Seeing the following error in the flow collector log on versions 7.10.3 and 7.11.0:
“ipaddr_enricher.hostname_enricher.ip/cider_to_values”,“caller”:“cidr2value/cidr2value.go:169”,“msg”:“provided value for 192.168.130.16/28 in /etc/elastiflow/metadata/ipaddrs.yml is not a string!”
Contents of the ipaddrs.yml:
192.168.130.16/28:
vlan: 11
I have tried single and double quotes and escaping the “/” in the CIDR. How should I specify a CIDR network in the ipaddrs.yml file considering that this is the example?
Specify whether the IP/CIDR/Range is considered to be “internal”.
192.0.2.0/24:
internal: true
Additional options are name, vlan, tags and metadata.
YAML requires specific indentation. It’s not obvious in the post if the indentation in the file is correct. Can you attach the actual file or paste it in ‘code block’?
I think the error message is indicating that it’s reading the CIDR address correctly, but the “provided value,” which in this case is 11 (the key-value pair is vlan-11). I would try putting quotes around the 11 and see if it parses correctly.
Wrapping the VLAN id in quotes does not resolve the situation and also generates a new panic when the collector is started.
{"level":"panic","ts":"2025-06-11T15:46:58.393-0500","logger":"flowcoll","caller":"flowprocessor/instance_registration.go:159","msg":"failed to initialize cached components","code":"flowprocessor/cached-error","reason":"error building caches: error generating enrich IPAddr cache: error creating enrichIPaddr: IP Metadata Enricher initialization failed: could not parse user-defined metadata values in '/etc/elastiflow/metadata/ipaddrs.yml': yaml: unmarshal errors:\n line 2: cannot unmarshal !!str `9` into uint64\n line 4: cannot unmarshal !!str `10` into uint64\n line 6: cannot unmarshal !!str `11` into uint64\n line 8: cannot unmarshal !!str `14` into uint64\n line 10: cannot unmarshal !!str `16` into uint64\n line 12: cannot unmarshal !!str `12` into uint64\n line 14: cannot unmarshal !!str `true` into bool","stacktrace":"github.com/elastiflow/flowcoll/pkg/processors/flowprocessor.NewInstantiatorRegistration.newCreateInstanceFunc.func1\n\t/tmp/collectors/pkg/processors/flowprocessor/instance_registration.go:159\ngithub.com/elastiflow/go-env-conf/instantiator.(*Instantiator).Run\n\t/root/go/pkg/mod/github.com/elastiflow/go-env-conf@v0.8.10/instantiator/instantiator.go:78\ngithub.com/elastiflow/flowcoll/pkg/apps/unified_flowcoll.(*App).Run\n\t/tmp/collectors/pkg/apps/unified_flowcoll/app.go:160\nmain.main\n\t/tmp/collectors/cmd/flowcoll/main.go:106\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:272"}
The DNS enricher is looking for string and not finding it in your ipaddrs.yml file. The default is /etc/elastiflow/hostname/user_defined.yml which has an IP address (not CIDR) and a string for the hostname.