Skip to content

Commit 689f6c9

Browse files
committed
FDS Output: expand README with <outputSelection> documentation
1 parent 01f3982 commit 689f6c9

File tree

1 file changed

+29
-0
lines changed

1 file changed

+29
-0
lines changed

src/plugins/output/fds/README.rst

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,21 @@ Example configuration
2828
<timeWindow>300</timeWindow>
2929
<align>yes</align>
3030
</dumpInterval>
31+
<outputSelection>
32+
<element>iana:octetDeltaCount</element>
33+
<element>iana@reverse:octetDeltaCount@reverse</element>
34+
<element>iana:packetDeltaCount</element>
35+
<element>iana@reverse:packetDeltaCount@reverse</element>
36+
<element>iana:destinationIPv4Address</element>
37+
<element>iana:destinationIPv6Address</element>
38+
<element>iana:sourceIPv4Address</element>
39+
<element>iana:sourceIPv6Address</element>
40+
<element>iana:destinationTransportPort</element>
41+
<element>iana:sourceTransportPort</element>
42+
<element>iana:protocolIdentifier</element>
43+
<element>cesnet:quicSNI</element>
44+
<element>cesnet:TLSSNI</element>
45+
</outputSelection>
3146
</params>
3247
</output>
3348
@@ -62,6 +77,20 @@ Parameters
6277
and window size is 5 minutes long, files will be created at 0, 5, 10, etc.
6378
[values: yes/no, default: yes]
6479

80+
:``outputSelection``:
81+
Select only a subset of fields that will be saved in output. A list of IPFIX
82+
elements is provided. Any fields of an element that are not a part of this list
83+
will be skipped and not included in the resulting FDS output file.
84+
Note that when
85+
[default: all fields]
86+
87+
:``element``:
88+
The identifier of the IPFIX element in the form of ``SCOPE_NAME:ELEMENT_NAME``,
89+
for example ``iana:sourceIPv4Address``. ``SCOPE_NAME:`` prefix can be omitted in
90+
case of "iana:".
91+
Note: Reverse elements use the following naming pattern
92+
``iana@reverse:sourceIPv4Address@reverse``
93+
6594
:``asyncIO``:
6695
Allows to use asynchronous I/O for writing to the file. Usually when parts
6796
of the file are being written, the process is blocked on synchronous I/O

0 commit comments

Comments
 (0)