Drop "final" flow events

(Roger) #1

I'm trying to use a processor to drop events when "final" = false (I have flows enabled).

I've tried these processors:

  • drop_event.when.equals.final: ["false"]
  • drop_event.when.equals.final: false
  • drop_event.when.equals.final: "false"

but no one of them work. I'm not understanding how to filter on boolean value.

(Andrew Kroh) #2

You can disable non-final flows by setting the period to -1 (or might be -1s).

(Roger) #3

wow... there is really to much to learn.
by the way, in the .yml template I found this comment:

Configure reporting period. If set to -1, only killed flows will be reported

which is really clear. but, can you explain to me, for example, what does it mean if I set

period: 10s


(Andrew Kroh) #4

When period is >0 then you will get non-final events that give a summary of the flow up to that point in time.

BTW there is a new doc page for flows: https://www.elastic.co/guide/en/beats/packetbeat/master/flows.html

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.