Missing User-ID field on Netflow from Palo Alto

[fpieressa (Franco)]

Hi team, we have configured a Palo Alto Firewall to send Netflow to a Filebeat.

We are seeing all events right, except that the "User-ID" Netflow field (value 56702) its not shown.

We have replaced the Filebeat with a Logstash, and with it we are seeing the "User-ID" Netflow field is mapped on the "netflow_user_id" Elasticsearch field.

Is there any way to configure the Netflow Filebeat Input to collect it? Or it's an issue that must be fixed in the code?

Thanks!

[andrewkroh]

The netflow input in Filebeat has support for custom field definitions. For example:

filebeat.inputs:
- type: netflow
  max_message_size: 10KiB
  host: "0.0.0.0:2055"
  protocols: [ v5, v9, ipfix ]
  expiration_timeout: 30m
  queue_size: 8192
  custom_definitions:
  - /etc/filebeat/netflow-application-specific-fields.yml

/etc/filebeat/netflow-application-specific-fields.yml:

346:
- :uint32
- :privateEnterpriseNumber
56701:
- :string
- :app_id
56702:
- :string
- :user_id

• https://knowledgebase.paloaltonetworks.com/servlet/fileField?entityId=ka10g000000D8OdAAK&field=Attachment_1__Body__s

[fpieressa (Franco)]

@andrewkroh

Great, it worked, thanks!!