IPFIX in Elastic

Want to use the power of the elastic stack to analyse Netflow and IPFIX? Here’s how to get started.

Create a logstash configuration file in /etc/logstash/conf.d/

# IPFIX -> Logstash -> Elasticsearch pipeline.
input {
  udp {
    port  => 2055
    codec => netflow
  }
}
output {
  elasticsearch {
    hosts => ["http://10.9.100.36:9200"]
    index => "ipfix-%
  
}

You may need to restart logstash. Your elastic stack will now be listening for Netflow and IPFIX records on port 2055, and post the data to an elastic host index ipfix-2019.05.31 for example.

For testing, we used an IOS-XE router:

flow exporter ELASTIC
 destination 10.9.100.36
 transport udp 2055
 export-protocol ipfix
!
!
flow monitor DEMO-MON
 exporter ELASTIC
 record netflow ipv4 original-input
!
interface GigabitEthernet4
 ip flow monitor DEMO-MON input

And that’s it! Now enjoy creating graphs and charts of your network.