akvorado VS goflow2

i recently started using:https://github.com/akvorado/akvorado - very happy about it.

I played with Elastiflow extensively some years ago - it was excellent, if a little hungry on memory, but I suspect most of that was the logstash & elasticsearch overhead.

Rob did a big rewrite about 4 years ago, I think, licensing the new codebase in a way that led us to look elsewhere.

There's some alternatives that aren't elastic under the hood, of course. The hard-to-type Akvorado looks very promising, especially given its heritage:

https://github.com/akvorado/akvorado

Because we're moving to opentel / prometheus, this project (seems quite active) is especially interesting, with the promise of integrating OS & app metrics, tracing, and netflow insights:

https://github.com/netobserv/flowlogs-pipeline

I'm trying to deploy Akvorado, this has gone fine in my home lab. However I'm struggling to make this work in my work's lab and it's something we are keen to get working.

Akvorado is a flow collector for Netflow/IPFIX and sFlow that enriches the data with interface names and geo information, and then exports the results or lets you browse them via a web interface. Kindly suggested by brynx97.

I would look at https://github.com/akvorado/akvorado.

Akvorado, a free and opensource flow collector, developed by Vincent Bernat (Free)

I would also suggest Akvorado as an open source alternative.

I use goflow2 to do something like this. I don't specifically use syslog itself for this, but mtail to generate the metrics.

I've been using this one: https://github.com/netsampler/goflow2

Take a look at goflow2 which is based on Cloudflare's flow analysis pipeline.

I'm not particularly familiar with netflow formats, but this collector emits Prometheus metrics.

GoFlow2 is a high-performance sFlow/IPFIX/NetFlow collector that gathers network information and serializes it in a common format. This fork of CloudFlare's GoFlow provides horizontal scalability, consistent format and the ability to work with raw samples and build aggregation and custom enrichment. Our thanks for this suggestion goes to SuperQue.

You want something like goflow2.

There's goflow2, which is a fork of CloudFlare's goflow netflow collector.

I'd suggest looking at goflow2 before you write something new.

I personally use goflow2, but my needs are pretty simple.