Drop "final" flow events

Elastic Stack Beats
1

Hi,
I'm trying to use a processor to drop events when "final" = false (I have flows enabled).

I've tried these processors:

  • drop_event.when.equals.final: ["false"]
  • drop_event.when.equals.final: false
  • drop_event.when.equals.final: "false"

but no one of them work. I'm not understanding how to filter on boolean value.

2

You can disable non-final flows by setting the period to -1 (or might be -1s).

3

wow... there is really to much to learn.
by the way, in the .yml template I found this comment:

Configure reporting period. If set to -1, only killed flows will be reported

which is really clear. but, can you explain to me, for example, what does it mean if I set

period: 10s

value?

4

When period is >0 then you will get non-final events that give a summary of the flow up to that point in time.

BTW there is a new doc page for flows: https://www.elastic.co/guide/en/beats/packetbeat/master/flows.html