Exclude host enrichment

I would like to exclude the flow exporter from being enriched, in our ipaddrs.yml i have a subnet defined:
  name: network equipment
    .geo.loc.coord: 2366,87
    .geo.city.name: cityA
    .geo.country.code: ABC
    .geo.country.name: countryA
    .geo.tz.name: Europe

And our flow exporter is within the above subnet flow exporter ip: and the gets enriched like this:
To incl_excl.yml i have added:

  #  -

But that does not seam to work, anyone has an idea of what I am doing wrong?

Thanks for the information. We are looking into it. Can you share the flowcoll.yml file?

Dexter Turner

I am not able to locate a flowcoll.yml file, I am running Elastiflow from a container

Best regards


The configuration options for a docker installation are in the docker-compose.yml file.