Can't (yet) decode flowset id 256 from source id 0, because no template to decode it with has been received

Elastic Stack Logstash
1

Hi,

my conf file for logstash looks like:

input {
  udp {
    port => 9995
    codec => netflow {
      versions => [5, 9]
    }
    type => netflow
    tags => "port_9995"
  }
}
output {
    if "port_9995" in [tags] {
    elasticsearch {
        hosts => "localhost:9200"
        index => "netflowtest"
    }
  }
}

Via tshark i can see that netflow data are coming to my host. But in logs i can see:

[2019-06-19T14:22:41,063][WARN ][logstash.codecs.netflow ] Can't (yet) decode flowset id 256 from source id 0, because no template to decode it with has been received. This message will usually go away after 1 minute.
[2019-06-19T14:22:41,066][WARN ][logstash.codecs.netflow ] Unsupported field in template 256 {:type=>88, :length=>2}
[2019-06-19T14:22:43,059][WARN ][logstash.codecs.netflow ] Can't (yet) decode flowset id 256 from source id 0, because no template to decode it with has been received. This message will usually go away after 1 minute.

Plugin is in version logstash-codec-netflow (3.14.1)

I went through a lot of comments to this topic, but nothing helps me.

Thanks

2

Hi, this needs to be fixed on the device level or in the logstash? Thanks

3

Does the warning go away after a couple of minutes or does it persist?

5

I let it run for more than 10minutes and still have this warn.

7

Problem solved:

2019-06-19T14:22:41,066][WARN ][logstash.codecs.netflow ] Unsupported field in template 256 {:type=>88, :length=>2}

88 filed was missing in netflow.yaml

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.