When I receive netflow data from Cisco there seems to be an issue with the type of flow_start_msec.
I assume this should be treated as "date". But I get error messages like this:
"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [netflow.flow_start_msec]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"11298594751613545221\" is malformed at \"8594751613545221\""}}}}}
Does anybody know the details of this field from Cisco's side?