status of the flow filtration, profiling, and runtime reconfiguration features

[xoredbyte]

I would like to know the current status of the flow filtration, profiling, and runtime reconfiguration features.

At present, ipfixcol2 is capable of handling approximately 250 kfps when producing to the Kafka cluster without any filter plugin enabled.

1. Is it possible to perform filtering based on specific IPFIX flow record fields against a dataset containing say 10,000 unique field values?

2. Additionally, is there a way to update or modify these 10,000 field values without requiring a restart of the IPFIX Collector?

[sedmicha]

Hello!

1. It is possible, but the performance will differ based on which field it is. For now, only filtering based on IP is optimized for performance using a trie structure internally. Filtering of other types is performed in a naive way, so that number of elements might be a struggle. The filter is designed with extensibility in mind though, so adding such optimizations for other types would be possible.

2. Currently no, but it is also something that could be added.