search

robcowart / elastiflow

Network flow analytics (Netflow, sFlow and IPFIX) with the Elastic Stack
Other
2.49k stars 597 forks source link

Adjusting for v9 sample rate #68

Closed jlixfeld closed 6 years ago

jlixfeld commented 6 years ago

Hey there,

Thanks for all the hard work with EF. It's glorious!

While using NFSen previously, the sample rate transmitted with the flow template was used to ensure the rate NFSen reported (graphs, etc) matched up, more or less, with the real world traffic rates.

Elastiflow doesn't seem to do that out of the box (ie: I'm seeing 20Mbps in when I should be seeing 20Gbps in) so I'm wondering if there's a knob (or should this be asked of the Netflow plugin authors instead?)?

I'm using EF 2.1.0, ELK 6.2.4.

Thanks!

jlixfeld commented 6 years ago

Looks like this is answered here: https://github.com/robcowart/elastiflow/issues/52