Skip to content
This repository has been archived by the owner on Mar 22, 2024. It is now read-only.

Commit

Permalink
set translate refresh_behaviour to replace
Browse files Browse the repository at this point in the history
  • Loading branch information
@robcowart
robcowart committed Sep 17, 2018
1 parent f66d3c4 commit 69fe41a
Show file tree
Hide file tree
Showing 4 changed files with 28 additions and 0 deletions.
9 changes: 9 additions & 0 deletions logstash/elastiflow/conf.d/20_filter_20_netflow.logstash.conf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -510,6 +510,7 @@ filter {
field => "[node][ipaddr]"
destination => "[@metadata][appid_srctype]"
fallback => "${ELASTIFLOW_DEFAULT_APPID_SRCTYPE:__UNKNOWN}"
refresh_behaviour => "replace"
}

if [@metadata][appid_srctype] == "fortinet" {
Expand All @@ -532,6 +533,7 @@ filter {
field => "[@metadata][appid_key]"
destination => "[flow][application]"
fallback => "%{[netflow][application_id]}"
refresh_behaviour => "replace"
}
mutate {
id => "netflow_9_remove_app_id_unknown"
Expand Down Expand Up @@ -560,6 +562,7 @@ filter {
destination => "[netflow][rb_fe_type]"
override => true
fallback => "undefined (%{[netflow][rb_fe_type]})"
refresh_behaviour => "replace"
}
}
if [netflow][rb_passthru_reason] {
Expand All @@ -570,6 +573,7 @@ filter {
destination => "[netflow][rb_passthru_reason]"
override => true
fallback => "undefined (%{[netflow][rb_passthru_reason]})"
refresh_behaviour => "replace"
}
}
if [netflow][rb_wan_visibility] {
Expand All @@ -580,6 +584,7 @@ filter {
destination => "[netflow][rb_wan_visibility]"
override => true
fallback => "undefined (%{[netflow][rb_wan_visibility]})"
refresh_behaviour => "replace"
}
}
if [netflow][rb_cfe_tcp_port] {
Expand All @@ -589,6 +594,7 @@ filter {
field => "[netflow][rb_cfe_tcp_port]"
destination => "[netflow][rb_cfe_tcp_port_name]"
fallback => "__UNKNOWN"
refresh_behaviour => "replace"
}
if [netflow][rb_cfe_tcp_port_name] == "__UNKNOWN" {
mutate {
Expand All @@ -609,6 +615,7 @@ filter {
field => "[netflow][rb_outer_tcp_port]"
destination => "[netflow][rb_outer_tcp_port_name]"
fallback => "__UNKNOWN"
refresh_behaviour => "replace"
}
if [netflow][rb_outer_tcp_port_name] == "__UNKNOWN" {
mutate {
Expand All @@ -629,6 +636,7 @@ filter {
field => "[netflow][rb_sfe_tcp_port]"
destination => "[netflow][rb_sfe_tcp_port_name]"
fallback => "__UNKNOWN"
refresh_behaviour => "replace"
}
if [netflow][rb_sfe_tcp_port_name] == "__UNKNOWN" {
mutate {
Expand Down Expand Up @@ -660,6 +668,7 @@ filter {
field => "[node][ipaddr]"
destination => "[flow][sampling_interval]"
fallback => "0"
refresh_behaviour => "replace"
}
mutate {
convert => { "[flow][sampling_interval]" => "integer" }
Expand Down
2 changes: 2 additions & 0 deletions logstash/elastiflow/conf.d/20_filter_30_ipfix.logstash.conf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -403,6 +403,7 @@ filter {
field => "[node][ipaddr]"
destination => "[@metadata][appid_srctype]"
fallback => "${ELASTIFLOW_DEFAULT_APPID_SRCTYPE:__UNKNOWN}"
refresh_behaviour => "replace"
}

if [@metadata][appid_srctype] == "fortinet" {
Expand All @@ -425,6 +426,7 @@ filter {
field => "[@metadata][appid_key]"
destination => "[flow][application]"
fallback => "%{[ipfix][applicationId]}"
refresh_behaviour => "replace"
}
mutate {
id => "ipfix_remove_appid_unknown"
Expand Down
2 changes: 2 additions & 0 deletions logstash/elastiflow/conf.d/20_filter_40_sflow.logstash.conf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -167,6 +167,7 @@ filter {
destination => "[sflow][source_id_type]"
fallback => "UNKNOWN(%{[sflow][source_id_type]})"
override => true
refresh_behaviour => "replace"
}
}

