From 9f3d8c6b0b0feefc9c66415cbbd57664e57a78d1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20Sebasti=C3=A1n=20Soto=20Fern=C3=A1ndez?= Date: Mon, 11 Nov 2024 14:54:26 +0000 Subject: [PATCH] Add way to manage three scenearios to tagging --- resources/templates/default/sflow_tagging.conf.erb | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/resources/templates/default/sflow_tagging.conf.erb b/resources/templates/default/sflow_tagging.conf.erb index 9073eab..45c0120 100644 --- a/resources/templates/default/sflow_tagging.conf.erb +++ b/resources/templates/default/sflow_tagging.conf.erb @@ -1,11 +1,5 @@ filter { - # Default direction - mutate { - add_field => { - "direction" => "upstream" - } - } if ![tag] or [tag] == 0 { <% @flow_nodes.select{|s| s[:ipaddress] and s["redborder"] and s["redborder"]["homenets"] and !s["redborder"]["blocked"]}.each do |flow_node| %> @@ -19,9 +13,11 @@ filter { if homenets.any? {|subnet| subnet.include?(event.get('ip_src')) } if homenets.any? {|subnet| subnet.include?(event.get('ip_dst')) } event.set('direction', 'internal') - else - event.set('direction', 'downstream') + else + event.set('direction', 'upstream') end + elsif homenets.any? {|subnet| subnet.include?(event.get('ip_dst')) } + event.set('direction', 'downstream') end " }