Hi Paolo, Thanks for the quick response. I've tried the way you said, adding a pre-tag map and label aggregation. I've tried the pre-tag map with label=hostname, and again with set_label=hostname label=hostname (this had been my first attempt). Still I can't get a netflow message with the hostname information. I don't want to jump to the nfacctd configuration without *seeing* the label in the netflow messages. Does it make sense ? Please review what I might be doing wrong and where exactly in the netflow messages should we expect to have that label.
Regards, Bruno On Fri, Apr 19, 2024 at 5:43 PM Paolo Lucente <[email protected]> wrote: > > Hi Bruno, > > Yes you can use labels for that & i have just proofed that working > successfully end-to-end (exporter and collector sides) on my local > environment. > > In the nfprobe config: > > pre_tag_map: /path/to/pretag.map > aggregate: label, < all other usual suspects here > > > Then in pretag.map, super simple: > label=<hostname> > > You can craft one single label packing all you want, and separating the > info the way you like, ie. <hostname>_<instance>, or be fancy and have > multiple labels that then pmacct will concatenate for you -- although i > don't real see a point to complicate stuff like that. > > Hope this helps. > > Paolo > > > On 18/4/24 18:23, Bruno Agostinho (He Him) wrote: > > Hello All, > > > > I'm using pmacctd to export netflow messages to further processing in > > centralized nfacctd's. I'd like to enrich netflow messages with the > > hostname (and possibly instance type). I've deduced from documentation > > and other discussions that netflow protocol isn't designed to support > > it. Hence nfprobe usage of tags and labels is restrained to manipulate > > direction and ifindex fields. And to achieve what I want I'd need to use > > a protocol other than netflow, like kafka. Please confirm my > > understanding or, if I'm wrong, how this can be achieved (using tags and > > labels or any other method). > > > > Thanks a lot in advance for any insight you can provide! > > > > Bruno > > > > _______________________________________________ > > pmacct-discussion mailing list > > http://www.pmacct.net/#mailinglists >
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
