|
| 1 | +# MQTT Plugin |
| 2 | + |
| 3 | +The **MQTT Plugin** extends flow records with MQTT (Message Queuing Telemetry Transport) message information. |
| 4 | + |
| 5 | +## Features |
| 6 | + |
| 7 | +- Extracts and exports MQTT fields if flow contains MQTT information. |
| 8 | +- Only MQTT v3.1.1 and v5.0 are supported. |
| 9 | +- Flow is finished when _disconect_ message is received. |
| 10 | + |
| 11 | +## Parameters |
| 12 | + |
| 13 | +| Long name | Short name | Type | Default | Description | |
| 14 | +| --------- | ------------ | ----- | ------- | ------------------------------------------------------- | |
| 15 | +| `tc` | `topiccount` | `int` | 10 | Maximal count of topics from _publish_ messages to save | |
| 16 | + |
| 17 | +## Output Fields |
| 18 | + |
| 19 | +| Field Name | Data Type | Description | |
| 20 | +| -------------------------------------------------------------------------- | ---------- | ----------------------------------------------------------------------------------------- | |
| 21 | +| `MQQT_TYPE_CUMULATIVE` | `uint16_t` | Bitfield of messages that were detected during the communication. Each value takes 1 bit. | |
| 22 | +| DISCONNECT \| PINGRESP \| PINGREQ \| UNSUBACK \| UNSUBSCRIBE \| | |
| 23 | +| SUBACK \| SUBSCRIBE \| PUBCOMP \| PUBREL \| PUBREC \| PUBACK \| PUBLISH \| | |
| 24 | +| CONNACK \| CONNECT \| session present flag from _connection_ message\| | |
| 25 | +| `MQTT_VERSION` | `uint8_t` | Identifies the MQTT version being used. | |
| 26 | +| `MQTT_CONNECTION_FLAGS` | `uint8_t` | Flags of _connection_ message. | |
| 27 | +| `MQTT_KEEP_ALIVE` | `uint16_t` | MQTT connection keep alive | |
| 28 | +| `MQTT_CONNECTION_RETURN_CODE` | `uint8_t` | Return code value from _connack_ message. | |
| 29 | +| `MQTT_PUBLISH_FLAGS` | `uint8_t` | Cumulative of _publish_ message flags. | |
| 30 | +| `MQTT_TOPICS` | `string` | Concatenation of **topiccount** topics from _publish_ messages. | |
| 31 | + |
| 32 | +## Usage |
| 33 | + |
| 34 | +### YAML Configuration |
| 35 | + |
| 36 | +Add the plugin to your ipfixprobe YAML configuration: |
| 37 | + |
| 38 | +```yaml |
| 39 | +process_plugins: |
| 40 | + - mqtt |
| 41 | +``` |
| 42 | +
|
| 43 | +### CLI Usage |
| 44 | +
|
| 45 | +You can also enable the plugin directly from the command line: |
| 46 | +
|
| 47 | +`ipfixprobe -p mqtt ...` |
| 48 | +`ipfixprobe -p "mqtt;tc=<topic_count>" ...` |
0 commit comments