elasticsearch – Use own IPFIX template fields within Kibana
I have an Elasticflow setup. I followed the instructions from here:
github.com/elastiflow/ElastiFlow-Tools/tree/main/docker_install
I’m sending IPFIX packets to the flow-collector.
ipfix.ie.use_iana_default()
sourceIPv4Address = ipfix.ie.for_spec('sourceIPv4Address')
destinationIPv4Address = ipfix.ie.for_spec('destinationIPv4Address')
applicationName = ipfix.ie.for_spec('applicationName')
protocolL7Name = ipfix.ie.for_spec('protocolL7Name(30206/1)')
fields_ipv4 = [
sourceIPv4Address,
destinationIPv4Address,
applicationName,
protocolL7Name
]
This is a short form of my template. Let us say we set the fields to:
192.168.2.1
192.168.3.1
testAppName
testProtocolL7Name
Within wireshark I can see all my fields, but the protocolL7Name field does not show up with this name. Within the Kibana UI the applicationName is shown. There is somehow a mapping included. I can use within the UI the field app.name
I want to have a similar mapping for my own IPFIX field protocolL7Name.
I added a mapping with Dev Tools
PUT .ds-elastiflow-flow-codex-2.3-tsds-*/_mapping
{
"properties": {
"protocolL7Name": {
"type": "keyword"
}
}
}
But the field is empty within my Discover section.
Would like to use it like app.name e.g. prot.name
I also added a screenshot how this look like within Wireshark.

Read more here: Source link
