Pmacct

This config file (location depends on your configuration but mine exists at /etc/pmacct/nfacctd.conf) makes nfacct output a json formatted dump of all flows every minute to /tmp/nfacctd.json and call /usr/local/bin/nfacct-clickhouse-import to import it into clickhouse

debug: false
daemonize: false
pidfile: /var/run/nfacctd.pid

print_cache_entries: 1000000

plugin_pipe_size: 10240000
plugin_buffer_size: 10240

plugins: print[nfacct]
aggregate [nfacct]: tcpflags,tos,proto,src_host,dst_host,src_as,dst_as,src_port,dst_port,in_iface,out_iface,peer_src_ip
print_output_file[nfacct]: /tmp/nfacctd.json
print_output[nfacct]: json
print_history[nfacct]: 1m
print_history_roundoff[nfacct]: m
print_refresh_time[nfacct]: 60
print_trigger_exec[nfacct]: /usr/local/bin/nfacct-clickhouse-import

timestamps_since_epoch: true
timestamps_secs: true