Internal_networks setting for netflow integration


I'm trying to replace filebeat netflow module with elastic integration "netflow" that is deployed on a policy running on a few servers.

Flows are indexed properly, but there is no way to set the internal_networks parameter to allow the network direction field to be set.

In filebeat, we can set that as a config for netflow module, but as an integration in fleet there is no parameter called internal_networks.

I tried setting that parameter in the textbox called "Custom definitions", but that is not intended for that purpose and the agent failed starting.

How can we do this? Any docs?


Hey @Andres_Altamirano - thanks for flagging this. We've just merged a PR to add the internal_networks parameter to the Netflow integration. You should see an update available (to v2.6) to the integration, which will expose the parameter.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.