rschirin
(Robert)
May 12, 2017, 3:47pm
1
Hi,
I'm trying to use a processor to drop events when "final" = false (I have flows enabled).
I've tried these processors:
drop_event.when.equals.final: ["false"]
drop_event.when.equals.final: false
drop_event.when.equals.final: "false"
but no one of them work. I'm not understanding how to filter on boolean value.
You can disable non-final flows by setting the period to -1
(or might be -1s
).
rschirin
(Robert)
May 12, 2017, 4:33pm
3
wow... there is really to much to learn.
by the way, in the .yml template I found this comment:
Configure reporting period. If set to -1, only killed flows will be reported
which is really clear. but, can you explain to me, for example, what does it mean if I set
period: 10s
value?
When period is >0 then you will get non-final events that give a summary of the flow up to that point in time.
BTW there is a new doc page for flows: https://www.elastic.co/guide/en/beats/packetbeat/master/flows.html
system
(system)
Closed
June 9, 2017, 6:50pm
5
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.