Expand Down Expand Up @@ -298,6 +299,7 @@ filter {
destination => "[sflow][protocol]"
fallback => "UNKNOWN(%{[sflow][protocol]})"
override => true
refresh_behaviour => "replace"
}
}
} else {
Expand Down
15 changes: 15 additions & 0 deletions logstash/elastiflow/conf.d/20_filter_90_post_process.logstash.conf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -253,6 +253,7 @@ filter {
field => "[flow][dst_addr]"
destination => "[@metadata][dst_whitelist]"
fallback => "false"
refresh_behaviour => "replace"
}
# If not whitelisted, lookup the IP reputation.
if [@metadata][dst_whitelist] == "false" {
Expand All @@ -261,6 +262,7 @@ filter {
dictionary_path => "${ELASTIFLOW_DICT_PATH:/etc/logstash/elastiflow/dictionaries}/ip_rep_basic.yml"
field => "[flow][dst_addr]"
destination => "[@metadata][dst_rep_label]"
refresh_behaviour => "replace"
}
# Parse the IP reputation lable into tags.
if [@metadata][dst_rep_label] {
Expand Down Expand Up @@ -394,6 +396,7 @@ filter {
field => "[flow][src_addr]"
destination => "[@metadata][src_whitelist]"
fallback => "false"
refresh_behaviour => "replace"
}
# If not whitelisted, lookup the IP reputation.
if [@metadata][src_whitelist] == "false" {
Expand All @@ -402,6 +405,7 @@ filter {
dictionary_path => "${ELASTIFLOW_DICT_PATH:/etc/logstash/elastiflow/dictionaries}/ip_rep_basic.yml"
field => "[flow][src_addr]"
destination => "[@metadata][src_rep_label]"
refresh_behaviour => "replace"
}
# Parse the IP reputation lable into tags.
if [@metadata][src_rep_label] {
Expand Down Expand Up @@ -464,6 +468,7 @@ filter {
field => "[flow][src_port]"
destination => "[flow][src_port_name]"
fallback => "__UNKNOWN"
refresh_behaviour => "replace"
}
}
if [flow][dst_port] {
Expand All @@ -473,6 +478,7 @@ filter {
field => "[flow][dst_port]"
destination => "[flow][dst_port_name]"
fallback => "__UNKNOWN"
refresh_behaviour => "replace"
}
}
} else if [flow][ip_protocol] == 17 { # UDP
Expand All @@ -483,6 +489,7 @@ filter {
field => "[flow][src_port]"
destination => "[flow][src_port_name]"
fallback => "__UNKNOWN"
refresh_behaviour => "replace"
}
}
if [flow][dst_port] {
Expand All @@ -492,6 +499,7 @@ filter {
field => "[flow][dst_port]"
destination => "[flow][dst_port_name]"
fallback => "__UNKNOWN"
refresh_behaviour => "replace"
}
}
} else if [flow][ip_protocol] == 132 { # SCTP
Expand All @@ -502,6 +510,7 @@ filter {
field => "[flow][src_port]"
destination => "[flow][src_port_name]"
fallback => "__UNKNOWN"
refresh_behaviour => "replace"
}
}
if [flow][dst_port] {
Expand All @@ -511,6 +520,7 @@ filter {
field => "[flow][dst_port]"
destination => "[flow][dst_port_name]"
fallback => "__UNKNOWN"
refresh_behaviour => "replace"
}
}
} else if [flow][ip_protocol] == 33 { # DCCP
Expand All @@ -521,6 +531,7 @@ filter {
field => "[flow][src_port]"
destination => "[flow][src_port_name]"
fallback => "__UNKNOWN"
refresh_behaviour => "replace"
}
}
if [flow][dst_port] {
Expand All @@ -530,6 +541,7 @@ filter {
field => "[flow][dst_port]"
destination => "[flow][dst_port_name]"
fallback => "__UNKNOWN"
refresh_behaviour => "replace"
}
}
} else {
Expand Down Expand Up @@ -606,6 +618,7 @@ filter {
destination => "[flow][ip_protocol]"
fallback => "UNKNOWN(%{[flow][ip_protocol]})"
override => true
refresh_behaviour => "replace"
}

# Set final value of port name fields.
Expand Down Expand Up @@ -870,6 +883,7 @@ filter {
field => "[@metadata][in_if_key]"
destination => "[flow][input_ifname]"
fallback => "index: %{[flow][input_snmp]}"
refresh_behaviour => "replace"
}
}
if [flow][output_snmp] {
Expand All @@ -883,6 +897,7 @@ filter {
field => "[@metadata][out_if_key]"
destination => "[flow][output_ifname]"
fallback => "index: %{[flow][output_snmp]}"
refresh_behaviour => "replace"
}
}

Expand Down

0 comments on commit 69fe41a

Please sign in to comment.