Enhancements to handle bi-directional flows from Cisco ASA devices. about elastiflow HOT 4 CLOSED

c6d01da
Added the necessary logic for deriving timestamps and traffic volume (bytes and packets) for bi-directional flows as sent by Cisco ASA devices. Thanks especially to @jeenode, @Noebas and @sempervictus for your input.

I have committed fixes for these issues, but would like things tested before I close out the issues. If anyone can test and provide feedback here, I would really appreciate it.

@DanSheps @timmernet @azlocalit @dhermans

from elastiflow.

hi @robcowart
i tested using a clean 6.1.1 logstash/elastic/kibana and installed the two files from the commit attached to this issue. I replayed some captures with tcpreplay that I previously edited using tcprewrite.

apart from some 6.1.1 oddities ( you have to enter the advanced index dialog and re-enter netflow-* BEFORE selecting last_switched ) the new version works very nicely

basically all viz are working ( apart from a few where i'm obviously not sending data )
Thanks so much - looks fantastic..

from elastiflow.

I will update later today and give it a go.

from elastiflow.

Thanks for the feedback @dhermans. Closing this and releasing v1.2.0.

from elastiflow.