# Does codec netflow support L7 protocol name?

**URL:** <https://discuss.elastic.co/t/does-codec-netflow-support-l7-protocol-name/125303>\
**Category:** Logstash\
**Created:** [March 23, 2018, 5:04am UTC](https://discuss.elastic.co/t/does-codec-netflow-support-l7-protocol-name/125303 "2018-03-23T05:04:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [March 23, 2018, 5:04am UTC](https://discuss.elastic.co/t/does-codec-netflow-support-l7-protocol-name/125303/1 "2018-03-23T05:04:12Z")

</div>

Hi everyone, I export netflow to logstash and use the netflow codec plugin to analyze the flows, but I found that the flow data doesn't include L7 protocol name field.  
this is the json doc:

```
{
  "_index": "netflow-%{year}-%{month}-%{day}",
  "_type": "doc",
  "_id": "jF_yUGEBwY8ORgd4bUeK",
  "_version": 1,
  "_score": null,
  "_source": {
    "netflow": {
      "first_switched": "2018-02-01T10:24:40.341Z",
      "dst_mask": 0,
      "input_snmp": 144,
      "l4_dst_port": 4324,
      "sampling_algorithm": 0,
      "version": 5,
      "ipv4_next_hop": "120.127.163.1",
      "protocol": 17,
      "src_mask": 0,
      "dst_as": 0,
      "in_pkts": 1,
      "engine_type": 1,
      "output_snmp": 0,
      "last_switched": "2018-02-01T10:24:40.341Z",
      "tcp_flags": 0,
      "l4_src_port": 53,
      "ipv4_dst_addr": "168.95.43.41",
      "in_bytes": 126,
      "flow_seq_num": 1275194905,
      "sampling_interval": 0,
      "flow_records": 28,
      "src_as": 0,
      "engine_id": 2,
      "src_tos": 0,
      "ipv4_src_addr": "120.127.160.98"
    },
    "@timestamp": "2018-02-01T10:29:40.342Z",
    "@version": "1",
    "host": "120.127.163.4"
  },
  "fields": {
    "netflow.first_switched": [
      "2018-02-01T10:24:40.341Z"
    ],
    "@timestamp": [
      "2018-02-01T10:29:40.342Z"
    ],
    "netflow.last_switched": [
      "2018-02-01T10:24:40.341Z"
    ]
  },
  "sort": [
    1517480980342
  ]
}

```

I wonder whether it is due to the v5 netflow doesn't has the L7 protocol name field?  
If I change to v9 netflow would the doc has the field?

thank you in advance!

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [March 23, 2018, 7:22am UTC](https://discuss.elastic.co/t/does-codec-netflow-support-l7-protocol-name/125303/2 "2018-03-23T07:22:48Z")

</div>

Netflow v5 definitely does not have that field.

When you say "L7 protocol name" I assume you mean something like "application ID", as layer 7 doesn't really have protocols in the traditional sense. Netflow v9 definitely can transport this information and the codec has support for many related fields. For example, my Fortinet gear sends a field `netflow.application_id`.

The first question will be: Does your device support sending this information via Netflow. You may have to specifically configure it do so.

Rob

Robert Cowart ([rob@koiossian.com](mailto:rob@koiossian.com))  
[www.koiossian.com](http://www.koiossian.com)  
True Turnkey SOLUTIONS for the Elastic Stack

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2018, 7:22am UTC](https://discuss.elastic.co/t/does-codec-netflow-support-l7-protocol-name/125303/3 "2018-04-20T07:22:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.