[role="xpack"]

:modulename: netflow
:has-dashboards: false

== NetFlow module

This is a module for receiving NetFlow and IPFIX flow records over UDP. This
input supports NetFlow versions 1, 5, 6, 7, 8 and 9, as well as IPFIX. For
NetFlow versions older than 9, fields are mapped automatically to NetFlow v9.

This module wraps the <<filebeat-input-netflow,netflow input>> to enrich the
flow records with geolocation information about the IP endpoints by using
Elasticsearch Ingest Node.

include::../include/gs-link.asciidoc[]

include::../include/configuring-intro.asciidoc[]

:fileset_ex: log

include::../include/config-option-intro.asciidoc[]

[float]
==== `log` fileset settings

The fileset is by default configured to listen for UDP traffic on
`localhost:2055`. For most uses cases you will want to set the `netflow_host`
variable to allow the input bind to all interfaces so that it can receive
traffic from network devices.

["source","yaml",subs="attributes"]
-----
- module: netflow
  log:
    enabled: true
    var:
      netflow_host: 0.0.0.0
      netflow_port: 2055
-----

`var.netflow_host`:: Address to bind to. Defaults to `localhost`.

`var.netflow_port`:: Port to listen on. Defaults to `2055`.

`var.max_message_size`:: The maximum size of the message received over UDP.
The default is `10KiB`.

`var.read_buffer`:: The size of the read buffer on the UDP socket.

`var.timeout`:: The read and write timeout for socket operations.

`var.expiration_timeout`:: The time before an idle session or unused template is
expired. Only applicable to v9 and IPFIX protocols. A value of zero disables
expiration.

`var.queue_size`:: The maximum number of packets that can be queued for
processing. Use this setting to avoid packet-loss when dealing with occasional
bursts of traffic.

`var.custom_definitions`:: A list of paths to field definitions YAML files.
These allow to update the NetFlow/IPFIX fields with vendor extensions and to
override existing fields. See <<filebeat-input-netflow,netflow input>> for
details.

`var.detect_sequence_reset`:: Flag controlling whether {beatname_uc} should
monitor sequence numbers in the Netflow packets to detect an Exporting Process
reset. See <<filebeat-input-netflow,netflow input>> for details.

`var.internal_networks`:: A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the values of
`source.locality`, `destination.locality`, and `flow.locality`. The values
can be either a CIDR value or one of the named ranges supported by the
<<condition-network, `network`>> condition. The default value is `[private]`
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.

*`var.tags`*::

A list of tags to include in events. Including `forwarded` indicates that the
events did not originate on this host and causes `host.name` to not be added to
events. Defaults to `[forwarded]`.

:has-dashboards!:

:fileset_ex!:

:modulename!:
