> For the complete documentation index, see [llms.txt](https://docs.elastiflow.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.elastiflow.com/flowcoll/quickstart-guide.md). # Quickstart Guide ### Getting Started Follow this guide to get immediate insights into your network. This is an opinionated, non-production installation option that gets you set up with NetObserv and OpenSearch on a single virtual machine. Refer to the [Installation section](/flowcoll/installation.md) for production-grade deployments and setup. The ElastiFlow Virtual Appliance provides a pre-configured virtual machine with Ubuntu 24.04 LTS, NetObserv Flow, and OpenSearch pre-installed. This is an ideal solution for proof-of-concept (PoC) and lab environments. {% hint style="info" %} The virtual appliance is designed to get you up and running quickly. It includes a single-node OpenSearch cluster with a pre-configured NetObserv Flow instance. For production deployments, consider installing NetObserv Flow on dedicated infrastructure using Docker or native packages. {% endhint %} ### System Requirements | Requirement | Minimum | | ----------- | -------------------------------------------------------------------- | | Hypervisor | VMware ESXi 6.7+, VMware Workstation, VMware Fusion, Proxmox VE 8.3+ | | vCPUs | 4 | | Memory | 16 GB | | Disk | 128 GB (expandable) | ### Download the OVA ``` wget https://elastiflow-virtual-appliance.s3.us-east-2.amazonaws.com/2026-07-10/elastiflow-quickstart-7.26.0-1-amd64.ova ``` ``` curl -O https://elastiflow-virtual-appliance.s3.us-east-2.amazonaws.com/2026-07-10/elastiflow-quickstart-7.26.0-1-amd64.ova ``` ### Deploying the OVA #### VMware ESXi / vCenter 1. Log into the vSphere Client or ESXi Host Client. 2. Navigate to **Virtual Machines** → **Create/Register VM**. 3. Select **Deploy a virtual machine from an OVF or OVA file**. 4. Browse to and select the downloaded OVA file. 5. Follow the deployment wizard (name, compute, storage). 6. Complete [Initial Configuration (VMware ESXi)](#vmware-esxi-initial-configuration) before powering on the VM. #### VMware Workstation / Fusion 1. Select **File** → **Open** and choose the downloaded OVA. 2. Click **Import** and adjust VM settings as needed (at least 4 vCPUs / 16 GB RAM). 3. Complete [Initial Configuration (VMware Workstation / Fusion)](#vmware-workstation--fusion-initial-configuration) **before** powering on the VM. Do not power on until the cloud-init seed ISO is attached. #### Proxmox 1. In **Storage**, edit your target storage (e.g. local) and enable **Disk image** and **Import** content types. 2. Select that storage → **Import** → **Download from URL** and paste: ``` https://elastiflow-virtual-appliance.s3.us-east-2.amazonaws.com/2026-07-10/elastiflow-quickstart-7.26.0-1-amd64.ova ``` 3. Click **Query URL**, then **Download**. 4. Select the imported OVA and click **Import**. Adjust VM settings as needed. 5. Complete [Initial Configuration (Proxmox)](#proxmox-initial-configuration) before powering on the VM. ### Initial Configuration Configure cloud-init before the first power-on. On first boot, cloud-init expands the disk, applies network settings, creates the `elastiflow` user, and enables SSH. First boot may take several minutes. {% hint style="info" %} This appliance uses the network interface name **`eth0`** (predictable names like `ens160` are disabled). Use `eth0` in any static IP configuration. {% endhint %} #### Proxmox initial configuration 1. Select the imported VM. If you do not see a **Cloud-Init** tab, open **Hardware** → **Add** → **CloudInit Drive**. 2. On the **Cloud-Init** tab, set **User** (`elastiflow`), **Password**, and **IP Config** (DHCP or static). 3. Click **Regenerate Image**, then power on the VM. #### VMware ESXi initial configuration Choose one method below, not both. **Option 1: VM configuration parameters (guestinfo)** The VM reads configuration via the VMware GuestInfo datasource on first boot. **user-data** Create a file named `user-data`: ```yaml #cloud-config hostname: elastiflow users: - name: elastiflow sudo: ALL=(ALL) NOPASSWD:ALL shell: /bin/bash lock_passwd: false chpasswd: list: | elastiflow:your-password expire: false ssh_pwauth: true package_upgrade: false growpart: mode: auto devices: ['/'] resize_rootfs: true ``` **meta-data (static IP only)** For a static IP on vSphere, create a file named `meta-data`: ```yaml instance-id: elastiflow-vm local-hostname: elastiflow network: version: 2 ethernets: eth0: dhcp4: false addresses: - 192.168.1.100/24 routes: - to: default via: 192.168.1.1 nameservers: addresses: - 8.8.8.8 - 8.8.4.4 ``` 1. Create `user-data` using the template above. Add `meta-data` too if you need a static IP. 2. Base64-encode each file: `base64 user-data | tr -d '\n'` (repeat for `meta-data` if used). 3. With the VM powered off, go to **VM Options** → **Advanced** → **Configuration Parameters** → **Edit Configuration**. 4. Add `guestinfo.userdata` (paste the base64 output) and `guestinfo.userdata.encoding` (value: `base64`). 5. If using a static IP, also add `guestinfo.metadata` (paste the base64 output) and `guestinfo.metadata.encoding` (value: `base64`). 