Interface mapper extension issue

vaygr commented 1 year ago

For some reason in my setup it doesn't work, even though it seems netflow-collector processes yaml config properly.

I have:

pipeline:
  filter:
    - local-to-local: true
    - match: source_ip
      is: 0.0.0.0
    - match: source_ip
      is: 255.255.255.255
    - match: destination_ip
      is: 0.0.0.0
    - match: destination_ip
      is: 255.255.255.255
  enrich:
    - interface_mapper
    - protocol_name
  metrics:
    prefix: netflow
    items:
      - name: traffic_detail
        description: Traffic detail
        labels:
          - name: sampler
            value: sampler
            converter: ipv4
          - name: source_ip
            value: source_ip
            converter: ipv4
          - name: destination_ip
            value: destination_ip
            converter: ipv4
          - name: protocol
            value: proto_name
            converter: str
          - name: input_interface
            value: input_interface
            converter: uint32
          - name: output_interface
            value: output_interface
            converter: uint32
extensions:
  interface_mapper:
    0: if0
    1: if1
    2: if2
    5: if5

input_interface_name and output_interface_name don't show up in metrics.

rkosegi commented 1 year ago

Hi @vaygr, thanks for bug report. I'm sure this feature is working,I just checked output of collector and labels for interface names are present.

netflow_flow_traffic_detail{destination="142.251.36.142",destination_asn_org="Google LLC",destination_country="US",destination_port="443",input_interface="7",input_interface_name="bridge1",output_interface="1",output_interface_name="wan",protocol="udp",sampler="192.168.1.3",source="192.168.1.101",source_asn_org="",source_country="local",source_port="41389"} 3566
netflow_flow_traffic_detail{destination="142.251.37.106",destination_asn_org="Google LLC",destination_country="US",destination_port="443",input_interface="7",input_interface_name="bridge1",output_interface="1",output_interface_name="wan",protocol="tcp",sampler="192.168.1.3",source="192.168.1.104",source_asn_org="",source_country="local",source_port="54036"} 2319

Few things to check on your end.

make sure that interface indexes are correct. You can get those from SNMP walk for example
try to force map keys to be strings, as this is how data is modeled internally.
```
extensions:
  interface_mapper:
    "0": if0
    "1": if1
```

I will put more effort to examples/documentation.

vaygr commented 1 year ago

@rkosegi yes, I tested those with strings first, same issue. I do have input_interface and output_interface labels as 0, 1, 2, and 5, so they exist.

github-actions[bot] commented 8 months ago

This issue has been marked 'stale' due to lack of activity. The issue will be closed in another 30 days.

github-actions[bot] commented 7 months ago

This issue has been closed due to inactivity. If you feel this is in error, please reopen the issue or file a new issue with the relevant details.

rkosegi / netflow-collector

Interface mapper extension issue #8