Network Observability with IPFIX, Prometheus and Elastic Stack
summary
Shows how to collect real IP flow data from a VPP-based CNI and store it for search and alerts using concrete open source pieces: IPFIX flow records exported by VPP into Logstash/GoFlow, indexed in Elasticsearch and visualized in Kibana, with selective metrics exported to Prometheus for alerting. Demonstrates a 1-node proof-of-concept with live flow dashboards, notes that heavy workloads require clustered Elasticsearch, per-node Logstash, and optional memory interfaces (memif) to avoid kernel overhead.
AI-written summary · about
chapters (8)
- 0:00Intro
- 1:22Motivation for Network Observability in K8s
- 3:35Options for Network Observability in K8s
- 6:29Network Observability in Traditional Networks
- 8:40IPFIX in Kubernetes
- 10:38Enabling IPFIX Export in Contiv-VPP CNI
- 12:59IPFIX Flow Collector & Analyzer based on ELK
- 21:26Possible Enhancements/ More Optimizations
related talks
35mNetwork Flow Monitoring in Kubernetes with Contiv/VPP CNI and Elastic Stack
24mNetwork Data Analysis With Elastic Stack
41mNetwork Observability
26mNetwork monitoring with FOSS
34mNetwork Observability with eBPF and OpenTelemetry
49mRelational Observability for Cloud-Native Security and Data Science
24mDeep Network Traffic Observability with Pktvisor and Prometheus
27mObservability with Prometheus and beyond