HPE CX Networking with Elastiflow part 3: Elastiflow

Опубликовано: 06 Август 2026
на канале: Airheads Broadcasting

303

In this video series I will show you how to install a single instance Elastiflow. Here is the list of videos:
Video 1: Install Elasticsearch
Video 2: Install Kibana
Video 3: Install Elastiflow
Video 4: Demonstrate capabilities with the HPE CX 10000 distributed services switch

For the installation you require some fine tuning and parameter settings. You can find the commands that I have used in this video below:

wget https://elastiflow-releases.s3.us-eas...

sha256sum flow-collector_7.18.1_linux_amd64.deb

https://elastiflow-releases.s3.us-eas...

curl o https://elastiflow-releases.s3.us-eas... | gpg --import -

echo "6A2E26EFDE24AA7A634A442ED5C0572E5D212F6B:6:" | gpg --import-ownertrust

apt install libpcap-dev ca-certificates

chmod +x *
chmod 777 *

apt install ./flow-collector_7.18.1_linux_amd64.deb

Edit the file /etc/elastiflow/flowcoll.yml

EF_LICENSE_ACCEPTED: "true"
EF_ACCOUNT_ID: ""
EF_LICENSE_KEY: ""

EF_LOGGER_FILE_LOG_ENABLE: "true"
EF_LOGGER_FILE_LOG_FILENAME: /var/log/elastiflow/flowcoll.log
EF_LOGGER_FILE_LOG_MAX_AGE: 2
EF_LOGGER_FILE_LOG_MAX_BACKUPS: 0

EF_OUTPUT_ELASTICSEARCH_ADDRESSES: your.elasticsearch.ip.address:9200
EF_OUTPUT_ELASTICSEARCH_ECS_ENABLE: "true"
EF_OUTPUT_ELASTICSEARCH_ENABLE: "true"

EF_OUTPUT_ELASTICSEARCH_INDEX_PERIOD: rollover
EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_ENABLE: "true"
EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_REPLICAS: 0
EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_SHARDS: 1
EF_OUTPUT_ELASTICSEARCH_PASSWORD: yourelasticsearchpassword
EF_OUTPUT_ELASTICSEARCH_TIMESTAMP_SOURCE: start
EF_OUTPUT_ELASTICSEARCH_USERNAME: elastic
EF_OUTPUT_ELASTICSEARCH_TLS_ENABLE: "true"
EF_OUTPUT_ELASTICSEARCH_TLS_SKIP_VERIFICATION: "true"

EF_OUTPUT_MONITOR_ENABLE: "true"
EF_OUTPUT_MONITOR_INTERVAL: 300

EF_PROCESSOR_ENRICH_IPADDR_DNS_NAMESERVER_IP: "your.dns.ip.address"
EF_PROCESSOR_ENRICH_IPADDR_DNS_NAMESERVER_TIMEOUT: 3000
EF_PROCESSOR_ENRICH_IPADDR_DNS_RESOLVE_PRIVATE: "true"
EF_PROCESSOR_ENRICH_IPADDR_DNS_RESOLVE_PUBLIC: "true"

systemctl daemon-reload && \
systemctl enable flowcoll && \
systemctl start flowcoll

systemctl status flowcoll
journalctl -xeu flowcoll.service
tail /var/log/elastiflow/flowcoll.log

https://www.elastiflow.com/docs/data_...

tcpdump "udp port 4739"

GET /_cat/indices?v

GET /elastiflow-flow-ecs-8.0-2.5-rollover-000001/_search