I’ve tried the virtual interface option here: http://vger.kernel.org/lpc_net2018_talks/erspan-linux-presentation.pdf
It will mirror the traffic, however it remains encapsulated on the erspan interface unfortunately. Running Debian kernel 4.19. I’ll see if I can get the ebpf going at some point and post an update.
Seems like this problem has come up before: https://www.reddit.com/r/networking/comments/i2h03w/erspan_decapsulation_on_linux/