6. Power on the VM. **Option 2: Cloud-init ISO** Use the same seed-ISO steps as [VMware Workstation / Fusion](#vmware-workstation--fusion-initial-configuration) (create `user-data`, `meta-data`, and optional `network-config`, build a `cidata` ISO, attach it as a CD/DVD with **Connect at power on**). #### VMware Workstation / Fusion initial configuration Workstation and Fusion need a **NoCloud seed ISO** attached before first power-on (no vSphere cloud-init UI). {% hint style="warning" %} Password goes in `user-data`. Static IP goes in a separate `network-config` file — not in `user-data`. Without `network-config`, the VM uses DHCP. {% endhint %} **1. Create the seed files** **`user-data`** (required): ```yaml #cloud-config hostname: elastiflow users: - name: elastiflow sudo: ALL=(ALL) NOPASSWD:ALL shell: /bin/bash lock_passwd: false chpasswd: list: | elastiflow:your-password expire: false ssh_pwauth: true ``` **`meta-data`** (required): ```yaml instance-id: elastiflow-vm local-hostname: elastiflow ``` **`network-config`** (optional, static IP only). Do not add a `network:` wrapper or `#cloud-config` header: ```yaml version: 2 ethernets: eth0: dhcp4: false addresses: - 192.168.1.100/24 routes: - to: default via: 192.168.1.1 nameservers: addresses: - 8.8.8.8 - 8.8.4.4 ``` **2. Build the seed ISO** The volume label must be `cidata` or `CIDATA`. On Linux/macOS: ``` # DHCP genisoimage -output cloud-init.iso -volid cidata -joliet -rock user-data meta-data # Static IP genisoimage -output cloud-init.iso -volid cidata -joliet -rock user-data meta-data network-config ``` On Windows, use WSL (`sudo apt install genisoimage`) or have someone on Linux/macOS build the ISO. **3. Attach the ISO and power on** 1. With the VM powered off, open **Settings** → add a **CD/DVD** drive → **Use ISO image file** → select `cloud-init.iso`. 2. Enable **Connected** / **Connect at power on**, then power on. First boot may take several minutes. ### Finding the VM IP Address Open the VM console or run `ip -br addr` / `ip addr show eth0` after login. Connect with `ssh elastiflow@` using the password from `user-data`. ### Accessing the Services | Service | URL | Credentials | Port | Protocol | | --------------------- | ---------------------- | ------------------- | ---- | -------- | | OpenSearch Dashboards | `https://:5601` | admin / Elast1flow! | 5601 | TCP | | Flow Collector API | `http://:8080` | - | 8080 | TCP | | Flow ingestion | `` | - | 9995 | UDP | | SSH | `` | cloud-init password | 22 | TCP | {% hint style="warning" %} Change the OpenSearch Dashboards password after first login. Your SSH password is the one you set during cloud-init. {% endhint %} ### Next Steps 1. Configure your network devices or cloud VPCs/VNets to send NetFlow, IPFIX, or sFlow data to your VM IP on UDP port `9995`. 2. Open OpenSearch Dashboards at `https://:5601`. Flow data may take a few minutes to appear after exporters are pointed at the VM. 3. To apply your ElastiFlow license, which is required for the collector to process more than 500 events per second, do the following: 1. Request a free [Basic License](https://www.elastiflow.com/basic-license) (valid for 1 year) or a [30-day Trial](https://www.elastiflow.com/trial) of NetObserv Premium. 2. SSH to the VM (`ssh elastiflow@`). 3. Edit `/etc/elastiflow/flowcoll.yml` (this is how you make all future config changes of NetObserv). 4. Navigate to `EF_ACCOUNT_ID` and enter your account ID. Navigate to `EF_LICENSE_KEY` and enter your license key. Then run `sudo systemctl restart flowcoll.service` to restart NetObserv. For more details on licenses, please refer to the [license configuration](/flowcoll/configuration/config_gen/license.md) page. ### Troubleshooting #### VM won't start * Verify the OVA imported cleanly and the host meets the [system requirements](#system-requirements). * **Proxmox.** Add a **CloudInit Drive** if the Cloud-Init tab is missing. Click **Regenerate Image** before first boot. * **VMware ESXi.** Use guestinfo or a cloud-init ISO, not both. Set guestinfo while the VM is powered off. * **VMware Workstation / Fusion.** Ensure the cloud-init ISO is attached, **Connected**, and set to **Connect at power on** before the first boot. #### Cloud-init didn't apply * **Proxmox.** Re-check the Cloud-Init tab and click **Regenerate Image**. Cloud-init only runs on first boot. * **VMware guestinfo.** Verify parameter names, YAML syntax, and base64 encoding (no line breaks in the pasted value). * **Seed ISO.** Confirm the ISO volume label is `cidata` / `CIDATA`, that `user-data` and `meta-data` are at the root of the ISO (not in a subfolder), and that the CD/DVD was connected at first power-on. * Check the VM console for cloud-init errors. After login you can also inspect `/var/log/cloud-init.log` and `/var/log/cloud-init-output.log`. #### Password worked, but static IP did not * Put static IP in `network-config` on the seed ISO (or in guestinfo `metadata` `network:` on ESXi) — not in `user-data`. * Rebuild with volume label `cidata` / `CIDATA` and interface **`eth0`**. * Prefer a fresh OVA deploy. To retry an existing VM: attach a corrected ISO, run `sudo cloud-init clean --logs --seed`, and reboot. #### Cannot access services or no flow data * Confirm the VM has a valid IP and required [ports](#accessing-the-services) are open. * Allow a few minutes after first boot for services to start. * For missing flow data, verify exporters target UDP `9995` and run `sudo systemctl status flowcoll.service`. #### Running out of disk space Expand the VM disk in your hypervisor, then resize the filesystem from within the VM. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.elastiflow.com/flowcoll/quickstart-guide.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.