ERSpan Type 1 in Suricata 6.0.9

Help
1

I know that ERSpan Type 1 is enabled by default in Suricata 6.0.9.

Does the decoder statement still need to be in suricata.yaml?

This command returns an empty line currently:
grep decoder.erspan stats.log

I guess because the line does not appear in the file at this time.

If it should I’ll add it.

If it is no longer necessary, is there a way to get erspan stats?

2

You would see a warning if you put it in the config. How does your config look like and how do you run it? Could be related to the capture so might be worth to debug with more details about the setup.