Hi, i had parsed netflow via filebeat 7.7.0 and send it to logstash 7.6.2 then elasticsearch 7.6.2, but i see the agent field is only about filebeat, not the client device information. "agent" => { "id" => "d5cd54a7-e74d-43b9-af3a-efd1c89a98a9", "version" => "7.7.0",…

Useragent information

rcowart (Rob Cowart) July 19, 2021, 8:56am 7

Yes. That is probably the case. You can always do a PCAP of the incoming records and confirm.

Topic		Replies	Views
Filebeat causes error messages in logstash Beats filebeat	2	758	March 30, 2020
Missing User-ID field on Netflow from Palo Alto Beats beats-module	3	1163	December 17, 2019
Can't get filebeat Netflow Module to work Beats filebeat	5	2809	January 25, 2021
Filebeat 7.2 netflow module and adding custom fields Beats filebeat	1	467	August 6, 2019
Filebeat netflow cant parse netstream from huawei Beats elastic-stack-monitoring , filebeat	6	1191	November 15, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Useragent information

Related topics