IPPORT Enricher not working

ElastiFlow Community
1

I’ve configured:

EF_PROCESSOR_ENRICH_APP_IPPORT_ENABLE: “true”
EF_PROCESSOR_ENRICH_APP_IPPORT_PATH: “/etc/elastiflow/app/ipport.yml”
EF_PROCESSOR_ENRICH_APP_IPPORT_PRIVATE: “true”
EF_PROCESSOR_ENRICH_APP_IPPORT_PUBLIC: “false”
EF_PROCESSOR_ENRICH_APP_REFRESH_RATE: 5

and in the file ipport.yml:

ipport

but ElastFlow does not identify the applications defined.

Any sugestion??..may be ipport.yml syntax??

2

Hard to tell from the image, actual text is easier to troubleshoot, but yes, it could be the syntax. You can find online YAML file syntax checkers and I often use those to validate the syntax.

3

Now is working. It was a syntax problem.

The “metadata” must use properties names between double quotes.

Example:

8530:
name: “WsusHTTP”
category: “Infraestructura”
subcategory: “WSUS”
metadata:
“business.unit”: “tecnologia”
“tcp.flags.tags”: “WSUS”

Just like the documentation:
https://docs.elastiflow.com/docs/config_ref/flowcoll/enrich_apps#ef_processor_enrich_app_ipport_path

1 Like
4

Thanks for the update! It’s helpful for people who might have the same issue.