A Docker container for the ElastiFlow Unified Flow Collector is available on Docker Hub. docker-compose is a good way to run the container. It allows for the various environment variables, used to configure the collector, to be easily managed in one place without having to enter them on the command line.
docker-compose.yml file provides an example with common settings that will likely need to be configured to process flow records and send them to Elasticsearch.
The name of the current released image is
restart is set to
unless-stopped so that the collector will restart automatically if it fails for some reason.
There is a old issue with Docker that persists still, where an inbound packet's source IP address is not persisted across the Docker bridge interface. This is not an issue for sFlow as the exporter's IP is extracted from the
agent_address in the sFlow header. However for Netflow and IPFIX the source IP from the IP header is all that is available to determine which device sent the records. The Docker bridge messes this up.
To work around this issue
network_mode must be set to
On macOS Docker containers do not run natively on the operating system. They actually run in a behind the scenes linux VM. In the case
host networking would be the network stack of the VM and not of macOS itself. This means the
bridged mode networking must be used and the necessary port mapping defined. Because of the source IP issues mentioned above, you will not be able to do much on macOS other than basic testing.
There are a few scenarios where it is necessary to make files on the host file system available to the collector.
In the example above,
/etc/elastiflow on the host's filesystem is mapped into the same path within the container. After downloading the
GeoLite2-ASN maxmind databases from the Maxmind website, they can be placed at
/etc/elastiflow/maxmind on the host's filesystem and will be able to be accessed by the collector within the container.
It is also possible to build a new container, adding additional files as needed. This may the best choice if running the container in a dynamically orchestrated environment (e.g. running in Kubernetes). However for an instance dedicated to a specific host, using bind mounted volumes can be very convenient.
The ElastiFlow Unified Flow Collector is configured using environment variables. The settings above provide an example configuration that represents the most likely settings to consider and modify when deploying the collector.
For a complete reference of all configuration options please refer to the Configuration Environment Variable Reference.
After completing configuration of the collector in the
docker-compose.yml file, you can start the container using one of the following commands...
From within the same path as the
From a path different from the location of the
To view the logs written by the container run:
To stop the container run: