Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Filebeat] Fixes for NetFlow v9 devices from various vendors #15449

Merged
merged 6 commits into from
Jan 14, 2020
Merged

[Filebeat] Fixes for NetFlow v9 devices from various vendors #15449

merged 6 commits into from
Jan 14, 2020

Commits on Jan 14, 2020

  1. NetFlow: Allow for zero scope fields in options template 

    NetFlow v9 spec allows for options templates that contain no scope
fields. The netflow input was treating this case as an error and
discarding the template, but that is only applicable to IPFIX.
    @adriansr
    adriansr committed Jan 14, 2020
    Configuration menu
    Copy the full SHA
    326f661 View commit details
    Browse the repository at this point in the history

  2. Use additional fields to populate bytes/pkt counters 

    Some devices out there (Cisco NSEL) use fields 231/232 as bytes
counters, when those are supposed to be layer 4 payload counters.

This updates the ECS fields populator to use those fields when the
expected ones are not found.

Fixes elastic#14212
    @adriansr
    adriansr committed Jan 14, 2020
    Configuration menu
    Copy the full SHA
    13a66ab View commit details
    Browse the repository at this point in the history

  3. Support a classId of 32 bits 

    While the spec mandates a classId of 8 bits, some Cisco ASA devices
actually use a 32 bit version of this field.

This patches the field to allow up to 32-bit integers and updates the
index pattern to use `long` for the `netflow.class_id` field.
    @adriansr
    adriansr committed Jan 14, 2020
    Configuration menu
    Copy the full SHA
    55f77f1 View commit details
    Browse the repository at this point in the history

  4. Add more fields from v9 Cisco devices

    @adriansr
    adriansr committed Jan 14, 2020
    Configuration menu
    Copy the full SHA
    51bf3de View commit details
    Browse the repository at this point in the history

  5. Make update

    @adriansr
    adriansr committed Jan 14, 2020
    Configuration menu
    Copy the full SHA
    9e9552b View commit details
    Browse the repository at this point in the history

  6. Missing update

    @adriansr
    adriansr committed Jan 14, 2020
    Configuration menu
    Copy the full SHA
    0e0b5c9 View commit details
    Browse the repository at this point in the history