Samadi
Jun 22, 2022Altocumulus
sFlow/Netflow
Hello,
I need to configure my BIGIP to send sFlow to ELK, so I need the version of sFlow or Netflow used by F5 BIGIP (version 14.1.4)
can any one help with this please ?
Regards,
Hello,
I need to configure my BIGIP to send sFlow to ELK, so I need the version of sFlow or Netflow used by F5 BIGIP (version 14.1.4)
can any one help with this please ?
Regards,
Hi,
sFlow on ELK isn't very well support, netflow which is very slightly different is much better.
It has filebeats and logstash plugins ready to go.
Also the default sFlow config doesn't help much.
I would recommend using netflow and using a method like this
https://docs.illumio.com/asp/20.2/Content/Guides/flowlink-configure-usage/collect-flow-records-f5.htm
Sorry i can't for the life of me get google to find the f5 pages that show the same, but in short its basically a log publisher and log destination setup like syslog. Then all you do is have a simple irule on the virtual server that you want logging.
This setup supports netflowv9 and ipfix (v10) so you should be good to go!
Hope this helps.