Closed leonel-santos closed 5 years ago
The Logstash TCP input used to resolve the name of all clients connecting to it. This caused a number of issues and may have been the problem here. There was a fix that added a feature to disable these lookups, which I have added to my development branch and will include in the next ElastiFlow release.
Hi. A problem of this kind is happening to me too.
When I export IPFIX flows via TCP or UDP to logstach within the same network, no problem. I can see the IPFIX flows in Elastiflow Kibana Dashboards.
When I have the IPFIX exporter on a different network than the ELK server, I can only decode IPFIX flows exported via UDP to the logstach. TCP dosen't work.
The error:
It seems that there is some modification in the IP address field and it is replaced by a DNS name associated with it.
Can someone help. Thanks in advance.