netsampler / goflow2

High performance sFlow/IPFIX/NetFlow Collector
BSD 3-Clause "New" or "Revised" License
491 stars 112 forks source link

Field with a IP or ID of goflow instance. #354

Open giovaneh opened 1 month ago

giovaneh commented 1 month ago

Hello everyone.

I'm setting up an environment where I have a few GoFlow2 instances.

One of the metrics we use is to identify the origin of the flow.

We already know who created the flow, but we don't know who collected it.

This is important to us. We need to know which collector the equipment is connected to, since we use IP anycast.

I tried using mapping, but without success.

If anyone can give me some light, I would be immensely grateful.

formatter:
  fields:
    - goflow_source
    - src_addr
    - dst_addr
    - bytes
    - sampler_address
  protobuf:
    - name: goflow_source
      index: 100
      type: string

ipfix:
  mapping:
    - field: 8
      destination: src_addr
    - field: 12
      destination: dst_addr
    - field: 1
      destination: bytes
    - field: 130
      destination: sampler_address
    - destination: goflow_source
      type: const
      value: "10.1.2.3"

netflowv9:
  mapping:
    - field: 8
      destination: src_addr
    - field: 12
      destination: dst_addr
    - field: 1
      destination: bytes
    - field: 130
      destination: sampler_address
    - destination: goflow_source
      type: const
      value: "10.1.2.3"

sflow:
  mapping:
    - field: 8
      destination: src_addr
    - field: 12
      destination: dst_addr
    - field: 1
      destination: bytes
    - field: 130
      destination: sampler_address
    - destination: goflow_source
      type: const
      value: "10.1.2.3"
lspgn commented 1 month ago

Hi @giovaneh, Unfortunately there is currently no possibility to add a constant value out of the box. You will need to edit the code. This said, it's a good idea and will likely consider it for a future enhancement.