# Can't (yet) decode flowset id 256 from source id 0, because no template to decode it with has been received
**URL:** https://discuss.elastic.co/t/cant-yet-decode-flowset-id-256-from-source-id-0-because-no-template-to-decode-it-with-has-been-received/186465
**Category:** Logstash
**Created:** [June 19, 2019, 12:25pm UTC](https://discuss.elastic.co/t/cant-yet-decode-flowset-id-256-from-source-id-0-because-no-template-to-decode-it-with-has-been-received/186465 "2019-06-19T12:25:25Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@thirty2](https://discuss.elastic.co/u/thirty2)
#### Post date: [June 19, 2019, 12:25pm UTC](https://discuss.elastic.co/t/cant-yet-decode-flowset-id-256-from-source-id-0-because-no-template-to-decode-it-with-has-been-received/186465/1 "2019-06-19T12:25:25Z")
Hi,
my conf file for logstash looks like:
```
input {
udp {
port => 9995
codec => netflow {
versions => [5, 9]
}
type => netflow
tags => "port_9995"
}
}
output {
if "port_9995" in [tags] {
elasticsearch {
hosts => "localhost:9200"
index => "netflowtest"
}
}
}
```
Via tshark i can see that netflow data are coming to my host. But in logs i can see:
> [2019-06-19T14:22:41,063][WARN][logstash.codecs.netflow] Can't (yet) decode flowset id 256 from source id 0, because no template to decode it with has been received. This message will usually go away after 1 minute.
> [2019-06-19T14:22:41,066][WARN][logstash.codecs.netflow] Unsupported field in template 256 {:type=\>88, :length=\>2}
> [2019-06-19T14:22:43,059][WARN][logstash.codecs.netflow] Can't (yet) decode flowset id 256 from source id 0, because no template to decode it with has been received. This message will usually go away after 1 minute.
Plugin is in version logstash-codec-netflow (3.14.1)
I went through a lot of comments to this topic, but nothing helps me.
Thanks
---
### Author:  [@thirty2](https://discuss.elastic.co/u/thirty2)
#### Post date: [June 25, 2019, 11:13am UTC](https://discuss.elastic.co/t/cant-yet-decode-flowset-id-256-from-source-id-0-because-no-template-to-decode-it-with-has-been-received/186465/2 "2019-06-25T11:13:52Z")
Hi, this needs to be fixed on the device level or in the logstash? Thanks
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 25, 2019, 2:29pm UTC](https://discuss.elastic.co/t/cant-yet-decode-flowset-id-256-from-source-id-0-because-no-template-to-decode-it-with-has-been-received/186465/3 "2019-06-25T14:29:04Z")
Does the warning go away after a couple of minutes or does it persist?
---
### Author:  [@thirty2](https://discuss.elastic.co/u/thirty2)
#### Post date: [June 26, 2019, 6:40am UTC](https://discuss.elastic.co/t/cant-yet-decode-flowset-id-256-from-source-id-0-because-no-template-to-decode-it-with-has-been-received/186465/5 "2019-06-26T06:40:08Z")
I let it run for more than 10minutes and still have this warn.
---
### Author:  [@thirty2](https://discuss.elastic.co/u/thirty2)
#### Post date: [June 26, 2019, 10:34am UTC](https://discuss.elastic.co/t/cant-yet-decode-flowset-id-256-from-source-id-0-because-no-template-to-decode-it-with-has-been-received/186465/7 "2019-06-26T10:34:53Z")
Problem solved:
> 2019-06-19T14:22:41,066][WARN][logstash.codecs.netflow] Unsupported field in template 256 {:type=\>88, :length=\>2}
88 filed was missing in netflow.yaml
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 24, 2019, 10:46am UTC](https://discuss.elastic.co/t/cant-yet-decode-flowset-id-256-from-source-id-0-because-no-template-to-decode-it-with-has-been-received/186465/8 "2019-07-24T10:46:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.