Adding support for Netflow field 130 (EXPORTER_IPV4_ADDRESS) for Flow Exporters Dashboard about elastiflow HOT 3 CLOSED

Good catch. I added ELASTIFLOW_KEEP_ORIG_DATA to README.md but not helper files. I guess I was trying to work too fast.

from elastiflow.

I just added support for this in v2.1.0 which is available here...
https://github.com/robcowart/elastiflow/releases/tag/v2.1.0

Added support for flow proxies, such as nProbe, which populate the exporterIPv4Address or exporterIPv6Address fields with the IP of the device from which the flow originated. This applies to both Netflow v9 and IPFIX flow types.

I have no way to test this myself (OK, I could setup nProbe, but it will probably be quicker for you at the moment), so please provide some feedback. If it works please close this issue.

Thanks.

from elastiflow.

Well that was fast 👍

I can confirm it is working, the node.ipaddr and node.hostname fields are now using the data from EXPORTER_IPV4_ADDRESS. (We don't log IPv6 flows, so can't confirm for that.)

Thank you.

I also tested the new setting ELASTIFLOW_KEEP_ORIG_DATA=false, and that also works.

But the file "logstash.service.d/elastiflow.conf" needs to be updated manually with that ENV variable at the moment.

from elastiflow.