Metadata Configuration Options

The User-Defined Metadata allows for additional information to be added to a record for a given IP address. It can also be used to override existing fields. Metadata maybe specified for CIDR blocks, IP ranges or individual IP addresses.

EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE

Specifies whether the user-defined metadata enrichment is enabled.

• Valid Values

  • true, false

• Default

  • false

EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH

If the user-defined metadata enrichment is enabled (EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE is true) this setting specifies the path to the metadata file. If this value is undefined or empty, metadata enrichment will be disabled.

For more details on the format of this file and the behavior of the User-Defined Metadata functionality, refer to: User-Defined Metadata Enrichment

• Default

  • ''

• Recommended

  • /etc/elastiflow/metadata/ipaddrs.yml

EF_PROCESSOR_ENRICH_IPADDR_METADATA_REFRESH_RATE

The file specified in EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH can be loaded automatically to refresh values without restarting the collector. This value specifies the refresh interval, in minutes, that the file will be reloaded. The value of 0 disables refreshing of the values.

• Default

  • 15

EF_PROCESSOR_ENRICH_IPADDR_METADATA_API_ENABLE

Enable the REST/gRPC/connectrpc API for User-Defined Metadata. To enable this feature, EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE must also be set to true.

If the API is enabled, after startup of NetObserv, the file configured with EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH is never re-read, and should not be modified by hand, only via the API.

If this field is false (and EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE is true), then the API is disabled, and any updates to the EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH file must be done manually. As mentioned above, in that case the refresh rate can be configured using EF_PROCESSOR_ENRICH_IPADDR_METADATA_REFRESH_RATE.

• Valid Values

  • true, false

• Default

  • false