Skip to main content
Version: 5.6

User-Defined Metadata

The User-Defined Metadata allows for addtional information to be added to a record for a given IP address. It can also be used to override existing fields. Metadata maybe specified for CIDR blocks, IP ranges or individual IP addresses.

EF_FLOW_DECODER_ENRICH_IPADDR_METADATA_ENABLE​

Specifies whether the user-defined metadata enrichment is enabled.

  • Valid Values
    • true, false
  • Default
    • true

EF_FLOW_DECODER_ENRICH_IPADDR_METADATA_USERDEF_PATH​

If the user-defined metadata enrichment is enabled (EF_FLOW_DECODER_ENRICH_IPADDR_METADATA_ENABLE is true) this setting specifies the path to the metadata file. If this value is undefined or empty, metadata enrichment will be disabled.

note

If the value of the path begins with a / this path will be interpreted as an absolute file system path. Otherwise it will be interpreted as relative to the value of EF_FLOW_DECODER_SETTINGS_PATH.

For more details on the format of this file and the behavior of the User-Defined Metadata functionality refer to: User-Defined Metadata Enrichment

  • Default
    • ''
  • Recommended
    • metadata/ipaddrs.yml

EF_FLOW_DECODER_ENRICH_IPADDR_METADATA_REFRESH_RATE​

The file specified in EF_FLOW_DECODER_ENRICH_IPADDR_METADATA_USERDEF_PATH can be loaded automatically to refresh values without restarting the collector. This value specifies the refresh interval, in minutes, that the file will be reloaded. The value of 0 disables refreshing of the values.

  • Default
    • 15