Hello,
I am using filebeat to collect Netflow/IPFIX stream.
When IPFIX template specifies the same information element (IE) multiple times, filebeat yields only the last value. I am wondering if filebeat can handle it.
Another tool GitHub - CESNET/ipfixcol2: High-performance NetFlow v5/v9 and IPFIX collector (RFC7011) handles it by yielding an array for that IE.
The IPFIX template looks like this. Note the fields 71 and 17 are repeated.
