Comments (2)
robcowart
commented on June 14, 2024
While I can definitely see the value of normalizing BGP next hops across flow types. I am not sure that it makes sense to normalize BGP next hops, with other next hops.
Currently netflow.ipv4_next_hop, netflow.ipv6_next_hop, ipfix.ipNextHopIPv4Address, ipfix.ipNextHopIPv6Address and sflow.ip_address_next_hop_router are normalized to flow.next_hop
At the moment I would probably normalize netflow.bgp_ipv4_next_hop, netflow.bgp_ipv6_next_hop, ipfix.bgpNextHopIPv4Address, and ipfix.bgpNextHopIPv6Address to a new field flow.bgp_next_hop
Do you think it would be better to normalize the BGP next hop fields to flow.next_hop as well? If so, can you explain the use-case.
I have no BGP sources that I can investigate. Can you tell me if your flows are populating both next-hop fields or only one or the other (BGP-related and not-BGP-related)?
from elastiflow.
robcowart
commented on June 14, 2024
After discussion with a another telco user I have normalized netflow.bgp_ipv4_next_hop, netflow.bgp_ipv6_next_hop, ipfix.bgpNextHopIPv4Address, and ipfix.bgpNextHopIPv6Address to a new field flow.bgp_next_hop. This has been merged into master and will be included in the next release.
from elastiflow.
Related Issues (20)
- Import PCAP file from a USB File to ElasticFlow HOT 1
- RISKIQ behind proxy HOT 1
- Can't access ElastiFlow 5.0.0 in Docker HOT 2
- Centos 7 Install Logstsh sFlow codec fails HOT 1
- ElasticFlow : Netflow VLAN data is not populated in elastiflow HOT 2
- Elastiflow : Not generating enough data in Elastic HOT 2
- ElasticSearch 7.12 ... just checking :) HOT 3
- I can't see data (elastiflow) in kibana HOT 1
- docker image - flowcoll should recover once elasticsearch become available HOT 3
- index-pattern remain elastiflow empty HOT 8
- Invalid request payload JSON format HOT 4
- Elastic upgrade from 7.10 to 7.12 HOT 5
- source.as.organization.name always public HOT 2
- logstash is running but not able to see Sflow data HOT 3
- netflowv5 mikrotik no data in dashboard HOT 6
- kibana terms list might be incomplete because the request is taking to long HOT 1
- Mapper_parsing_exception HOT 2
- No matching indices found: No indices match pattern "elastiflow-flow-codex-*" HOT 2
- no data in threats HOT 2
- The legacy ElastiFlow is deprecated. TRY THE NEW ELASTIFLOW!!!
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from elastiflow.