User-Defined Metadata

The User-Defined Metadata allows for additional information to be added to a record for a given IP address. It can also be used to override existing fields. Metadata maybe specified for CIDR blocks, IP ranges or individual IP addresses.

EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE

Specifies whether the user-defined metadata enrichment is enabled.

• Valid Values

  • true, false

• Default

  • true

EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH

If the user-defined metadata enrichment is enabled (EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE is true) this setting specifies the path to the metadata file. If this value is undefined or empty, metadata enrichment will be disabled.

For more details on the format of this file and the behavior of the User-Defined Metadata functionality refer to: User-Defined Metadata Enrichment

• Default

  • ''

• Recommended

  • /etc/elastiflow/metadata/ipaddrs.yml

EF_PROCESSOR_ENRICH_IPADDR_METADATA_REFRESH_RATE

The file specified in EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH can be loaded automatically to refresh values without restarting the collector. This value specifies the refresh interval, in minutes, that the file will be reloaded. The value of 0 disables refreshing of the values.

• Default

  • 15