Libbeat ignore outgoing messages

(Esquive) #1


I used packetbeat on multiple hosts. So I needed to disable the outgoing messages. The problem was that despite having a proper configuration of /etc/hostname and /etc/hosts, in the publisher class it was not resolved resulting in messages being published anyway. So I made a small change: I did use a map of local IPs and droped the messages with Src.IP == any local IP. Are you interested in that small modification?

(Tudor Golubenco) #2

Hi, yes, that sounds like a more direct way of checking compared to the current version. Please send a pull request :-).

(system) #3