Filebeat 7.2 netflow module and adding custom fields

Elastic Stack Beats
1

Hi there

I recently switched from using the logstash.netflow module to the filebeat.netflow module (so the data shows in SIEM).

In the logstash.netflow configuration I had the following field [netflow][sampling_bytes] which gave a closer reading to the data being transfered.

filter { ... event.set( '[netflow][sampling_bytes]', event.get('[netflow][in_bytes]').to_i * event.get('[netflow][sampling_interval]').to_i ) ... }

Any idea how would I replicate this in the filebeat.netflow module?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.