CIDR syntax error for IP address enrichment

[robertclark]

Seeing the following error in the flow collector log on versions 7.10.3 and 7.11.0:

“ipaddr_enricher.hostname_enricher.ip/cider_to_values”,“caller”:“cidr2value/cidr2value.go:169”,“msg”:“provided value for 192.168.130.16/28 in /etc/elastiflow/metadata/ipaddrs.yml is not a string!”

Contents of the ipaddrs.yml:

192.168.130.16/28:
vlan: 11

I have tried single and double quotes and escaping the “/” in the CIDR. How should I specify a CIDR network in the ipaddrs.yml file considering that this is the example?

Specify whether the IP/CIDR/Range is considered to be “internal”.

192.0.2.0/24:
internal: true

Additional options are name, vlan, tags and metadata.

192.0.2.192/26:
name: atlanta_guest_wifi
vlan: 1001
tags:
- wifi
- dhcp
metadata:
dhcp.pool.name: atlanta_guest_wifi
.site.id: atlanta

Regards,

Robert

[dxturner]

YAML requires specific indentation. It’s not obvious in the post if the indentation in the file is correct. Can you attach the actual file or paste it in ‘code block’?

[robertclark]

My data:

192.168.130.16/28:
  vlan: 11

Sample config data:

# Additional options are name, vlan, tags and metadata.
192.0.2.192/26:
  name: atlanta_guest_wifi
  vlan: 1001
  tags:
    - wifi
    - dhcp
  metadata:
    dhcp.pool.name: atlanta_guest_wifi
    .site.id: atlanta

[dxturner]

I think the error message is indicating that it’s reading the CIDR address correctly, but the “provided value,” which in this case is 11 (the key-value pair is vlan-11). I would try putting quotes around the 11 and see if it parses correctly.

Please do let us know if that helps!

[robertclark]

Wrapping the VLAN id in quotes does not resolve the situation and also generates a new panic when the collector is started.

{"level":"panic","ts":"2025-06-11T15:46:58.393-0500","logger":"flowcoll","caller":"flowprocessor/instance_registration.go:159","msg":"failed to initialize cached components","code":"flowprocessor/cached-error","reason":"error building caches: error generating enrich IPAddr cache: error creating enrichIPaddr: IP Metadata Enricher initialization failed: could not parse user-defined metadata values in '/etc/elastiflow/metadata/ipaddrs.yml': yaml: unmarshal errors:\n  line 2: cannot unmarshal !!str `9` into uint64\n  line 4: cannot unmarshal !!str `10` into uint64\n  line 6: cannot unmarshal !!str `11` into uint64\n  line 8: cannot unmarshal !!str `14` into uint64\n  line 10: cannot unmarshal !!str `16` into uint64\n  line 12: cannot unmarshal !!str `12` into uint64\n  line 14: cannot unmarshal !!str `true` into bool","stacktrace":"github.com/elastiflow/flowcoll/pkg/processors/flowprocessor.NewInstantiatorRegistration.newCreateInstanceFunc.func1\n\t/tmp/collectors/pkg/processors/flowprocessor/instance_registration.go:159\ngithub.com/elastiflow/go-env-conf/instantiator.(*Instantiator).Run\n\t/root/go/pkg/mod/github.com/elastiflow/go-env-conf@v0.8.10/instantiator/instantiator.go:78\ngithub.com/elastiflow/flowcoll/pkg/apps/unified_flowcoll.(*App).Run\n\t/tmp/collectors/pkg/apps/unified_flowcoll/app.go:160\nmain.main\n\t/tmp/collectors/cmd/flowcoll/main.go:106\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:272"}

ipaddrs.yml:

192.168.131.0/29:
  vlan: "9"
192.168.129.0/29:
  vlan: "10"
192.168.130.16/28:
  vlan: "11"

Robert

[dxturner]

Thanks for the update. I will test to see if I can replicate.

Can you give me some details on the installation? Is this a native Linux install (if so, what flavor?) or a container installation?

[robertclark]

Native Linux installation: Rocky 9 - Kernel 5.14.0-570.19.1

Original flow-collector installation was 7.10.3 and recently upgraded to 7.11 to see if the upgrade addressed this enrichment issue.

Robert

[dxturner]

Check your messages in your forum account. Need some more information to try to replicate.

Thanks,
Dexter

[dxturner]

Hi Robert,

I think I see the issue in your flowcoll.yml file. You have the following entry:

EF_PROCESSOR_ENRICH_IPADDR_DNS_USERDEF_PATH: "/etc/elastiflow/metadata/ipaddrs.yml"

The DNS enricher is looking for string and not finding it in your ipaddrs.yml file. The default is /etc/elastiflow/hostname/user_defined.yml which has an IP address (not CIDR) and a string for the hostname.

Let us know if this resolves the issue!

Regards,
Dexter