tyjhart / flowanalyzer Goto Github PK

Hi, infix is crashing about every 30 seconds.

Traceback (most recent call last):
File "./ipfix.py", line 431, in
helpers.bulk(es,flow_dic)
File "/usr/local/lib/python2.7/dist-packages/elasticsearch/helpers/init.py", line 195, in bulk
for ok, item in streaming_bulk(client, actions, **kwargs):
File "/usr/local/lib/python2.7/dist-packages/elasticsearch/helpers/init.py", line 163, in streaming_bulk
for result in _process_bulk_chunk(client, bulk_actions, raise_on_exception, raise_on_error, **kwargs):
File "/usr/local/lib/python2.7/dist-packages/elasticsearch/helpers/init.py", line 135, in _process_bulk_chunk
raise BulkIndexError('%i document(s) failed to index.' % len(errors), errors)
elasticsearch.helpers.BulkIndexError: (u'1 document(s) failed to index.', [{u'index': {u'status': 400, u'_type': u'Flow', u'_id': u'AVyTE_avwlw_IxAFa81b', u'error': {u'caused_by': {u'reason': u'Numeric value (4294967295) out of range of int\n at [Source: org.elasticsearch.common.bytes.BytesReference$MarkSupportingStreamInputWrapper@7190f04; line: 1, column: 905]', u'type': u'json_parse_exception'}, u'reason': u'failed to parse [Destination AS]', u'type': u'mapper_parsing_exception'}, u'_index': u'flow-2017-06-10'}}])

Import the file and get this.

Hi, when attempting to literally follow the quick installations it fails.
Env:
ubuntu 16.04 LTS on a VM with 8GB, 4Cores, 500GB disk

sudo apt-get install git [WORKS]

git clone https://gitlab.com/thart/flowanalyzer.git [WORKS]

cd flowanalyzer [obviously WORKS]

sudo sh ./Install/ubuntu_install_elk5.sh [MOSTLY WORKS]
some mild complaints about the pip .cache not being owned by the user.
with pip suggesting one uses sudo -H flag

sh ./Install/build_netflow_index_elk5. [FAILS]

sh ./Install/build_netflow_index_elk5.sh
curl: (7) Failed to connect to localhost port 9200: Connection refused
curl: (7) Failed to connect to localhost port 9200: Connection refused

netstat -an | more shows that there is nothing listening on port 9200

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:XX 0.0.0.0:* LISTEN
tcp 0 0 YYY.XX.0.26:EEEEE AAA.BBB.CCC.DDD:60437 ESTABLISHED
tcp6 0 0 :::XX :::* LISTEN
udp 0 0 YYY.XX.0.26:123 0.0.0.0:*
udp 0 0 127.0.0.1:123 0.0.0.0:*
udp 0 0 0.0.0.0:123 0.0.0.0:*
udp6 0 0 fe80::YYY:ZZZ:feb8:123 :::*
udp6 0 0 ::1:123 :::*
udp6 0 0 :::123 :::*

There is no firewall rules on this device, per iptables --list

thoughts ??