Skip to content

Commit 41e9dd8

Browse files
andrewkrohandrewkroh
committed
[Filebeat] Document netflow internal_networks and set default (#24110)
Documentation for the `internal_networks` option of the Netflow input and module was missing. Also the module's manifest did not declare the option so if it was not set in the module config it would cause an error. I did not see where a default was set for the netflow input's internal_networks option so I set that to `private` to keep the old behavior before this was configurable. Fixes #24094 (cherry picked from commit 3ca53aa)
1 parent 6274e0f commit 41e9dd8

7 files changed

Lines changed: 29 additions & 1 deletion

File tree

‎CHANGELOG.next.asciidoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
247247
- aws/s3access dataset was populating event.duration using the wrong unit. {pull}23920[23920]
248248
- Zoom module pipeline failed to ingest some chat_channel events. {pull}23904[23904]
249249
- Fix aws/vpcflow generating errors for empty logs or unidentified formats. {pull}24167[24167]
250+
- Fix Netlow module issue with missing `internal_networks` config parameter. {issue}24094[24094] {pull}24110[24110]
250251

251252
*Heartbeat*
252253

‎filebeat/docs/modules/netflow.asciidoc‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,13 @@ details.
7272
monitor sequence numbers in the Netflow packets to detect an Exporting Process
7373
reset. See <<filebeat-input-netflow,netflow input>> for details.
7474

75+
`var.internal_networks`:: A list of CIDR ranges describing the IP addresses that
76+
you consider internal. This is used in determining the values of
77+
`source.locality`, `destination.locality`, and `flow.locality`. The values
78+
can be either a CIDR value or one of the named ranges supported by the
79+
<<condition-network, `network`>> condition. The default value is `[private]`
80+
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
81+
7582
*`var.tags`*::
7683

7784
A list of tags to include in events. Including `forwarded` indicates that the

‎x-pack/filebeat/docs/inputs/input-netflow.asciidoc‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,17 @@ cause flow loss until the exporter provides new templates. If set to `false`,
120120
if the exporter process is reset. This option is only applicable to Netflow V9
121121
and IPFIX. Default is `true`.
122122

123+
[float]
124+
[[internal_networks]]
125+
==== `internal_networks`
126+
127+
A list of CIDR ranges describing the IP addresses that you consider internal.
128+
This is used in determining the values of `source.locality`,
129+
`destination.locality`, and `flow.locality`. The values can be either a CIDR
130+
value or one of the named ranges supported by the
131+
<<condition-network, `network`>> condition. The default value is `[private]`
132+
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
133+
123134
[id="{beatname_lc}-input-{type}-common-options"]
124135
include::../../../../filebeat/docs/inputs/input-common-options.asciidoc[]
125136

‎x-pack/filebeat/input/netflow/config.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ var defaultConfig = config{
3333
ForwarderConfig: harvester.ForwarderConfig{
3434
Type: inputName,
3535
},
36+
InternalNetworks: []string{"private"},
3637
Protocols: []string{"v5", "v9", "ipfix"},
3738
ExpirationTimeout: time.Minute * 30,
3839
PacketQueueSize: 8192,

‎x-pack/filebeat/module/netflow/_meta/docs.asciidoc‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,13 @@ details.
6767
monitor sequence numbers in the Netflow packets to detect an Exporting Process
6868
reset. See <<filebeat-input-netflow,netflow input>> for details.
6969

70+
`var.internal_networks`:: A list of CIDR ranges describing the IP addresses that
71+
you consider internal. This is used in determining the values of
72+
`source.locality`, `destination.locality`, and `flow.locality`. The values
73+
can be either a CIDR value or one of the named ranges supported by the
74+
<<condition-network, `network`>> condition. The default value is `[private]`
75+
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
76+
7077
*`var.tags`*::
7178

7279
A list of tags to include in events. Including `forwarded` indicates that the

‎x-pack/filebeat/module/netflow/log/config/netflow.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ expiration_timeout: '{{.expiration_timeout}}'
66
queue_size: {{.queue_size}}
77

88
{{if .internal_networks}}
9-
internal_hosts:
9+
internal_networks:
1010
{{range .internal_networks}}
1111
- '{{ . }}'
1212
{{end}}

‎x-pack/filebeat/module/netflow/log/manifest.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ var:
1717
- name: detect_sequence_reset
1818
- name: tags
1919
default: [forwarded]
20+
- name: internal_networks
2021
ingest_pipeline: ingest/pipeline.yml
2122
input: config/netflow.yml
2223

0 commit comments

Comments
 (0)