ElastiFlow

https://docs.elastiflow.com
Admin
ElastiFlow is a network observability and security analytics platform that collects and analyzes...
Tokens:222,596
Snippets:2,877
Trust Score:8.6
Update:5 months ago
Show doc for...
Tokens:
Raw
### Run ElastiFlow Initial Install Script

Source: https://docs.elastiflow.com/flowcoll/docker-compose-quickstart-guide-for-elastiflow-with-elasticsearch

Execute the initial install script as root to begin the ElastiFlow setup. This script handles the installation of ElastiFlow, Elasticsearch, and Kibana, and detects when all systems are ready.

```bash
sudo ./initial_install.sh
```

--------------------------------

### Dynamic Documentation Query Example

Source: https://docs.elastiflow.com/additional-resources-reference-articles/guides/configuring-flow-logs-on-devices/arista

Demonstrates how to query the documentation dynamically using an HTTP GET request with the 'ask' query parameter.

```http
GET https://docs.elastiflow.com/additional-resources-reference-articles/guides/configuring-flow-logs-on-devices/arista.md?ask=<question>
```

--------------------------------

### Unencrypted Device Configuration Example

Source: https://docs.elastiflow.com/snmpcoll/configuration/def_devices/device-file-encryption

This is an example of a device configuration file before encryption. It includes details for two example devices.

```yaml
example1:
    ip: 192.0.2.1
    port: 161
    poll_interval: 60
    timeout: 3000
    retries: 2
    exponential_timeout: false
    version: 2c
    communities:
        - public
    device_groups:
        - cisco_c1000
example2:
    ip: 192.0.2.2
    port: 161
    poll_interval: 60
    timeout: 3000
    retries: 2
    exponential_timeout: false
    version: 3
    v3_credentials:
        - username: elastiflow
          authentication_protocol: sha
          authentication_passphrase: efauthpassword
          privacy_protocol: des
          privacy_passphrase: efprivpassword
    device_groups:
        - cisco_c1000
```

--------------------------------

### Enable and Start Elasticsearch Service

Source: https://docs.elastiflow.com/data_platforms/elastic/install_redhat

Reload the systemd daemon, enable the Elasticsearch service to start on boot, and then start the service.

```shell
sudo systemctl daemon-reload && \
  sudo systemctl enable elasticsearch && \
  sudo systemctl start elasticsearch
```

--------------------------------

### Enable and Start Kibana Service

Source: https://docs.elastiflow.com/data_platforms/elastic/install_redhat

Reload the systemd daemon, enable the Kibana service to start on boot, and then start the Kibana service.

```shell
sudo systemctl daemon-reload && \
  sudo systemctl enable kibana && \
  sudo systemctl start kibana
```

--------------------------------

### Verify Docker Service Status and Start (Debian)

Source: https://docs.elastiflow.com/flowcoll/docker-compose-quickstart-guide-for-elastiflow-with-elasticsearch

Check if the Docker service is running. If not, enable it to start on boot and start it manually. This ensures Docker is operational after installation.

```bash
sudo systemctl status docker
sudo systemctl enable docker
sudo systemctl start docker
```

--------------------------------

### Enable and Start Elasticsearch Service

Source: https://docs.elastiflow.com/data_platforms/elastic/install_ubuntu

Reload the systemd daemon, enable Elasticsearch to start on boot, and then start the service. Use `systemctl status` to confirm it's running.

```shell
sudo systemctl daemon-reload && \
  sudo systemctl enable elasticsearch && \
  sudo systemctl start elasticsearch
```

```shell
sudo systemctl status elasticsearch
```

--------------------------------

### Install Prerequisite Packages

Source: https://docs.elastiflow.com/data_platforms/elastic/install_ubuntu

Installs `apt-transport-https` for secure APT repository access and `unzip` for extracting compressed files, which are required for subsequent installations.

```shell
sudo apt install -y apt-transport-https
sudo apt install -y unzip
```

