I’ve configured:
EF_PROCESSOR_ENRICH_APP_IPPORT_ENABLE: “true”
EF_PROCESSOR_ENRICH_APP_IPPORT_PATH: “/etc/elastiflow/app/ipport.yml”
EF_PROCESSOR_ENRICH_APP_IPPORT_PRIVATE: “true”
EF_PROCESSOR_ENRICH_APP_IPPORT_PUBLIC: “false”
EF_PROCESSOR_ENRICH_APP_REFRESH_RATE: 5
and in the file ipport.yml:
but ElastFlow does not identify the applications defined.
Any sugestion??..may be ipport.yml syntax??
Hard to tell from the image, actual text is easier to troubleshoot, but yes, it could be the syntax. You can find online YAML file syntax checkers and I often use those to validate the syntax.
Now is working. It was a syntax problem.
The “metadata” must use properties names between double quotes.
Example:
8530:
name: “WsusHTTP”
category: “Infraestructura”
subcategory: “WSUS”
metadata:
“business.unit”: “tecnologia”
“tcp.flags.tags”: “WSUS”
Just like the documentation:
https://docs.elastiflow.com/docs/config_ref/flowcoll/enrich_apps#ef_processor_enrich_app_ipport_path
Thanks for the update! It’s helpful for people who might have the same issue.
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.