manifest.yml

title: NetFlow logs
type: logs
streams:
  - input: netflow
    template_path: netflow.yml.hbs
    title: Collect NetFlow logs
    description: Collect NetFlow logs using the netflow input
    vars:
      - name: host
        type: text
        title: UDP host to listen on
        multi: false
        required: true
        show_user: true
        default: localhost
      - name: port
        type: integer
        title: UDP port to listen on
        multi: false
        required: true
        show_user: true
        default: 2055
      - name: expiration_timeout
        type: text
        title: Time duration before an idle session or unused template is expired. Valid time units are h, m, s.
        multi: false
        required: true
        show_user: false
        default: 30m
      - name: internal_networks
        type: text
        title: Internal Networks
        description: List of CIDR ranges describing the IP addresses that is considered internal. This is used in determining the values of `source.locality`, `destination.locality`, and `flow.locality`. The values can be either a CIDR value or one of the named ranges supported by the <<condition-network, `network`>> condition. The default value is `[private]` which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
        multi: true
        required: false
        show_user: true
      - name: queue_size
        type: integer
        title: Maximum number of packets that can be queued for processing
        multi: false
        required: true
        show_user: false
        default: 8192
      - name: read_buffer
        type: text
        title: Read Buffer Size
        description: |
          Sets the size of the OS read buffer on the UDP socket in the format KiB/MiB, an example would be: 10KiB. If it is not set, the existing operating system's default value is used.
        required: false
        show_user: false
      - name: custom_definitions
        type: text
        title: Custom definitions
        multi: true
        required: false
        show_user: false
        default: ""
      - name: detect_sequence_reset
        type: bool
        title: Whether to detect sequence reset
        multi: false
        required: true
        show_user: false
        default: true
      - name: max_message_size
        type: text
        title: Maximum size of the message received over UDP
        multi: false
        required: true
        show_user: false
        default: 10KiB
      - name: tags
        type: text
        title: Tags
        multi: true
        required: false
        show_user: false
        default:
          - netflow
          - forwarded
      - name: timeout
        type: text
        title: Read timeout for socket operations. Valid time units are ns, us, ms, s, m, h.
        multi: false
        required: false
        show_user: false
      - name: processors
        type: yaml
        title: Processors
        multi: false
        required: false
        show_user: false
        description: >-
          Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.