Huawei netstream v5 or V9 logstash 6.3.1 Ignoring Netflow version

Elastic Stack Logstash
1

ip netstream export version 5

[2018-08-16T16:10:51,220][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v32773
[2018-08-16T16:10:56,202][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v32773
[2018-08-16T16:11:01,096][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v32773
[2018-08-16T16:11:01,098][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v32773
[2018-08-16T16:11:01,164][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v32773
[2018-08-16T16:11:06,086][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v32773
[2018-08-16T16:11:11,054][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v32773
[2018-08-16T16:11:11,103][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v32773
[2018-08-16T16:11:11,103][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v32773
[2018-08-16T16:11:16,064][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v32773
[2018-08-16T16:11:16,064][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v32773
[2018-08-16T16:11:16,066][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v32773
[2018-08-16T16:11:16,093][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v32773

ip netstream export version 9

[2018-08-16T15:54:53,780][DEBUG][logstash.codecs.netflow ] Start processing data flowset 1315

[2018-08-16T15:54:53,780][WARN ][logstash.codecs.netflow ] Can't (yet) decode flowset id 1315 from source id 1, because no template to decode it with has been received. This message will usually go away after 1 minute.

[2018-08-16T15:54:53,785][DEBUG][logstash.codecs.netflow ] Start processing data flowset 1315

[2018-08-16T15:54:53,786][WARN ][logstash.codecs.netflow ] Can't (yet) decode flowset id 1315 from source id 1, because no template to decode it with has been received. This message will usually go away after 1 minute.

2

You should open an issue on the repo for logstash-codec-netflow and provide a PCAP of the flows in question.

3

Hi Robert,

Where can I open an issue?
Thanks a lot.

4
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.