User's Guide

Overview
207 of 218
Stream Flow Data from
ExtremeAnalytics into Elastic Stack
ExtremeAnalytics includes the ability to stream flow data from an
ExtremeAnalytics engine to Elastic Stack (aka ELK stack). To help you use
Elastic Stack with ExtremeAnalytics, we added an ELK directory to the Extreme
Management Center NetSight/appdata/Purview directory.
The ELK directory contains the following:
l A PDF describing how to add the open-source “Elastiflow” module to an ELK server
and how to update this deployment to make Elastiflow aware of Extreme’s IPFIX
format.
l Files that you can copy to the ELK server to assist with the customization.
Use the procedures in this section to send Extreme Networks-enriched network
flow data to Elastic Stack using IPFIX and ElastiFlow.
Environment
l Extreme Management Center 8.2 and later
l Elastic Stack 6.7 (single server deployment) and later
l ElastiFlow 3.4.2 and later (version compatible with Elastic Stack 6.7) running on
Ubuntu Server 18.04
Overview
Use ElastiFlow to collect IPFIX flow data and visualize the results using Elastic
Stack. ElastiFlow requires a working Elastic Stack and it must be configured by
editing text files on the file system and by using the Kibana user interface.
The installation steps assume that IPFIX will only be sent over UDP on port 2055
from Extreme Management Center. After making the file system and UI changes,
you must restart the Elastic Stack components. Finally, enable and deploy the
IPFIX exporter of ExtremeAnalytics from the Extreme Management Center user
interface.