Skip to main content
Version: 7.16

User-Defined Metadata

The User-Defined Metadata (UDM) allows for additional information to be added to a record for a given IP address. It can also be used to override existing fields. Metadata may be specified for CIDR blocks, IP ranges, or individual IP addresses. See User-Defined Metadata Enrichment for more details.

EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE​

Specifies whether the user-defined metadata enrichment is enabled.

  • Valid Values
    • true, false
  • Default
    • false

EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH​

If the user-defined metadata enrichment is enabled (EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE is true) this setting is required, and specifies the path to the metadata file.

If the API is enabled (EF_PROCESSOR_ENRICH_IPADDR_METADATA_API_ENABLE, below), the file must only be modified via the API after startup. Any manual modifications after startup will be overwritten by changes made via the API.

For more details on the format of this file and the behavior of the User-Defined Metadata functionality, refer to: User-Defined Metadata Enrichment

  • Default
    • ''
  • Recommended
    • /etc/elastiflow/metadata/ipaddrs.yml

EF_PROCESSOR_ENRICH_IPADDR_METADATA_REFRESH_RATE​

If the API (EF_PROCESSOR_ENRICH_IPADDR_METADATA_API_ENABLE, below) is not enabled, the file specified in EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH can be loaded automatically to refresh values without restarting the collector. This value specifies the refresh interval, in minutes, that the file will be reloaded. The value of 0 disables refreshing of the values.

If the API is enabled (EF_PROCESSOR_ENRICH_IPADDR_METADATA_API_ENABLE, below), this setting is ignored, and the file will never be automatically reloaded; all changes must be made via the API.

  • API not enabled
    • Default
      • 15
  • API enabled
    • Setting is ignored; file is never reloaded.

API Configuration​

EF_PROCESSOR_ENRICH_IPADDR_METADATA_API_ENABLE​

Enable the REST/gRPC/connectrpc API for User-Defined Metadata. To enable this feature, EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE must also be set to true.

If the API is enabled, after startup of NetObserv Flow the EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH file is never re-read, and should not be modified by hand, only via the API.

For more on the API, see User-Defined Metadata API.

If this field is false (and EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE is true), then the API is disabled, and any updates to the EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH file must be done manually. As mentioned above, in that case the refresh rate can be configured using EF_PROCESSOR_ENRICH_IPADDR_METADATA_REFRESH_RATE.

  • Valid Values
    • true, false
  • Default
    • false

Other API Configuration options​

The IP address, port, TLS, and authentication options are the same as those for the administrative tasks API.