So I am doing a data visualization of netflow traffic, and I am running packetbeat in "af mode" to gather all of the netflow data.
The problem is that the IP that I am connecting to the box with packetbeat on it, is something I want to ignore. Since I know what it is and it is just cluttering things up in the visualization.
I want to ignore all of the traffic that has this data:
"dest.ip" of < XYZ >
"source.ip" of < IP of server running packetbeat >
I have the "packetbeat.ignore_outgoing: true" set up in my packetbeat.yml file. I am running this on CentOS and outputting the packetbeat data straight to Logstash.
Is there any way to do this?