User's Guide

Part 1 – Installing and Configuring ElastiFlow and Elastic Stack
211 of 218
a. To prepare for this step, copy the extr_elastiflow_3.4.2.tar.gz file
to the /etc/logstash directory.
b.
cd /etc/logstash
sudo tar xvzf extr_elastiflow_3.4.2.tar.gz
7. Configure logstash pipelines.yml.
a.
sudo nano /etc/logstash/pipelines.yml
b. Add:
- pipeline.id: elastiflow
path.config: "/etc/logstash/elastiflow/conf.d/*.conf"
NOTE: Be careful about spacing and extra blank lines with the following file. Make
sure there are no blank lines between the main definition and the
elastiflow definition.
- pipeline.id: main
path.config: "/etc/logstash/conf.d/*.conf"
- pipeline.id: elastiflow
path.config: "/etc/logstash/elastiflow/conf.d/*.conf"
Do not add a <CR> at the end of the file.
Save the file.
The following configuration example receives Extreme Networks-enriched
IPFIX on UDP port 2055 only. We can modify the Logstash configuration
and service parameters to limit the Logstash plugins that are loaded.
To prepare for this step, copy the extr_udp_2055_logstash.tar.gz file
to the / directory.
cd /
sudo tar xvzf extr_udp_2055_logstash.tar.gz
cd /etc/logstash/elastiflow/conf.d
sudo mv 10_input_netflow_ipv4.logstash.conf 10_input_netflow_
ipv4.logstash.conf.disabled;
sudo mv 10_input_sflow_ipv4.logstash.conf 10_input_sflow_
ipv4.logstash.conf.disabled;
sudo mv 20_filter_20_netflow.logstash.conf 20_filter_20_
netflow.logstash.conf.disabled;