add pmacct IPFIX IEs

robcowart · Dec 19, 2019 · 4c5e960 · 4c5e960
1 parent 22e2415
commit 4c5e960
Show file tree

Hide file tree

Showing 2 changed files with 52 additions and 0 deletions.
diff --git a/logstash/elastiflow/definitions/ipfix.yml b/logstash/elastiflow/definitions/ipfix.yml
@@ -8362,6 +8362,23 @@
   - :uint32
   - :viptela_unk_4322
 
+# pmacct
+43874:
+  0:
+  - :skip
+  1:
+  - :uint64
+  - :pmacct_tag1
+  2:
+  - :uint64
+  - :pmacct_tag2
+  3:
+  - :uint64
+  - :pmacct_tag3
+  4:
+  - :uint64
+  - :pmacct_tag4
+
 # Ziften Technologies
 44619:
   257:

diff --git a/logstash/elastiflow/templates/elastiflow.template.json b/logstash/elastiflow/templates/elastiflow.template.json
@@ -19828,6 +19828,41 @@
 
 
 
+      {
+        "ipfix.pmacct_tag1": {
+          "path_match": "ipfix.pmacct_tag1",
+          "mapping": {
+            "type": "long"
+          }
+        }
+      },
+      {
+        "ipfix.pmacct_tag2": {
+          "path_match": "ipfix.pmacct_tag2",
+          "mapping": {
+            "type": "long"
+          }
+        }
+      },
+      {
+        "ipfix.pmacct_tag3": {
+          "path_match": "ipfix.pmacct_tag3",
+          "mapping": {
+            "type": "long"
+          }
+        }
+      },
+      {
+        "ipfix.pmacct_tag4": {
+          "path_match": "ipfix.pmacct_tag4",
+          "mapping": {
+            "type": "long"
+          }
+        }
+      },
+
+
+
       {
         "ipfix.ziften_inbound": {
           "path_match": "ipfix.ziften_inbound",