# Calculation of first\_switched and last\_switched is not correct in netflow.rb cocde

**URL:** https://discuss.elastic.co/t/calculation-of-first-switched-and-last-switched-is-not-correct-in-netflow-rb-cocde/37151
**Category:** Logstash
**Created:** [December 14, 2015, 5:16pm UTC](https://discuss.elastic.co/t/calculation-of-first-switched-and-last-switched-is-not-correct-in-netflow-rb-cocde/37151 "2015-12-14T17:16:59Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![abhisheyke](https://avatars.discourse-cdn.com/v4/letter/a/a3d4f5/32.png) [@abhisheyke](https://discuss.elastic.co/u/abhisheyke)
#### Post date: [December 14, 2015, 5:16pm UTC](https://discuss.elastic.co/t/calculation-of-first-switched-and-last-switched-is-not-correct-in-netflow-rb-cocde/37151/1 "2015-12-14T17:16:59Z")

</div>

Looking at below snap of netfow.rb, It seems that overflow of bit is taken care during calculation of first\_switched and last\_switched. I can think a case where system up time may be smaller than first switched time in numeric form if there is overflow occurred. In that case, current netflow.rb will fail to generate accurate first\_switched and last\_switched. Any thought on this?

Thanks in advance.

Snip of code which calculate first\_switched and last\_switched.

```
    # The flow record sets the first and last times to the device
    # uptime in milliseconds. Given the actual uptime is provided
    # in the flowset header along with the epoch seconds we can
    # convert these into absolute times
    millis = flowset.uptime - v
    seconds = flowset.unix_sec - (millis / 1000)
    micros = (flowset.unix_nsec / 1000) - (millis % 1000)
    if micros < 0
      seconds--
      micros += 1000000
    end
    event[@target][k.to_s] = LogStash::Timestamp.at(seconds, micros).to_iso8601
  else
    event[@target][k.to_s] = v.snapshot
  end
end
```

---

<div class="post-metadata">

### Author: ![Leonardo\_Costanza](https://avatars.discourse-cdn.com/v4/letter/l/a6a055/32.png) [@Leonardo\_Costanza](https://discuss.elastic.co/u/Leonardo_Costanza)
#### Post date: [July 13, 2016, 11:16am UTC](https://discuss.elastic.co/t/calculation-of-first-switched-and-last-switched-is-not-correct-in-netflow-rb-cocde/37151/2 "2016-07-13T11:16:06Z")

</div>

You must replace "micros = ..." by "micros = (flowset.unix\_nsec / 1000) - ((millis % 1000) \* 1000)"

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:48am UTC](https://discuss.elastic.co/t/calculation-of-first-switched-and-last-switched-is-not-correct-in-netflow-rb-cocde/37151/3 "2017-07-06T04:48:05Z")

</div>