Create input plugin for Cisco Netflow

[megastef]

Monitoring Cisco router traffic with Netflow: https://github.com/delian/node-netflowv9

[skprabhanjan]

Can i work on this issue?
A starter for this would be really helpful :)

[megastef]

Yes. Once you have test data it would be nice to share (e.g. as JSON file to simulate tests). You can find input plugins examples here:
https://github.com/sematext/logagent-js/tree/master/lib/plugins/input

See e.g TCP input plugin.
Docs: https://sematext.com/docs/logagent/input-plugin-tcp/
Source code: https://github.com/sematext/logagent-js/blob/master/lib/plugins/input/tcp.js
The key functions are here:

1. A constructor with config and eventEmitter as parameters:

function InputNetflow (config, eventEmitter) {
  this.eventEmitter = eventEmitter
  this.config = config
}

2. A start and stop function for the plugin.

InputNetflow.prototype.start = function () {
  if (!this.started) {
    this.createServer()
    this.started = true
  }
}

InputNetflow.prototype.stop = function (cb) {
  this.server.close(cb)
}

3. Received data should be emitted as JSON string as "raw" event including a "context" object with log source meta data. The context object should include a "sourceName" to identify log source.

var context = { name: 'input.netflow', sourceName: self.config.sourceName || socket.remoteAddress + ':' + socket.remotePort, serverPort: self.config.port }```
self.eventEmitter.emit('data.raw', fastSafeStringify(data), context)

An alternative would be to use 'data.parsed' events - but then input-filter plugins would be skipped, and no need for JSON serialisation/deserialisation.

self.eventEmitter.emit('data.parsed', data, context)

Once the plugin is working you could create an alias for the module loading like this one:
https://github.com/sematext/logagent-js/blob/master/bin/logagent.js#L36

And add documentation to the documentation (but we can help with it as well):
https://github.com/sematext/docs/tree/master/docs/logagent
If you like we can create Hactoberfest task for it in sematext/docs too.

[otisg]

@skprabhanjan Do you still intend to work on this?

[skprabhanjan]

@otisg ,Sorry for the delay, I will try to work on this but if someone else is willing then they can work on this and submit a PR.
Thanks :)

[Khodesaeed]

@otisg Can I start working on this issue?

[otisg]

@Khodesaeed Certainly, thanks!

[Khodesaeed]

Hi,
I've accomplished to receive netflow packets and store them in file,elasticsearch, and opensearch output via this package.
I need someone to review my code. Do I have to open a pull request? @otisg

[otisg]

Sounds good. Would be great to have some tests included, too.

[Khodesaeed]

I'll work on it. @otisg

[Khodesaeed]

#294