Missing User-ID field on Netflow from Palo Alto

Hi team, we have configured a Palo Alto Firewall to send Netflow to a Filebeat.

We are seeing all events right, except that the "User-ID" Netflow field (value 56702) its not shown.

We have replaced the Filebeat with a Logstash, and with it we are seeing the "User-ID" Netflow field is mapped on the "netflow_user_id" Elasticsearch field.

Is there any way to configure the Netflow Filebeat Input to collect it? Or it's an issue that must be fixed in the code?


The netflow input in Filebeat has support for custom field definitions. For example:

- type: netflow
  max_message_size: 10KiB
  host: ""
  protocols: [ v5, v9, ipfix ]
  expiration_timeout: 30m
  queue_size: 8192
  - /etc/filebeat/netflow-application-specific-fields.yml


- :uint32
- :privateEnterpriseNumber
- :string
- :app_id
- :string
- :user_id

Great, it worked, thanks!!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.