elasticsearch – Use own IPFIX template fields within Kibana

I have an Elasticflow setup. I followed the instructions from here:
github.com/elastiflow/ElastiFlow-Tools/tree/main/docker_install

I’m sending IPFIX packets to the flow-collector.

ipfix.ie.use_iana_default()

sourceIPv4Address = ipfix.ie.for_spec('sourceIPv4Address')
destinationIPv4Address = ipfix.ie.for_spec('destinationIPv4Address')
applicationName = ipfix.ie.for_spec('applicationName')
protocolL7Name = ipfix.ie.for_spec('protocolL7Name(30206/1)')

fields_ipv4 = [
    sourceIPv4Address,
    destinationIPv4Address,
    applicationName,
    protocolL7Name
]

This is a short form of my template. Let us say we set the fields to:
192.168.2.1
192.168.3.1
testAppName
testProtocolL7Name

Within wireshark I can see all my fields, but the protocolL7Name field does not show up with this name. Within the Kibana UI the applicationName is shown. There is somehow a mapping included. I can use within the UI the field app.name

I want to have a similar mapping for my own IPFIX field protocolL7Name.

I added a mapping with Dev Tools

PUT .ds-elastiflow-flow-codex-2.3-tsds-*/_mapping
{
  "properties": {
    "protocolL7Name": {
      "type": "keyword"
    }
  }
}

But the field is empty within my Discover section.
Would like to use it like app.name e.g. prot.name

I also added a screenshot how this look like within Wireshark.
enter image description here

Read more here: Source link