docs/index.asciidoc in logstash-codec-netflow-3.10.0 vs docs/index.asciidoc in logstash-codec-netflow-3.11.0
- old
+ new
@@ -43,10 +43,11 @@
|Cisco ISR w/ HSL | | n | | Fails because of duplicate fields, see: https://github.com/logstash-plugins/logstash-codec-netflow/issues/93
|Cisco WLC | | y | |
|Citrix Netscaler | | | y | Still some unknown fields, labeled netscalerUnknown<id>
|fprobe | y | | |
|Fortigate FortiOS | | y | |
+|Huawei Netstream | | y | |
|ipt_NETFLOW | y | y | y |
|Juniper MX80 | y | | | SW > 12.3R8
|Mikrotik | y | | y | http://wiki.mikrotik.com/wiki/Manual:IP/Traffic_Flow
|nProbe | y | y | y | L7 DPI fields now also supported
|Nokia BRAS | | | y |
@@ -72,10 +73,12 @@
codec => netflow
}
}
--------------------------
-For high-performance production environments the configuration below will decode up to 15000 flows/sec on a dedicated 16 CPU instance. If your total flowrate exceeds 15000 flows/sec, you should use multiple Logstash instances.
+For high-performance production environments the configuration below will decode up to 15000 flows/sec from a Cisco ASR 9000 router on a dedicated 16 CPU instance. If your total flowrate exceeds 15000 flows/sec, you should use multiple Logstash instances.
+
+Note that for richer flows from a Cisco ASA firewall this number will be at least 3x lower.
[source, ruby]
--------------------------
input {
udp {