Seeing the following error in the flow collector log on versions 7.10.3 and 7.11.0:
“ipaddr_enricher.hostname_enricher.ip/cider_to_values”,“caller”:“cidr2value/cidr2value.go:169”,“msg”:“provided value for 192.168.130.16/28 in /etc/elastiflow/metadata/ipaddrs.yml is not a string!”
Contents of the ipaddrs.yml:
192.168.130.16/28:
vlan: 11
I have tried single and double quotes and escaping the “/” in the CIDR. How should I specify a CIDR network in the ipaddrs.yml file considering that this is the example?
Specify whether the IP/CIDR/Range is considered to be “internal”.
192.0.2.0/24:
internal: true
Additional options are name, vlan, tags and metadata.
192.0.2.192/26:
name: atlanta_guest_wifi
vlan: 1001
tags:
- wifi
- dhcp
metadata:
dhcp.pool.name: atlanta_guest_wifi
.site.id: atlanta
Regards,
Robert
YAML requires specific indentation. It’s not obvious in the post if the indentation in the file is correct. Can you attach the actual file or paste it in ‘code block’?
My data:
192.168.130.16/28:
vlan: 11
Sample config data:
# Additional options are name, vlan, tags and metadata.
192.0.2.192/26:
name: atlanta_guest_wifi
vlan: 1001
tags:
- wifi
- dhcp
metadata:
dhcp.pool.name: atlanta_guest_wifi
.site.id: atlanta
I think the error message is indicating that it’s reading the CIDR address correctly, but the “provided value,” which in this case is 11 (the key-value pair is vlan-11). I would try putting quotes around the 11 and see if it parses correctly.
Please do let us know if that helps!
Wrapping the VLAN id in quotes does not resolve the situation and also generates a new panic when the collector is started.
{"level":"panic","ts":"2025-06-11T15:46:58.393-0500","logger":"flowcoll","caller":"flowprocessor/instance_registration.go:159","msg":"failed to initialize cached components","code":"flowprocessor/cached-error","reason":"error building caches: error generating enrich IPAddr cache: error creating enrichIPaddr: IP Metadata Enricher initialization failed: could not parse user-defined metadata values in '/etc/elastiflow/metadata/ipaddrs.yml': yaml: unmarshal errors:\n line 2: cannot unmarshal !!str `9` into uint64\n line 4: cannot unmarshal !!str `10` into uint64\n line 6: cannot unmarshal !!str `11` into uint64\n line 8: cannot unmarshal !!str `14` into uint64\n line 10: cannot unmarshal !!str `16` into uint64\n line 12: cannot unmarshal !!str `12` into uint64\n line 14: cannot unmarshal !!str `true` into bool","stacktrace":"github.com/elastiflow/flowcoll/pkg/processors/flowprocessor.NewInstantiatorRegistration.newCreateInstanceFunc.func1\n\t/tmp/collectors/pkg/processors/flowprocessor/instance_registration.go:159\ngithub.com/elastiflow/go-env-conf/instantiator.(*Instantiator).Run\n\t/root/go/pkg/mod/github.com/elastiflow/go-env-conf@v0.8.10/instantiator/instantiator.go:78\ngithub.com/elastiflow/flowcoll/pkg/apps/unified_flowcoll.(*App).Run\n\t/tmp/collectors/pkg/apps/unified_flowcoll/app.go:160\nmain.main\n\t/tmp/collectors/cmd/flowcoll/main.go:106\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:272"}
ipaddrs.yml:
192.168.131.0/29:
vlan: "9"
192.168.129.0/29:
vlan: "10"
192.168.130.16/28:
vlan: "11"
Robert
Thanks for the update. I will test to see if I can replicate.
Can you give me some details on the installation? Is this a native Linux install (if so, what flavor?) or a container installation?
Native Linux installation: Rocky 9 - Kernel 5.14.0-570.19.1
Original flow-collector installation was 7.10.3 and recently upgraded to 7.11 to see if the upgrade addressed this enrichment issue.
Robert
Check your messages in your forum account. Need some more information to try to replicate.
Thanks,
Dexter
Hi Robert,
I think I see the issue in your flowcoll.yml file. You have the following entry:
EF_PROCESSOR_ENRICH_IPADDR_DNS_USERDEF_PATH: "/etc/elastiflow/metadata/ipaddrs.yml"
The DNS enricher is looking for string and not finding it in your ipaddrs.yml file. The default is /etc/elastiflow/hostname/user_defined.yml which has an IP address (not CIDR) and a string for the hostname.
Let us know if this resolves the issue!
Regards,
Dexter
