[Packetbeat] How to distinguish netflow from different interface device in log?

Elastic Stack Beats
1

Packetbeat supports capturing all messages sent or received by the server on which Packetbeat is installed：

packetbeat.interfaces.device: any

But when I set the output to Elasticsearch, I found that the field interface.device does not exist on its log . In other words, How to distinguish netflow from different interface device in log?

2

Wi @492917328 welcome to the community!

Look at the interface fields here

interface.name
Interface name as reported by the system.

type: keyword

example: eth0

And

interface.id

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.