App enrichment in Elastiflow

Any pointers on how to enable Application enrichment?
As soon as I enabled these options, the flowcoll service failed to load after a restart. What am I missing here?

EF_PROCESSOR_ENRICH_APP_ID_ENABLE: “true”
EF_PROCESSOR_DECODE_IPFIX_ENABLE: “true”

What is the error in the logs? What is the config file?

Is a wall of text bad form? Everything was working until I added the 2 lines above. Now the service won’t start.

Well, if you added two lines and it broke, I’d take one out and try again to see which one broke it :wink:

Actually, I think I know the issue. I think you need to provide a path to the app id lookup file. This feature allows you to create a look up for apps that are not learned from the option data. If you enable it, it expects to have a file to read/load.

Let us know if that helps.

Thanks,
Dexter

OK, the service is loading now. Thank you.


Is there anything else I need to do to see actual L7 applications?

Is it because my switch needs to be definied in the appid.yml file?

OK, just needed to enable app-recognition on my switch. It’s working now! Thanks for your help.

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.