Ingest NetFlow records into Dynatrace

  • How-to guide
  • 2-min read

Network observability provides the necessary visibility to understand how applications interact with the underlying network. It allows teams to identify and address issues more effectively by starting with device health monitoring and extending to flow data collection—such as NetFlow—to track network usage. This approach actively supports performance optimization, enhances security, and streamlines troubleshooting efforts.

This guide shows you how to ingest NetFlow records into Dynatrace by setting up the collector.

Why monitor network flow with Dynatrace?

Ingesting network flows into Dynatrace immediately puts this data in context. The data contained in the network flows complements supported network use cases by linking flow volume and directions to devices and interfaces. The network flow data can be compared with process-to-process data to help solve network-induced application problems.

How does Dynatrace as a platform support NetFlow ingestion?

Dynatrace supports network flow protocols such as NetFlow, sFlow, and IPFIX through a fully supported version of the OpenTelemetry Collector. A dedicated network flow receiver enables seamless ingestion of flow data into the Dynatrace platform for analysis and visualization.

Prerequisites

See Collector Deployment and Collector Configuration on how to set up your Collector with the configuration below.

Steps

In this example, we deploy using Docker to keep the demonstration simple. For production use cases, we recommend deploying as a gateway on a Kubernetes cluster. For details, see Configure OpenTelemetry Collector for Kubernetes monitoring.

  1. To configure a Dynatrace Collector instance, create a file called otel-collector-config.yaml and add the following configuration:

    receivers:
      netflow:
          scheme: netflow
          port: 2055
          sockets: 16
          workers: 32
      netflow/sflow:
          scheme: sflow
          port: 6343
          sockets: 16
          workers: 32
    

    processors:
      batch:
        send_batch_size: 2000
        timeout: 30s
    

    exporters:
      otlp_http:
        endpoint: "${env:DT_ENDPOINT}"
        headers:
          Authorization: "Api-Token ${env:DT_API_TOKEN}"
    

    service:
      pipelines:
        logs:
          receivers: [netflow, netflow/sflow]
          processors: [batch]
          exporters: [otlp_http]
      telemetry:
        logs:
          level: debug

    Check the NetFlow receiver documentation for the available configuration options.

  2. Create an .env file to add the DT_ENDPOINT and DT_API_TOKEN variables.

    Ensure your .env file is properly secured and not exposed to unauthorized access, as it contains sensitive information.

  3. Create an access token by going to Access Tokens > Generate new token and selecting Ingest logs as a scope.

  4. Run the Collector image in Docker using the following command:

    docker run -p 2055:2055 --env-file ./.dt_token.env -v $(pwd)/otel-collector-config.yaml:/etc/otelcol/otel-collector-config.yaml ghcr.io/dynatrace/dynatrace-otel-collector/dynatrace-otel-collector:0.33.0 --config=/etc/otelcol/otel-collector-config.yaml

    Once the process is completed, you can start running and processing data.

    If you want the process to run in the background, you can kill it and run again with the -d option.

  5. Direct your network devices to send NetFlow records to the Collector.

    The network device configuration is vendor-specific. It must indicate the Dynatrace endpoint's IP address and the matching UDP port.

You have successfully configured NetFlow ingestion. Your network flow data is now available in Dynatrace for analysis.