centos7 ELK6.5日志收集套件上手(11)elk主机配置netflow模块及看板表

/usr/share/logstash/bin/logstash --modules netflow --setup

cisco防火墙配置好netflow日志转发(我用的是netflow V9版本)logstash配置文件参考

#/etc/logstash/logstash.yml netflow配置参考

modules:

- name: netflow

var.input.udp.port: 9996

var.elasticsearch.hosts: "localhost:9200"

var.elasticsearch.ssl.enabled: false

var.kibana.host: "localhost:5601"

var.kibana.scheme: http

var.kibana.ssl.enabled: false

var.kibana.ssl.verification_mode: disable

测试配置启动

/usr/share/logstash/bin/logstash --modules netflow --setup -M

netflow.var.input.udp.port=9996

配置logstash服务

systemctl start logstash && systemctl enable logstash

netflow dashboar

===Top-N 内网主机的流量排行榜===

===图标统计分析可以轻松查找异常流量的主机===

===geoip转地理位置,测试这一次头条退稿不===

IP access map