--------------------------------

### Install Docker and Docker Compose

Source: https://docs.elastiflow.com/flowcoll/docker-compose-quickstart-guide-for-elastiflow-with-elasticsearch

Install the Docker CE, CLI, containerd.io, buildx plugin, and compose plugin.

```bash
sudo dnf install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
```

--------------------------------

### Install NetObserv Flow Collector with License Key

Source: https://docs.elastiflow.com/flowcoll/installation/install_helm

Install the netobserv-flow chart using Helm's 'set' option to specify the license key. This method allows for direct configuration of the license during installation.

```bash
helm install netobserv netobserv/netobserv-flow \
  --set license.licenseKey="licensekeygoeshere"
```

--------------------------------

### Start Docker Service

Source: https://docs.elastiflow.com/flowcoll/docker-compose-quickstart-guide-for-elastiflow-with-elasticsearch

Enable and start the Docker service to ensure it runs on boot and is active.

```bash
sudo systemctl enable --now docker
```

--------------------------------

### Install Required Packages

Source: https://docs.elastiflow.com/flowcoll/installation/install_linux

Install the `libpcap-dev` and `ca-certificates` packages using apt if they are not already present on your system.

```bash
sudo apt install libpcap-dev ca-certificates
```

--------------------------------

### Example docker-compose.yml Volume Mount

Source: https://docs.elastiflow.com/additional-resources-reference-articles/faq/upgrade_7.5

An example of how to configure the volume mount in `docker-compose.yml` for persisting data.

```yaml
volumes:
  - /var/lib/elastiflow/flowcoll:/var/lib/elastiflow/flowcoll
```

--------------------------------

### Install Kibana Package

Source: https://docs.elastiflow.com/data_platforms/elastic/install_ubuntu

Update the package list and install the Kibana package using apt.

```shell
sudo apt update && sudo apt install -y kibana
```

--------------------------------

### Example sFlow Verification Output

Source: https://docs.elastiflow.com/additional-resources-reference-articles/guides/configuring-flow-logs-on-devices/device_flow_cisco_catalyst_sflow

An example output from the 'show sflow' command, illustrating configured agent and collector settings.

```text
Agent:
------
IP : 192.0.2.11

Collector:
----------
Max number of collectors : 2

 Id |           Collector IP        | Port | Max Datagram size
--------------------------------------------------------------
 1  | 192.168.100.10                  | 6343 | 1280
```

--------------------------------

### Install Docker and Docker Compose (Debian)

Source: https://docs.elastiflow.com/flowcoll/docker-compose-quickstart-guide-for-elastiflow-with-elasticsearch

Install the Docker Engine, CLI, containerd, buildx plugin, and Docker Compose plugin. This command installs the necessary components for running Docker containers and managing them with Compose.

```bash
sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
```

--------------------------------

### Install Unzip Utility

Source: https://docs.elastiflow.com/flowcoll/docker-compose-quickstart-guide-for-elastiflow-with-elasticsearch

If the 'unzip' command is not found, install it using the appropriate package manager for your distribution.

```bash
sudo apt install unzip
```

```bash
sudo dnf install unzip
```

--------------------------------

### Start SNMP Collector Service

Source: https://docs.elastiflow.com/snmpcoll/installation/install_linux

Use this command to start the SNMP collector service after installation or configuration changes.

```shell
sudo systemctl daemon-reload && sudo systemctl start snmpcoll.service
```

--------------------------------

### Device File with Defaults Applied

Source: https://docs.elastiflow.com/snmpcoll/configuration/def_devices

This example shows a minimal device file that, when combined with the 'device.yml' defaults, results in a complete device definition.

```yaml
mydevice:
  ip: 192.0.2.1
```

--------------------------------

### Check AutoOps Agent Status

Source: https://docs.elastiflow.com/data_platforms/elastic/autoops

Verify if the AutoOps agent is installed and running on the host. This command is useful for confirming installation after running the agent setup script.

```bash
sudo elastic-agent status
```

