Quickstart Guide

Getting Started

Follow this guide to get immediate insights into your network. This is an opinionated, non-production installation option that gets you set up with NetObserv and OpenSearch on a single virtual machine. Refer to the Installation section for production-grade deployments and setup.

The ElastiFlow Virtual Appliance provides a pre-configured virtual machine with Ubuntu 24.04 LTS, NetObserv Flow, and OpenSearch pre-installed. This is an ideal solution for proof-of-concept (PoC) and lab environments.

The virtual appliance is designed to get you up and running quickly. It includes a single-node OpenSearch cluster with a pre-configured NetObserv Flow instance. For production deployments, consider installing NetObserv Flow on dedicated infrastructure using Docker or native packages.

System Requirements

Requirement	Minimum
Hypervisor	VMware ESXi 6.7+, VMware Workstation, VMware Fusion, Proxmox VE 8.3+
vCPUs	4
Memory	16 GB
Disk	128 GB (expandable)

Download the OVA

wget https://elastiflow-virtual-appliance.s3.us-east-2.amazonaws.com/2026-07-10/elastiflow-quickstart-7.26.0-1-amd64.ova

curl -O https://elastiflow-virtual-appliance.s3.us-east-2.amazonaws.com/2026-07-10/elastiflow-quickstart-7.26.0-1-amd64.ova

Deploying the OVA

VMware ESXi / vCenter

1. Log into the vSphere Client or ESXi Host Client.
2. Navigate to Virtual Machines → Create/Register VM.
3. Select Deploy a virtual machine from an OVF or OVA file.
4. Browse to and select the downloaded OVA file.
5. Follow the deployment wizard (name, compute, storage).
6. Complete Initial Configuration (VMware ESXi) before powering on the VM.

VMware Workstation / Fusion

1. Select File → Open and choose the downloaded OVA.
2. Click Import and adjust VM settings as needed (at least 4 vCPUs / 16 GB RAM).
3. Complete Initial Configuration (VMware Workstation / Fusion) before powering on the VM. Do not power on until the cloud-init seed ISO is attached.

Proxmox

1. In Storage, edit your target storage (e.g. local) and enable Disk image and Import content types.
2. Select that storage → Import → Download from URL and paste:

https://elastiflow-virtual-appliance.s3.us-east-2.amazonaws.com/2026-07-10/elastiflow-quickstart-7.26.0-1-amd64.ova

1. Click Query URL, then Download.
2. Select the imported OVA and click Import. Adjust VM settings as needed.
3. Complete Initial Configuration (Proxmox) before powering on the VM.

Initial Configuration

Configure cloud-init before the first power-on. On first boot, cloud-init expands the disk, applies network settings, creates the elastiflow user, and enables SSH. First boot may take several minutes.

This appliance uses the network interface name eth0 (predictable names like ens160 are disabled). Use eth0 in any static IP configuration.

Proxmox initial configuration

1. Select the imported VM. If you do not see a Cloud-Init tab, open Hardware → Add → CloudInit Drive.
2. On the Cloud-Init tab, set User (elastiflow), Password, and IP Config (DHCP or static).
3. Click Regenerate Image, then power on the VM.

VMware ESXi initial configuration

Choose one method below, not both.

Option 1: VM configuration parameters (guestinfo)

The VM reads configuration via the VMware GuestInfo datasource on first boot.

user-data

Create a file named user-data:

#cloud-config
hostname: elastiflow
users:
  - name: elastiflow
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    lock_passwd: false
chpasswd:
  list: |
    elastiflow:your-password
  expire: false
ssh_pwauth: true
package_upgrade: false
growpart:
  mode: auto
  devices: ['/']
resize_rootfs: true

meta-data (static IP only)

For a static IP on vSphere, create a file named meta-data:

instance-id: elastiflow-vm
local-hostname: elastiflow
network:
  version: 2
  ethernets:
    eth0:
      dhcp4: false
      addresses:
        - 192.168.1.100/24
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses:
          - 8.8.8.8
          - 8.8.4.4

1. Create user-data using the template above. Add meta-data too if you need a static IP.
2. Base64-encode each file: base64 user-data | tr -d '\n' (repeat for meta-data if used).
3. With the VM powered off, go to VM Options → Advanced → Configuration Parameters → Edit Configuration.
4. Add guestinfo.userdata (paste the base64 output) and guestinfo.userdata.encoding (value: base64).
5. If using a static IP, also add guestinfo.metadata (paste the base64 output) and guestinfo.metadata.encoding (value: base64).
6. Power on the VM.

Option 2: Cloud-init ISO

Use the same seed-ISO steps as VMware Workstation / Fusion (create user-data, meta-data, and optional network-config, build a cidata ISO, attach it as a CD/DVD with Connect at power on).

