Netflow example (#280)

* Upgrading logstash container to 8.9.2 * Adding netflow udp pipeline example
epacke · Feb 15, 2025 · 8825dd0 · 8825dd0
1 parent 68db016
commit 8825dd0
Show file tree

Hide file tree

Showing 6 changed files with 23 additions and 1 deletion.
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -18,6 +18,7 @@ services:
       - "5245:5245"
       - "9600:9600"
       - "5060:5060"
+      - "2055:2055/udp"
     volumes:
       - "./logstash/logstash-config/logstash.yml:/usr/share/logstash/config/logstash.yml"
       - "./logstash/logstash-config/pipelines.yml:/usr/share/logstash/config/pipelines.yml"

diff --git a/logstash/Dockerfile b/logstash/Dockerfile
@@ -1,4 +1,4 @@
-FROM logstash:8.1.1
+FROM logstash:8.9.2
 
 USER root
 

diff --git a/logstash/logstash-config/pipeline/netflow/filter.conf b/logstash/logstash-config/pipeline/netflow/filter.conf
@@ -0,0 +1 @@
+filter {}
diff --git a/logstash/logstash-config/pipeline/netflow/input.conf b/logstash/logstash-config/pipeline/netflow/input.conf
@@ -0,0 +1,11 @@
+input {
+  # Netflow
+  udp {
+    port => 2055
+    codec => netflow {
+      versions => [5,9,10]
+      include_flowset_id => "true"
+    }
+    type => "netflow"
+  }
+}
diff --git a/logstash/logstash-config/pipeline/netflow/output.conf b/logstash/logstash-config/pipeline/netflow/output.conf
@@ -0,0 +1,7 @@
+output {
+    http {
+        format => "json"
+        http_method => "post"
+        url => "${BACKEND_ENDPOINT:http://pipeline-ui:8080/api/v1/receiveLogstashOutput}"
+    }
+}
diff --git a/logstash/logstash-config/pipelines.yml b/logstash/logstash-config/pipelines.yml
@@ -6,3 +6,5 @@
   path.config: "/usr/share/logstash/pipeline/f5-syslog"
 - pipeline.id: generic-json
   path.config: "/usr/share/logstash/pipeline/generic-json"
+- pipeline.id: netflow
+  path.config: "/usr/share/logstash/pipeline/netflow"