So I am doing a data visualization of netflow traffic, and I am running packetbeat in "af mode" to gather all of the netflow data.
The problem is that the IP that I am connecting to the box with packetbeat on it, is something I want to ignore. Since I know what it is and it is just cluttering things up in the visualization.
I want to ignore all of the traffic that has this data:
"dest.ip" of < XYZ >
and
"source.ip" of < IP of server running packetbeat >
I have the "packetbeat.ignore_outgoing: true" set up in my packetbeat.yml file. I am running this on CentOS and outputting the packetbeat data straight to Logstash.
which packetbeat version? You can drop events from within packetbeat using processors. Filtering via BPF would be better. Reason is, you want to filter as early as possible. Filtering late, still requires you to process and analyse the traffic. Filtering out in logstash means packetbeat has to serialize and send events. Filtering early via BPF saves you some resources.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.