[Filebeat] Netflow input - expand TCP controls bits to list of named flags
Open
enhancement
Filebeat
Stalled
Team:Security-Deployment and Devices
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 1h
- Merged PRs (30d)
- 370
Description
While converting the Logstash dashboards to work with Filebeat I didn't see anywhere that the tcpControlBits field gets expanded to a list of flags (e.g. 30 is SYN, RST, PSH, ACK). I think this would be nice enhancement and might make it easier to visualize the flags or filter flows based on a flag.
Contributor guide
Research direction
Locate the Filebeat Netflow input and trace how the tcpControlBits field is currently emitted. Compare the existing value with the issue's example, then define the named-flag output and verify that flows can be visualized or filtered by individual flags.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- networking
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100