dannyc/elk-netflow repository overview

Early attempt to make an ELK box for netflow collector. This is setup to listen for v5 or v9 flows on UDP/2055.. Kibana will still run on tcp/5601

At this point I have not ran this through a docker build file to specify ports to expose and auto launch the ELK components.

Invoke docker container by docker run -i -p 5601:5601/tcp -p 2055:2055/udp -t dannyc/elk-netflow /bin/bash

The run the commands service elasticsearch start service kibana start /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/netflow.cfg

Logstash will run in the foreground at this point you can detach from the container or just leave it running or background it.

To access Kibana you can go to http://:5601/