# Anyone using IPFIX?

**URL:** <https://discuss.elastic.co/t/anyone-using-ipfix/25366>\
**Category:** Logstash\
**Created:** [July 11, 2015, 5:49pm UTC](https://discuss.elastic.co/t/anyone-using-ipfix/25366 "2015-07-11T17:49:37Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![tpnoonan](https://avatars.discourse-cdn.com/v4/letter/t/76d3ee/32.png) [@tpnoonan](https://discuss.elastic.co/u/tpnoonan)\
**Post date:** [July 11, 2015, 5:49pm UTC](https://discuss.elastic.co/t/anyone-using-ipfix/25366/1 "2015-07-11T17:49:37Z")

</div>

I'm attempting to setup logstash(1.5.2) to accept netflow(ipfix) data from a Barracuda Network Gateway (F280). When i fire up logstash, I get the following warnings over and over.

←[33mIgnoring Netflow version v10 {:level=\>:warn}←[0m

my configuration file looks like this

input {  
udp {  
port =\> 9995  
codec =\> netflow  
}  
}  
output {  
stdout { }  
elasticsearch { host =\> "127.0.0.1" }  
}

appreciate any guidance that the community can provide.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 12, 2015, 8:34am UTC](https://discuss.elastic.co/t/anyone-using-ipfix/25366/2 "2015-07-12T08:34:19Z")

</div>

> The "netflow" codec is for decoding Netflow v5/v9 flows.

See [Netflow codec plugin | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-netflow.html)

---

<div class="post-metadata">

**Author:** ![tpnoonan](https://avatars.discourse-cdn.com/v4/letter/t/76d3ee/32.png) [@tpnoonan](https://discuss.elastic.co/u/tpnoonan)\
**Post date:** [July 12, 2015, 4:11pm UTC](https://discuss.elastic.co/t/anyone-using-ipfix/25366/3 "2015-07-12T16:11:18Z")

</div>

Is there an IPFIX codec that is available?

---

<div class="post-metadata">

**Author:** ![zbare](https://avatars.discourse-cdn.com/v4/letter/z/ecd19e/32.png) [@zbare](https://discuss.elastic.co/u/zbare)\
**Post date:** [July 5, 2016, 4:42pm UTC](https://discuss.elastic.co/t/anyone-using-ipfix/25366/4 "2016-07-05T16:42:15Z")

</div>

Did you ever find a solution for IPFIX?

---

<div class="post-metadata">

**Author:** ![tpnoonan](https://avatars.discourse-cdn.com/v4/letter/t/76d3ee/32.png) [@tpnoonan](https://discuss.elastic.co/u/tpnoonan)\
**Post date:** [July 9, 2016, 1:48pm UTC](https://discuss.elastic.co/t/anyone-using-ipfix/25366/5 "2016-07-09T13:48:19Z")

</div>

Yes, the latest versions of the codec can handle (some) ipfix data. You’ll just need to give it a shot for yours. Here’s a simple config.

input {

udp {

```
port => 9996

codec => netflow {

  versions => [10]

    target => "ipfix"

}

type => ipfix

```

}

}

output {

# Output to file rolling by day

# file { path =\> "logs/netflow\_events-%{+YYYY-MM-dd}.log" }

# Output to ElasticSearch

elasticsearch {

```
index => "logstash-netflow-%{+YYYY.MM.dd}"

hosts => ["192.168.100.24:9200","192.168.100.24:9201"]

```

}

}

---

<div class="post-metadata">

**Author:** ![zbare](https://avatars.discourse-cdn.com/v4/letter/z/ecd19e/32.png) [@zbare](https://discuss.elastic.co/u/zbare)\
**Post date:** [July 15, 2016, 4:50am UTC](https://discuss.elastic.co/t/anyone-using-ipfix/25366/6 "2016-07-15T04:50:16Z")

</div>

Thank you. This was very helpful and I'm happy to finally get this up and running.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:47am UTC](https://discuss.elastic.co/t/anyone-using-ipfix/25366/7 "2017-07-06T04:47:58Z")

</div>