--------------------------------

### SNMP Poller License Error Example

Source: https://docs.elastiflow.com/changelog

This error indicates that the SNMP poller cannot start because the license agreement has not been accepted. Set EF_LICENSE_ACCEPTED to true to resolve this.

```shell
snmpcoll/main.go:62 exiting because of a license error {"code": "license/error", "reason": "license configuration: license agreement not accepted. Please update 'EF_LICENSE_ACCEPTED'"}
```

--------------------------------

### Verify Docker Compose Installation (Debian)

Source: https://docs.elastiflow.com/flowcoll/docker-compose-quickstart-guide-for-elastiflow-with-elasticsearch

After installation, verify that Docker Compose is correctly installed and accessible by running the version command.

```bash
sudo docker compose version
```

--------------------------------

### SNMPv3 Walk Example

Source: https://docs.elastiflow.com/additional-resources-reference-articles/guides/snmp-troubleshooting

This command demonstrates an SNMP walk using SNMPv3 with the authPriv security level, requiring authentication and privacy protocols and passwords. Ensure placeholders for user, passwords, host, and OIDs are correctly set.

```bash
# SNMPv3 Walk Example (authPriv security level using SHA-1 and AES-128)
snmpwalk -v3 \
  -l authPriv \
  -u <USER> \
  -a SHA \
  -A <AUTH_PASS> \
  -x AES \
  -X <PRIV_PASS> \
  <HOST> \
  1.3.6.1.2.1.31.1.1.1.1 \
  1.3.6.1.2.1.2.2.1.2 \
  1.3.6.1.2.1.31.1.1.1.18 \
  1.3.6.1.2.1.2.2.1.3
```

--------------------------------

### Install age on RPM-based Linux

Source: https://docs.elastiflow.com/flowcoll/configuration/encrypting-configuration-files

Installs the 'age' encryption tool on RPM-based Linux distributions. Verify the installation using 'age --version'.

```bash
sudo dnf install epel-release
sudo dnf install age
age --version # to verify install
```

--------------------------------

### Install age on Debian-based Linux

Source: https://docs.elastiflow.com/flowcoll/configuration/encrypting-configuration-files

Installs the 'age' encryption tool on Debian-based Linux distributions. Verify the installation using 'age --version'.

```bash
sudo apt install age
age --version # to verify install
```

--------------------------------

### Query Documentation via HTTP GET

Source: https://docs.elastiflow.com/data_platforms/elastic/install_redhat

Demonstrates how to query the documentation dynamically using an HTTP GET request with the 'ask' query parameter. This is useful for retrieving information not explicitly present on the page.

```http
GET https://docs.elastiflow.com/data_platforms/elastic/install_redhat.md?ask=<question>
```

--------------------------------

### Example Device Group Configuration

Source: https://docs.elastiflow.com/snmpcoll/configuration/snmp-definition-files/def_device_groups

This YAML snippet shows how to define a 'generic' device group and list the associated object groups.

```yaml
generic:
  object_groups:
    - system
    - host
    - netif
    - ip
    - icmp
    - tcp
    - udp
    - snmp
```

--------------------------------

### Enable and Start NetObserv Flow Collector

Source: https://docs.elastiflow.com/data_platforms/elastic/install_ubuntu

Commands to reload the systemd daemon, enable the flow collector service to start on boot, and start the service immediately.

```shell
sudo systemctl daemon-reload && \
  sudo systemctl enable flowcoll && \
  sudo systemctl start flowcoll
```

--------------------------------

### Install netobserv CLI Tool (rpm)

Source: https://docs.elastiflow.com/snmpcoll/configuration/def_devices/autodiscovery

Installs the netobserv CLI tool using an .rpm package. Replace `<space.vars.current_version>` with the actual version number.

```bash
wget https://elastiflow-releases.s3.us-east-2.amazonaws.amazonaws.com/netobserv/netobserv-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
sudo yum install -y netobserv-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
```

