Network Data Analysis With Elastic Stack
summary
Shows a concrete pipeline: syslog and NetFlow from a three-node IOS/NX‑OS lab ship into Logstash (UDP port 514), get normalized into Elasticsearch, and Kibana builds dashboards and saved visualizations. Elasticsearch listens on localhost:9200 and requires matching Kibana/ES versions (example 6.5.4). Logstash writes timestamped indexes that do daily index rollover, you can watch JSON on the console output for debugging, compare netflow v9 vs v5 and run simple unsupervised anomaly detection.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:27Elastic Stack overview
- 6:40Why use Elasticsearch
- 9:56Network data use cases
- 12:42Data ingestion workflow
- 15:47Demo setup and execution
- 23:02Conclusion and Q&A
related talks
26mNetwork Observability with IPFIX, Prometheus and Elastic Stack
26mNetwork monitoring with FOSS
35mNetwork Flow Monitoring in Kubernetes with Contiv/VPP CNI and Elastic Stack
01h 00mELK Stack - All You Need for Search In Your Applications
42mGoing Elastic
35mNetwork Flow Monitoring in Kubernetes with Contiv/VPP CNI and the Elastic Stack
29mPractical ISP CSIRT Incident Handling w/ Network Flows, ELK Stack & Cybersecurity Intelligence...
48mMake Sense of your Logs: From Zero to Hero in less than an Hour!