Hi,
If you define certain primitives, those not present in the parsed flow entry should be indeed left blank. If that is not the case, then it's a bug and i'd like to ask you for a way to reproduce the issue (so your config along with a brief capture (template + data packets) of your data. Paolo On Wed, Jan 15, 2020 at 04:07:17PM +0530, HEMA CHANDRA YEDDULA wrote: > > Hi, > > I have a scenario where we are planning to add custom primitives that > includes fields > across different protocols like http_request_host, http_response_code, > sip_request_uri > and sip_status_code. In the existing version, if they are defined to be > picked up from > payload, then all four of them pick some value depending on the length > defined. Is there > any way to sense the protocol and only meaningful custom primitives will pick > the value > and the rest should be blank. > > Thanks and regards, > Hema Chandra > > ------------------------------------------------------------------------------- > ::Disclaimer:: > ------------------------------------------------------------------------------- > > The contents of this email and any attachment(s) are confidential and intended > for the named recipient(s) only. It shall not attach any liability on C-DOT. > Any views or opinions presented in this email are solely those of the author > and may not necessarily reflect the opinions of C-DOT. Any form of > reproduction, dissemination, copying, disclosure, modification, distribution > and / or publication of this message without the prior written consent of the > author of this e-mail is strictly prohibited. If you have received this email > in error please delete it and notify the sender immediately. > > ------------------------------------------------------------------------------- > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
