App enrichment in Elastiflow

[garciajdusa]

Any pointers on how to enable Application enrichment?
As soon as I enabled these options, the flowcoll service failed to load after a restart. What am I missing here?

EF_PROCESSOR_ENRICH_APP_ID_ENABLE: “true”
EF_PROCESSOR_DECODE_IPFIX_ENABLE: “true”

[dxturner]

What is the error in the logs? What is the config file?

[garciajdusa]

Is a wall of text bad form? Everything was working until I added the 2 lines above. Now the service won’t start.

[garciajdusa]

[dxturner]

Well, if you added two lines and it broke, I’d take one out and try again to see which one broke it

Actually, I think I know the issue. I think you need to provide a path to the app id lookup file. This feature allows you to create a look up for apps that are not learned from the option data. If you enable it, it expects to have a file to read/load.

Let us know if that helps.

Thanks,
Dexter

[garciajdusa]

OK, the service is loading now. Thank you.

Is there anything else I need to do to see actual L7 applications?

[garciajdusa]

Is it because my switch needs to be definied in the appid.yml file?

[garciajdusa]

OK, just needed to enable app-recognition on my switch. It’s working now! Thanks for your help.