tshark + logstash

gistfile1.txt

logstash agent -e '
  input {
    pipe {
      type => tshark
      
      # run tshark unprivileged because it's protocol decoders can be buggy.
      command => "sudo tcpdump -w - | tshark -i - -lT fieldstshark -lT fields -E separator=, -E quote=d -e ip.src -e ip.dst -e ip.len"
    }
  }

  filter {
    csv {
      source => "@message"
      columns => [ "src", "dst", "bytes" ]
    }
    mutate {
      remove => "@message"
      convert => [ "bytes", "integer" ]
    }
  }

  output {
    elasticsearch_http { host => "some-server" flush_size => 50 }
  }
' 

What is the reason that you are piping output from tcpdump to tshark, rather than just running tshark directly?

what network bandwidth will this impact ELK ?