--------------------------------

### Install Elasticsearch

Source: https://docs.elastiflow.com/data_platforms/elastic/install_ubuntu

Update the package list and install the Elasticsearch package using `apt`. This command installs the latest stable version available in the configured repository.

```shell
sudo apt update && sudo apt install -y elasticsearch
```

--------------------------------

### Install ElastiFlow SNMP Trap Collector RPM

Source: https://docs.elastiflow.com/trapcoll/installation/install_linux

Install the ElastiFlow SNMP Trap Collector RPM package for the first time. Use this command for a fresh installation.

```shell
sudo yum install -y trap-collector-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
```

--------------------------------

### Install SNMP Walk .rpm Package with yum

Source: https://docs.elastiflow.com/additional-resources-reference-articles/guides/extending_snmp_device_support

Install the downloaded SNMP Walk RPM package using the yum command. This command is used for initial installation.

```bash
sudo yum install -y snmp-walk-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
```

--------------------------------

### Query Documentation via HTTP GET

Source: https://docs.elastiflow.com/data_platforms/elastic/install_ubuntu

Use this method to ask questions about the documentation dynamically. The response will contain direct answers and relevant excerpts.

```http
GET https://docs.elastiflow.com/data_platforms/elastic/install_ubuntu.md?ask=<question>
```

--------------------------------

### Install SNMP Walk .deb Package with dpkg

Source: https://docs.elastiflow.com/additional-resources-reference-articles/guides/extending_snmp_device_support

Install the downloaded SNMP Walk Debian package using the dpkg command. This is an alternative to using apt for installation.

```bash
sudo dpkg -i snmp-walk_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
```

--------------------------------

### Querying Documentation via HTTP GET

Source: https://docs.elastiflow.com/flowcoll/configuration/config_gen/data_path

To get additional information not present on the page, perform an HTTP GET request with the 'ask' query parameter. The question should be specific and self-contained.

```http
GET https://docs.elastiflow.com/flowcoll/configuration/config_gen/data_path.md?ask=<question>
```

--------------------------------

### Example Discovered Device Configuration (Secure Network)

Source: https://docs.elastiflow.com/snmpcoll/configuration/def_devices/autodiscovery

This YAML file shows discovered devices from a secure network, detailing SNMPv3 credentials, including username, authentication, and privacy protocols and passphrases.

```yaml
# /etc/elastiflow/snmp/devices/secure_network.yml
re-router:
  ip: 192.168.1.1
  port: 161
  version: 3
  v3_credentials:
    - username: admin
      authentication_protocol: SHA
      authentication_passphrase: authpass
      privacy_protocol: AES
      privacy_passphrase: privpass
  device_groups:
    - generic
```

--------------------------------

### Manage Kibana Service

Source: https://docs.elastiflow.com/data_platforms/elastic/install_ubuntu

Commands to reload the systemd daemon, enable Kibana to start on boot, and start the Kibana service. Use 'systemctl status kibana' to verify it has started successfully.

```shell
sudo systemctl daemon-reload && \
  sudo systemctl enable kibana && \
  sudo systemctl start kibana
```

```shell
sudo systemctl status kibana
```

--------------------------------

### Add Docker Repository

Source: https://docs.elastiflow.com/flowcoll/docker-compose-quickstart-guide-for-elastiflow-with-elasticsearch

Install the necessary plugin and add the official Docker repository to your system's configuration.

```bash
sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
```

--------------------------------

### Query Documentation via HTTP GET Request

Source: https://docs.elastiflow.com/flowcoll/configuration/config_gen

To get information not directly on the page, perform an HTTP GET request to the page URL with an 'ask' query parameter containing your question.

```http
GET https://docs.elastiflow.com/flowcoll/configuration/config_gen.md?ask=<question>
```

