goflow
goflow copied to clipboard
Idea/Feature: Extensible decoder
Netflow, IPFIX support templates, which supports device, device-class, vendor specific fields. These extended fields contain useful information, but it doesn't necessarily make sense to add to goflow's default list of supported fields.
The feature request is to have an extensible decoder for NFv9 and IPFIX, such that users are able to customise the decoder to support additional fields without having to maintain a full fledged fork of goflow.
As for implementation, I thought it could be :
- Configuration driven system - which is good for simple mapping. (record field -> pb value)
- Plugin system - decoder extension, which has access to the
DataField
andFlowMessage
, which could enable complex transformations. - Other ideas.
What are your thoughts.