132.21. NetFlow (xm_netflow)

Table of Contents

This module provides a parser for NetFlow payloads collected over UDP using im_udp. It supports the following NetFlow protocol versions: v1, v5, v7, v9, and IPFIX.

Note	To examine the supported platforms, see the list of installer packages in the Available Modules chapter.

Note	This module only supports parsing NetFlow data received as UDP datagrams and does not support TCP.

Note	xm_netflow uses the IP address of the exporter device to distinguish between different devices so that templates with the same name would not conflict.

The module exports an input parser which can be referenced in the UDP input instance with the InputType directive:

InputType netflow: This input reader function parses the payload and extracts NetFlow specific fields.

132.21.1. Configuration

The xm_netflow module accepts only the common module directives.

132.21.2. Fields

The fields generated by xm_netflow are provided separately. Please refer to the documentation available online or in the NXLog package.

132.21.3. Examples

Example 677. Parsing UDP NetFlow Data

The following configuration receives NetFlow data over UDP and converts the parsed data into JSON.

nxlog.conf


  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

  <Extension netflow>
    Module      xm_netflow
</Extension>

<Extension json>
    Module      xm_json
</Extension>

<Input udpin>
    Module      im_udp
    ListenAddr  0.0.0.0:2162
    InputType   netflow
</Input>

<Output out>
    Module      om_file
    File        "netflow.log"
    Exec        to_json();
</Output>

<Route nf>
    Path        udpin => out
</Route>

You are here

132.21. NetFlow (xm_netflow) | Log Collection Solutions