Input pcap_dir

The input pcap_dir will read packets from pcap files in a specific directories. This input is useful when you captured traffic for some time and split them in multiple files.

Parameters

Name	Type	Default value	Description
directory	string	/tmp	Directory where the pcap files are stored.
match	string	\.p\?cap[0-9]*$	Regexp used to match pcap files in the specified directory. The default regexp will match files .pcap or .cap followed by any number.
bpf_filter	string	<empty>	Specify the Berkley packet filter to use.