Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[filebeat][netflow] copy ipv6 addresses to ECS fields #19210

Closed
immon opened this issue Jun 16, 2020 · 2 comments · Fixed by #29383
Closed

[filebeat][netflow] copy ipv6 addresses to ECS fields #19210

immon opened this issue Jun 16, 2020 · 2 comments · Fixed by #29383
Labels

Comments

@immon
Copy link
Contributor

immon commented Jun 16, 2020

Describe the enhancement:

IPv6 addresses are not copied to destination.ip and source.ip fields. As a consequence visualizations for ipv6 netflows "do not work".

IPv4 addresses are correctly handled in convert.go#L190 and convert.go#L202.

A workaround at this moment is to modify netflow input like this:

  input:
    processors:
    - copy_fields:
      when:
        has_fields: ['netflow.destination_ipv6_address']
      fields:
        - from: netflow.destination_ipv6_address
          to: destination.ip
    - copy_fields:
      when:
        has_fields: ['netflow.source_ipv6_address']
      fields:
        - from: netflow.source_ipv6_address
          to: source.ip
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jun 16, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jun 16, 2020
@andrewkroh andrewkroh added the bug label Jun 16, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants