Exclude host enrichment

Network Flows
1

I would like to exclude the flow exporter from being enriched, in our ipaddrs.yml i have a subnet defined:

10.0.9.0/24:
  name: network equipment
  metadata:
    .geo.loc.coord: 2366,87
    .geo.city.name: cityA
    .geo.country.code: ABC
    .geo.country.name: countryA
    .geo.tz.name: Europe

And our flow exporter is within the above subnet flow exporter ip: 10.0.9.2 and the gets enriched like this:
image
To incl_excl.yml i have added:

exclude:
  #asn:
  #  -
  cidr:
    - 10.0.9.2/32

But that does not seam to work, anyone has an idea of what I am doing wrong?

2

Thanks for the information. We are looking into it. Can you share the flowcoll.yml file?

Regards,
Dexter Turner

3

I am not able to locate a flowcoll.yml file, I am running Elastiflow from a container

Best regards

Kåre

4

The configuration options for a docker installation are in the docker-compose.yml file.

5

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.