Netflow summarization of duplicate events

[srikwit]

Dear Team,

We currently have a setup that gathers Netflow data using vFlow which is sent to a Kafka instance from where it goes to Elasticsearch.

On analyzing the data we can see that an event with the same unique Source IP, Destination IP, Source Port, Destination Port, Packet size, Packet count, Start time and End time can be distributed across multiple captured packets.

This can increase the number of raw events of the captured data because the same conversation is present more than once in multiple DataSets.

Could you kindly suggest us a way to summarize them as one conversation using vFlow?