Netflow, IPFIX support templates, which supports device, device-class, vendor specific fields.
These extended fields contain useful information, but it doesn't necessarily make sense to add to goflow's default list of supported fields.
The feature request is to have an extensible decoder for NFv9 and IPFIX, such that users are able to customise the decoder to support additional fields without having to maintain a full fledged fork of goflow.
As for implementation, I thought it could be :
Configuration driven system - which is good for simple mapping. (record field -> pb value)
Plugin system - decoder extension, which has access to the DataField and FlowMessage, which could enable complex transformations.
Netflow, IPFIX support templates, which supports device, device-class, vendor specific fields. These extended fields contain useful information, but it doesn't necessarily make sense to add to goflow's default list of supported fields.
The feature request is to have an extensible decoder for NFv9 and IPFIX, such that users are able to customise the decoder to support additional fields without having to maintain a full fledged fork of goflow.
As for implementation, I thought it could be :
DataFieldandFlowMessage, which could enable complex transformations.What are your thoughts.