VMware Workstation / Fusion initial configuration

Workstation and Fusion need a NoCloud seed ISO attached before first power-on (no vSphere cloud-init UI).

Password goes in user-data. Static IP goes in a separate network-config file — not in user-data. Without network-config, the VM uses DHCP.

1. Create the seed files

user-data (required):

#cloud-config
hostname: elastiflow
users:
  - name: elastiflow
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    lock_passwd: false
chpasswd:
  list: |
    elastiflow:your-password
  expire: false
ssh_pwauth: true

meta-data (required):

instance-id: elastiflow-vm
local-hostname: elastiflow

network-config (optional, static IP only). Do not add a network: wrapper or #cloud-config header:

version: 2
ethernets:
  eth0:
    dhcp4: false
    addresses:
      - 192.168.1.100/24
    routes:
      - to: default
        via: 192.168.1.1
    nameservers:
      addresses:
        - 8.8.8.8
        - 8.8.4.4

2. Build the seed ISO

The volume label must be cidata or CIDATA. On Linux/macOS:

# DHCP
genisoimage -output cloud-init.iso -volid cidata -joliet -rock user-data meta-data

# Static IP
genisoimage -output cloud-init.iso -volid cidata -joliet -rock user-data meta-data network-config

On Windows, use WSL (sudo apt install genisoimage) or have someone on Linux/macOS build the ISO.

3. Attach the ISO and power on

1. With the VM powered off, open Settings → add a CD/DVD drive → Use ISO image file → select cloud-init.iso.
2. Enable Connected / Connect at power on, then power on. First boot may take several minutes.

Finding the VM IP Address

Open the VM console or run ip -br addr / ip addr show eth0 after login. Connect with ssh elastiflow@<vm-ip> using the password from user-data.

Accessing the Services

Service	URL	Credentials	Port	Protocol
OpenSearch Dashboards	https://<vm-ip>:5601	admin / Elast1flow!	5601	TCP
Flow Collector API	http://<vm-ip>:8080	-	8080	TCP
Flow ingestion	<vm-ip>	-	9995	UDP
SSH	<vm-ip>	cloud-init password	22	TCP

Change the OpenSearch Dashboards password after first login. Your SSH password is the one you set during cloud-init.

Next Steps

1. Configure your network devices or cloud VPCs/VNets to send NetFlow, IPFIX, or sFlow data to your VM IP on UDP port 9995.
2. Open OpenSearch Dashboards at https://<vm-ip>:5601. Flow data may take a few minutes to appear after exporters are pointed at the VM.
3. To apply your ElastiFlow license, which is required for the collector to process more than 500 events per second, do the following:

   1. Request a free Basic License (valid for 1 year) or a 30-day Trial of NetObserv Premium.
   2. SSH to the VM (ssh elastiflow@<vm-ip>).
   3. Edit /etc/elastiflow/flowcoll.yml (this is how you make all future config changes of NetObserv).
   4. Navigate to EF_ACCOUNT_ID and enter your account ID. Navigate to EF_LICENSE_KEY and enter your license key. Then run sudo systemctl restart flowcoll.service to restart NetObserv. For more details on licenses, please refer to the license configuration page.

Troubleshooting

VM won't start

• Verify the OVA imported cleanly and the host meets the system requirements.
• Proxmox. Add a CloudInit Drive if the Cloud-Init tab is missing. Click Regenerate Image before first boot.
• VMware ESXi. Use guestinfo or a cloud-init ISO, not both. Set guestinfo while the VM is powered off.
• VMware Workstation / Fusion. Ensure the cloud-init ISO is attached, Connected, and set to Connect at power on before the first boot.

Cloud-init didn't apply

• Proxmox. Re-check the Cloud-Init tab and click Regenerate Image. Cloud-init only runs on first boot.
• VMware guestinfo. Verify parameter names, YAML syntax, and base64 encoding (no line breaks in the pasted value).
• Seed ISO. Confirm the ISO volume label is cidata / CIDATA, that user-data and meta-data are at the root of the ISO (not in a subfolder), and that the CD/DVD was connected at first power-on.
• Check the VM console for cloud-init errors. After login you can also inspect /var/log/cloud-init.log and /var/log/cloud-init-output.log.

Password worked, but static IP did not

• Put static IP in network-config on the seed ISO (or in guestinfo metadata network: on ESXi) — not in user-data.
• Rebuild with volume label cidata / CIDATA and interface eth0.
• Prefer a fresh OVA deploy. To retry an existing VM: attach a corrected ISO, run sudo cloud-init clean --logs --seed, and reboot.

Cannot access services or no flow data

• Confirm the VM has a valid IP and required ports are open.
• Allow a few minutes after first boot for services to start.
• For missing flow data, verify exporters target UDP 9995 and run sudo systemctl status flowcoll.service.

Running out of disk space

Expand the VM disk in your hypervisor, then resize the filesystem from within the VM.