Forum Discussion
Sarah
Cirrus
CirrusIPFIX Elements
Hello Everyone, I have created an iRule to query HTTP hostname, URI, and respose code and ship them along with other info to Elsatic collectors through ipfix log publisher. but we came to an issue...
Hello Reader,
Thankfully, we found the answer!
So, basically, some elements such as the http ones i'm using in my above iRule, which are built into BIG-IP system, are defined by IANA under F5's Private Enterprise Number (PEN) 12276. Hence, the [pen: F5 Networks Inc] appeared in wireshark in replacement of the acctual field name unlike the other standard fields.
Solution
In my case, using Logstash and the netflow codec, for any non standard element (not under PEN 0), we must override the YAML file containing IPFIX field definitions (id, data type, and enetrprits id) for the flow to get decoded and to avoid thrown errors as "unsupported field in template".
Please feel free to update the post should you have any queries.
Regards,
Sarah.
BrentYost
Nimbostratus
NimbostratusCertainly! The issue may stem from custom HTTP elements not recognized by collectors. Ensure elements align with IPFIX standards. Check collector documentation for compatibility and consider using standard Information Elements.