--------------------------------

### Install netobserv CLI Tool (rpm)

Source: https://docs.elastiflow.com/flowcoll/configuration/enrichment-options/ip-address-enrichment/enrich_ip_netintel

Installs the netobserv CLI tool on Red Hat-based Linux systems using an .rpm package. Replace `<space.vars.current_version>` with the actual version number. For upgrades, use `rpm -Uhv`.

```bash
wget https://elastiflow-releases.s3.us-east-2.amazonaws.com/netobserv/netobserv-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
sudo yum install -y netobserv-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
```

```bash
sudo rpm -Uhv netobserv-<code class="expression">space.vars.current_version</code>-1.x86_64.rpm
```

--------------------------------

### Querying Documentation via HTTP GET

Source: https://docs.elastiflow.com/trapcoll/configuration/receiving-traps/credentials

To get information not explicitly on this page, perform an HTTP GET request to the page URL with an 'ask' query parameter. The question should be specific and in natural language.

```http
GET https://docs.elastiflow.com/trapcoll/configuration/receiving-traps/credentials.md?ask=<question>
```

--------------------------------

### Query Documentation via HTTP GET

Source: https://docs.elastiflow.com/flowcoll/configuration/inputs/input_benchmark

To get information not explicitly on the page, perform an HTTP GET request to the current page URL with the 'ask' query parameter. The question should be specific and self-contained.

```http
GET https://docs.elastiflow.com/flowcoll/configuration/inputs/input_benchmark.md?ask=<question>
```

--------------------------------

### Install .deb Package with apt

Source: https://docs.elastiflow.com/flowcoll/installation/install_linux

Install the NetObserv Flow .deb package using the apt package manager. Ensure you are in the directory where the .deb file was downloaded. Replace `<space.vars.current_version>` with the actual version number.

```bash
sudo apt install ./flow-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
```

--------------------------------

### Query Documentation via HTTP GET

Source: https://docs.elastiflow.com/additional-resources-reference-articles/guides/configuring-flow-logs-on-devices/device_flow_mikrotik_routeros

To get additional information not directly on the page, make an HTTP GET request to the page URL with an 'ask' query parameter containing your specific question.

```http
GET https://docs.elastiflow.com/additional-resources-reference-articles/guides/configuring-flow-logs-on-devices/device_flow_mikrotik_routeros.md?ask=<question>
```

--------------------------------

### Install .deb Package with dpkg

Source: https://docs.elastiflow.com/flowcoll/installation/install_linux

Install the NetObserv Flow .deb package using the dpkg package manager. This is an alternative to using apt. Ensure you are in the directory where the .deb file was downloaded. Replace `<space.vars.current_version>` with the actual version number.

```bash
sudo dpkg -i flow-collector_<code class="expression">space.vars.current_version</code>_linux_amd64.deb
```

--------------------------------

### Start softflowd Service

Source: https://docs.elastiflow.com/additional-resources-reference-articles/guides/configuring-flow-logs-on-devices/device_flow_openwrt_softflowd

Execute this command to start the softflowd service on your OpenWRT router.

```shell
/etc/init.d/softflowd start
```

--------------------------------

### Querying Documentation via HTTP GET

Source: https://docs.elastiflow.com/data_platforms/elastic/elasticsearch/cluster_medium

Demonstrates how to query the documentation dynamically for additional information not explicitly present on the page. This is achieved by making an HTTP GET request to the page URL with an 'ask' query parameter containing the specific question.

```http
GET https://docs.elastiflow.com/data_platforms/elastic/elasticsearch/cluster_medium.md?ask=<question>
```

--------------------------------

### Query Documentation via HTTP GET

Source: https://docs.elastiflow.com/snmpcoll/installation/requirements

To get information not explicitly present on a page, make an HTTP GET request to the page URL with the 'ask' query parameter. The question should be specific and in natural language.

```http
GET https://docs.elastiflow.com/snmpcoll/installation/requirements.md?ask=<question>
```
Tokens:
Raw