# Netflow Enrich basic
**URL:** https://discuss.elastic.co/t/netflow-enrich-basic/289303
**Category:** Beats
**Tags:** filebeat
**Created:** [November 16, 2021, 10:52am UTC](https://discuss.elastic.co/t/netflow-enrich-basic/289303 "2021-11-16T10:52:13Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@randomguy](https://discuss.elastic.co/u/randomguy)
#### Post date: [November 16, 2021, 10:52am UTC](https://discuss.elastic.co/t/netflow-enrich-basic/289303/1 "2021-11-16T10:52:13Z")
Hi,
I started to learn more about neflow in my home lab but soon realized the Filebeat Netflow module is a bit too simple.
The short question: is there an easy way to enrich netflow data from filebeat?
I think they can be divided into 2 groups:
1. Static:
There is a filed called "netflow.protocol\_identifier", it is just a number hard to read for a human and looks bad during a filter or a riport. Is it possible to "translate" the fields to a common nem like : TCP, UDP instead of 6, 17.
2. Dynamic:
Based on the vendor you can assign APP ID (netflow.application\_id), Interface ID (netflow.ingress\_interface, netflow.egress\_interface), VRF ID (netflow.egress\_vrfid) and so on.
It would be better to see a friendly name of the app instead of an ID and try to manually decrypt it.
There are other fields listed here that an be changed and belong to the 1. or 2. group:
> **[NetFlow fields | Filebeat Reference \[master\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/master/exported-fields-netflow.html)**
I found a community project called elastiflow that meets the above requirements:
"Support for Option Templates - Dynamic enrichment of network interface name and application names and more!"
"Fully decodes and translates all available data - DSCP, TCP Options, ECN, Fragmentation Flags, and more."
Is there a similar easy way to do that using the officially supported Filebeat module or do I have to rely on a community project?
And a bonus question:
I can configure address ranges at: var.internal\_networks and it determinates the values of `source.locality` , `destination.locality` , and `flow.locality`.
Is there an easy way to create custom groups?
For example: DMZ, Server, Office, Internet, Frontend, Backend...?
---
### Author:  [@rcowart](https://discuss.elastic.co/u/rcowart)
#### Post date: [November 26, 2021, 10:18am UTC](https://discuss.elastic.co/t/netflow-enrich-basic/289303/2 "2021-11-26T10:18:18Z")
@randomguy you are obviously aware of ElastiFlow and its advantages over Filebeat. Regarding your "bonus question"... ElastiFlow 5.2.0 added the "User-Defined Metadata Enricher" to provide the kinds of enrichment that you mention. For info is here: [IP Address Enrichment | ElastiFlow](https://docs.elastiflow.com/docs/config_enrich_ip#user-defined-metadata-enrichment)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 24, 2021, 12:19pm UTC](https://discuss.elastic.co/t/netflow-enrich-basic/289303/3 "2021-12-24T12:19:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.