# Filebeat netflow cant parse netstream from huawei **URL:** \ **Category:** Beats\ **Tags:** elastic-stack-monitoring, filebeat\ **Created:** [October 9, 2020, 6:30am UTC](https://discuss.elastic.co/t/filebeat-netflow-cant-parse-netstream-from-huawei/251534 "2020-10-09T06:30:09Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ar4](https://avatars.discourse-cdn.com/v4/letter/a/ecc23a/32.png) [@ar4](https://discuss.elastic.co/u/ar4)\ **Post date:** [October 9, 2020, 6:30am UTC](https://discuss.elastic.co/t/filebeat-netflow-cant-parse-netstream-from-huawei/251534/1 "2020-10-09T06:30:09Z")
Hi, We using filebeat for collect netflow from Mikrotik. Also its work perfect. Now we need to collect netstream from Huawei AR2240 and it's don't work, flows no seen in kibana. Then i run filebeat at debug mode i see that: ```auto |2020-10-09T09:22:21.178+0300|DEBUG|[netflow]|netflow/input.go:80|[netflow-v9] FlowSet ID 5000 length 900| |---|---|---|---|---| |2020-10-09T09:22:21.178+0300|DEBUG|[netflow]|netflow/input.go:80|[netflow-v9] No template for ID 5000| |2020-10-09T09:22:21.277+0300|DEBUG|[netflow]|netflow/input.go:80|[netflow-v9] Packet from:10.17.0.1:40000 src:0 seq:15426997| |2020-10-09T09:22:21.277+0300|DEBUG|[netflow]|netflow/input.go:80|[netflow-v9] FlowSet ID 5000 length 900| |2020-10-09T09:22:21.277+0300|DEBUG|[netflow]|netflow/input.go:80|[netflow-v9] No template for ID 5000| |2020-10-09T09:22:21.378+0300|DEBUG|[netflow]|netflow/input.go:80|[netflow-v9] Packet from:10.17.0.1:40000 src:0 seq:15426998| |2020-10-09T09:22:21.378+0300|DEBUG|[netflow]|netflow/input.go:80|[netflow-v9] FlowSet ID 5000 length 900| |2020-10-09T09:22:21.378+0300|DEBUG|[netflow]|netflow/input.go:80|[netflow-v9] No template for ID 5000| |2020-10-09T09:22:21.378+0300|DEBUG|[netflow]|netflow/input.go:80|[netflow-v9] Packet from:10.17.0.1:40000 src:0 seq:15426999| |2020-10-09T09:22:21.378+0300|DEBUG|[netflow]|netflow/input.go:80|[netflow-v9] FlowSet ID 5000 length 900| |2020-10-09T09:22:21.378+0300|DEBUG|[netflow]|netflow/input.go:80|[netflow-v9] No template for ID 5000| |2020-10-09T09:22:21.425+0300|DEBUG|[netflow]|netflow/input.go:80|[netflow-v9] Packet from:10.17.0.1:40000 src:0 seq:15427000| |2020-10-09T09:22:21.425+0300|DEBUG|[netflow]|netflow/input.go:80|[netflow-v9] FlowSet ID 5000 length 360| |2020-10-09T09:22:21.425+0300|DEBUG|[netflow]|netflow/input.go:80|[netflow-v9] No template for ID 5000| ``` My netflow module config: ```auto - module: netflow log: enabled: true var: netflow_host: 0.0.0.0 netflow_port: 9996 ` ``` Configuration from Huawei: ```auto ip netstream tcp-flag enable ip netstream export source 10.17.0.1 ip netstream export host 10.18.0.1 9996 ip netstream export version 9 ip netstream record NETSTREAM_TEST match ipv4 source-address match ipv4 destination-address match ipv4 source-port match ipv4 destination-port match ipv4 protocol collect counter packets collect counter bytes collect interface input collect interface output Tunnel0/0/10 port ip netstream record NETSTREAM_TEST ip netstream inbound ip netstream outbound ``` ---
**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\ **Post date:** [October 12, 2020, 8:12am UTC](https://discuss.elastic.co/t/filebeat-netflow-cant-parse-netstream-from-huawei/251534/2 "2020-10-12T08:12:29Z")
Could you please post more details regarding the filebeat version you're using? It seems that the 3-rd party FlowSet template is not available, but I'm not sure what's the root cause (Huawei device doesn't export it?). ---
**Author:** ![ar4](https://avatars.discourse-cdn.com/v4/letter/a/ecc23a/32.png) [@ar4](https://discuss.elastic.co/u/ar4)\ **Post date:** [October 13, 2020, 11:27am UTC](https://discuss.elastic.co/t/filebeat-netflow-cant-parse-netstream-from-huawei/251534/3 "2020-10-13T11:27:37Z")
My filebeat version: ```auto filebeat version 7.9.2 (amd64), libbeat 7.9.2 [2ab907f5ccecf9fd82fe37105082e89fd871f684 built 2020-09-22 23:19:45 +0000 UTC] ``` About export flowset template, i dont know. All configuration of Huawei in first post. ---
**Author:** ![aav](https://avatars.discourse-cdn.com/v4/letter/a/439d5e/32.png) [@aav](https://discuss.elastic.co/u/aav)\ **Post date:** [October 15, 2020, 5:04pm UTC](https://discuss.elastic.co/t/filebeat-netflow-cant-parse-netstream-from-huawei/251534/4 "2020-10-15T17:04:32Z")
After adding the missing id to netflow\_definitions, the following error appears in the logs: 2020-10-15T19:56:51.466+0300 ERROR instance/beat.go:951 Exiting: Failed to start crawler: creating module reloader failed: field ID 107 has unknown type uint576 failed to load NetFlow fields ---
**Author:** ![aav](https://avatars.discourse-cdn.com/v4/letter/a/439d5e/32.png) [@aav](https://discuss.elastic.co/u/aav)\ **Post date:** [October 15, 2020, 5:17pm UTC](https://discuss.elastic.co/t/filebeat-netflow-cant-parse-netstream-from-huawei/251534/5 "2020-10-15T17:17:48Z")
After removing these fields from the template on the device, it still gives an error from the first post: ``` netflow/input.go:80|[netflow-v9] FlowSet ID 5000 length 360| netflow/input.go:80|[netflow-v9] No template for ID 5000| ``` ---
**Author:** ![aav](https://avatars.discourse-cdn.com/v4/letter/a/439d5e/32.png) [@aav](https://discuss.elastic.co/u/aav)\ **Post date:** [October 17, 2020, 11:47pm UTC](https://discuss.elastic.co/t/filebeat-netflow-cant-parse-netstream-from-huawei/251534/6 "2020-10-17T23:47:03Z")
Huawei device export template every 1 minute. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 15, 2020, 1:47am UTC](https://discuss.elastic.co/t/filebeat-netflow-cant-parse-netstream-from-huawei/251534/7 "2020-11-15T01:47:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.