goflow icon indicating copy to clipboard operation
goflow copied to clipboard

Idea/Feature: Extensible decoder

Open shyam334 opened this issue 4 years ago • 0 comments

Netflow, IPFIX support templates, which supports device, device-class, vendor specific fields. These extended fields contain useful information, but it doesn't necessarily make sense to add to goflow's default list of supported fields.

The feature request is to have an extensible decoder for NFv9 and IPFIX, such that users are able to customise the decoder to support additional fields without having to maintain a full fledged fork of goflow.

As for implementation, I thought it could be :

  • Configuration driven system - which is good for simple mapping. (record field -> pb value)
  • Plugin system - decoder extension, which has access to the DataField and FlowMessage, which could enable complex transformations.
  • Other ideas.

What are your thoughts.

shyam334 avatar May 21 '20 00:05 shyam334