How to filter out the 127.0.0.1 traffic from Packetbeat and Logstash?

link之家

链接快照平台

输入网页链接，自动生成快照
标签化管理网页链接

相关文章推荐

宽容的野马 · 猎豹移动· 2 周前 ·

博学的鸵鸟 · 游泳比赛中遇到的各种专业英文名词_手机搜狐网· 4 月前 ·

冷静的饼干 · 讲座纪要：何处是伊朗——伊朗概况-北京大学考 ...· 5 月前 ·

傻傻的茴香 · 足球经理数据_足球经理数据库选择_足球经理数 ...· 1 年前 ·

纯真的皮带 · 干货篇（1-40周）孕期注意事项- 知乎· 1 年前 ·

You didn't mention what you are monitoring with Packetbeat, but I'm assuming you are talking about flow data rather than any one specific protocol.

There are multiple ways to filter Packetbeat data. Here are a few options you can set in your config file.


    packetbeat.interfaces.device: eth0

- On Linux the psuedo "any" interface is used by default. If you do not want to capture localhost traffic then you can change the value to listen on a specific interface like


    eth0


    packetbeat.interfaces.bpf_filter: "net 192.168.0.0/16 not port 5044"

- You can use a custom BPF filter to select the traffic you are interested in.

Use a drop_event processor to select specific events to drop. It's more efficient to filter the traffic using one of the other methods. This would drop the data only after it has been processed by Packetbeat and turned into an event.

share improve this answer

推荐文章

宽容的野马 · 猎豹移动

2 周前

博学的鸵鸟 · 游泳比赛中遇到的各种专业英文名词_手机搜狐网

4 月前

冷静的饼干 · 讲座纪要：何处是伊朗——伊朗概况-北京大学考古文博学院

5 月前

傻傻的茴香 · 足球经理数据_足球经理数据库选择_足球经理数据库大小-抖音

1 年前

纯真的皮带 · 干货篇（1-40周）孕期注意事项- 知乎

1 年前