Graylog2 / Graylog2/graylog2-server

Share IPFIX templates between cluster nodes

Open
#23,221 0 comments 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

From Support Issue: https://github.com/Graylog2/support/issues/297
[gz#2368](https://graylog7416.zendesk.com/agent/tickets/2368)

### How is it working currently (include screenshots and steps if needed):
Currently, the IPFIX input in Graylog receives flow data via UDP from networking infrastructure devices. Since UDP is a stateless protocol, the traffic cannot be reliably load balanced across Graylog nodes. The IPFIX input requires a template file to decode incoming flow data correctly. However, when load balancing is attempted, one Graylog node may receive the template, while another node receiving flow data may not—resulting in decoding failures due to the missing template.
This behavior makes it difficult to scale or balance IPFIX ingestion reliably in a clustered environment.

### Intended Purpose:
The purpose of this feature request is to enable all Graylog nodes to have consistent access to the IPFIX decoding template—ensuring proper processing of flow data regardless of which node receives it.

### Expected Outcome:
Graylog should provide a way to share IPFIX templates across all nodes in the cluster. This could be implemented either by:

- Automatically syncing the learned template data across all nodes, or
- Allowing users to specify an explicit template file that is accessible to all nodes.

Either option would ensure consistent decoding of IPFIX data and allow for reliable load balancing of the input.

### Business Impact:
IPFIX represents the majority of the customer's log ingest volume and is critical for network visibility and infrastructure monitoring. Without a way to share decoding templates across nodes, the customer cannot load balance this input—creating a potential single point of failure and limiting scalability.
Implementing this feature would improve system resiliency, scalability, and performance for large-scale deployments relying on IPFIX.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.