=”ELASTIFLOW_SFLOW_UDP_RCV_BUFF=212992″ no arquivo /etc/systemd/system/logstash.service.d/elastiflow.conf

Pessoal estou tendo esse problema The datetime zone id ‘UTC.’ is not recognised quando olho os logs do logstash, tem a ver com o timezone configurado no arquivo de configuração do Elastiflow, mas nao importa o que eu coloque lá, sempre da esse erro. Alguém ja pegou esse problema?

# /usr/share/logstash/bin/logstash-plugin install logstash-codec-sflow –no-verify
# /usr/share/logstash/bin/logstash-plugin update logstash-codec-netflow –no-verify
# /usr/share/logstash/bin/logstash-plugin update logstash-input-udp –no-verify
# /usr/share/logstash/bin/logstash-plugin update logstash-input-tcp –no-verify
# /usr/share/logstash/bin/logstash-plugin update logstash-filter-dns –no-verify
# /usr/share/logstash/bin/logstash-plugin update logstash-filter-geoip –no-verify
# /usr/share/logstash/bin/logstash-plugin update logstash-filter-translate –no-verify
# /usr/share/logstash/bin/logstash-plugin install –no-verify

# /usr/share/logstash/bin/logstash-plugin install logstash-codec-sflow
# /usr/share/logstash/bin/logstash-plugin update logstash-codec-netflow
# /usr/share/logstash/bin/logstash-plugin update logstash-input-udp
# /usr/share/logstash/bin/logstash-plugin update logstash-input-tcp
# /usr/share/logstash/bin/logstash-plugin update logstash-filter-dns
# /usr/share/logstash/bin/logstash-plugin update logstash-filter-geoip
# /usr/share/logstash/bin/logstash-plugin update logstash-filter-translate

Apresentou o seguinte erro:
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.headius.backport9.modules.Modules to method sun.nio.ch.NativeThread.signal(long)
WARNING: Please consider reporting this to the maintainers of com.headius.backport9.modules.Modules
WARNING: Use –illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release

Alguma dica?

[WARN ][logstash.codecs.netflow ] Can’t (yet) decode flowset id 257 from source id 0, because no template to decode it with has been received. This message will usually go away after 1 minute.

Não estou conseguidn oresolver, e no KIBANA não chega nenhum dado

Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:elastiflow, :exception=>”Java::JavaLang::IllegalStateException”, :message=>”Unable to configure plugins: (PluginLoadingError) Couldn’t find any codec plugin named ‘sflow’. Are you sure this is correct? Trying to load the sflow codec plugin resulted in this error: no such file to load — logstash/codecs/sflow”, :backtrace=>[“org.logstash.config.ir.CompiledPipeline.(CompiledPipeline.java:103)”, “org.logstash.execution.JavaBasePipelineExt.initialize(JavaBasePipelineExt.java:60)”, “org.logstash.execution.JavaBasePipelineExt$INVOKER$i$1$0$initialize.call(JavaBasePipelineExt$INVOKER$i$1$0$initialize.gen)”, “org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:837)”, “org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1169)”, “org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuperSplatArgs(IRRuntimeHelpers.java:1156)”, “org.jruby.ir.targets.InstanceSuperInvokeSite.invoke(InstanceSuperInvokeSite.java:39)”, “usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.RUBY$method$initialize$0(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:27)”, “org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:84)”, “org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)”, “org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:332)”, “org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:86)”, “org.jruby.RubyClass.newInstance(RubyClass.java:915)”, “org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)”, “org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:183)”, “usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0(/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36)”, “usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0$__VARARGS__(/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb)”, “org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:84)”, “org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)”, “org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:183)”, “usr.share.logstash.logstash_minus_core.lib.logstash.agent.RUBY$block$converge_state$2(/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326)”, “org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:136)”, “org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:77)”, “org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:71)”, “org.jruby.runtime.Block.call(Block.java:125)”, “org.jruby.RubyProc.call(RubyProc.java:274)”, “org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)”, “java.base/java.lang.Thread.run(Thread.java:834)”]}
[2020-05-11T22:49:07,166][ERROR][logstash.agent ] An exception happened when converging configuration {:exception=>LogStash::Error, :message=>”Don’t know how to handle `Java::JavaLang::IllegalStateException` for `PipelineAction::Create`”, :backtrace=>[“org/logstash/execution/ConvergeResultExt.java:109:in `create'”, “org/logstash/execution/ConvergeResultExt.java:37:in `add'”, “/usr/share/logstash/logstash-core/lib/logstash/agent.rb:339:in `block in converge_state'”]}
[2020-05-11T22:49:07,225][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<LogStash::Error: Don't know how to handle `Java::JavaLang::IllegalStateException` for `PipelineAction::Create`>, :backtrace=>[“org/logstash/execution/ConvergeResultExt.java:109:in `create'”, “org/logstash/execution/ConvergeResultExt.java:37:in `add'”, “/usr/share/logstash/logstash-core/lib/logstash/agent.rb:339:in `block in converge_state'”]}
[2020-05-11T22:49:07,242][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
[2020-05-11T22:49:30,319][INFO ][logstash.runner ] Starting Logstash {“logstash.version”=>”7.6.2″}
[2020-05-11T22:49:31,405][INFO ][logstash.config.source.local.configpathloader] No config files found in path {:path=>”/etc/logstash/conf.d/*.conf”}

No meu caso eu tava tendo problemas tambem, eu aumentei q quantidade de gigas no
-Xms4g
-Xmx4g

Pois tinha uma carga grande de flows

As métricas não estão listando, mas se eu listo algum histórico de tempo maior lista normalmente….. resumindo como ativei agora pouco a solução dados de 40minutos atraś listam normalmente…. agora os dados mais recentes não estão listando…. algo que possa ser feito?

O recurso da máquina está tranquilo, os serviços estão em execução e no tcpdump meus dois equipamentos de teste ( mikrotik ) estão enviando dados na porta 2055 udp.

Atenciosamente,

Infelizmente não :/