Feature: packetbeat flows support #756
Conversation
urso
added
enhancement
in progress
urso
force-pushed
the
feature/packetbeat-flows
branch
from
3feb499 to
ac99f0a
Compare
| func (pb *Packetbeat) setupSniffer(pub publisher.Client) error { | ||
| cfg := &pb.PbConfig | ||
|
|
||
| withVlans := cfg.Interfaces.With_vlans |
There was a problem hiding this comment.
After this PR we should probably to a "cleanup rename var" PR.
|
Some high level thoughts:
|
urso
force-pushed
the
feature/packetbeat-flows
branch
from
b0fec2f to
d0868b1
Compare
to be done
Yeah, a dedicated dashboard or kibana app. |
urso
force-pushed
the
feature/packetbeat-flows
branch
3 times, most recently
from
48a8abd to
f7b3b9a
Compare
| ICMPv6Flow FlowIDFlag = (1 << 8) | ||
| UDPFlow FlowIDFlag = (1 << 9) | ||
| TCPFlow FlowIDFlag = (1 << 10) | ||
| ConnectionID FlowIDFlag = (1 << 11) |
There was a problem hiding this comment.
Why not use iota for these? See Effective Go for an example of using iota for powers of two.
urso
force-pushed
the
feature/packetbeat-flows
branch
from
b125cae to
d876bd8
Compare
| ===== period | ||
|
|
||
| Configure the reporting interval. All flows are reported at the very same point | ||
| in time. Periodical reporting can be disabled by setting the value to -1. If |
There was a problem hiding this comment.
Why not 0 instead of -1? That would also be invalid, right?
There was a problem hiding this comment.
0 should have a similar effect. Due to parsing function it must say '0s' or '-1s' though.
|
When we say flows, is it worth clarifying which flow formats, e.g. NetFlow v5, NetFlow v9, IPFIX, sFlow, jFlow, ArborFlow, etc. |
urso
force-pushed
the
feature/packetbeat-flows
branch
from
d876bd8 to
d5bbcc4
Compare
urso
force-pushed
the
feature/packetbeat-flows
branch
from
d5bbcc4 to
0ff12f6
Compare
Feature: packetbeat flows support
Implements flow feature. For details see related issue: #670