Logstack netflow getting error for Netflowversion 9

Elastic Stack Logstash
1

Hi Team ,
During my testing it seems that logstah 5.1.1 is sending WARN message to process Netflow 9 messages
In my setup Netflow 5 version is working fine .
Any body knows root cases for this issue

My error message are given below

[2016-12-23T05:22:30,245][WARN ][logstash.codecs.netflow ] No matching template for flow id 256
[2016-12-23T05:22:30,267][WARN ][logstash.codecs.netflow ] Unsupported field {:type=>0, :length=>0}
[2016-12-23T05:22:30,268][WARN ][logstash.codecs.netflow ] Unsupported field {:type=>0, :length=>0}
[2016-12-23T05:22:30,270][WARN ][logstash.codecs.netflow ] Unsupported field {:type=>0, :length=>0}
[2016-12-23T05:22:30,270][WARN ][logstash.codecs.netflow ] No matching template for flow id 256
[2016-12-23T05:22:30,275][WARN ][logstash.codecs.netflow ] Unsupported field {:type=>0, :length=>0}
[2016-12-23T05:22:30,276][WARN ][logstash.codecs.netflow ] No matching template for flow id 256
[2016-12-23T05:22:30,305][WARN ][logstash.codecs.netflow ] Unsupported field {:type=>0, :length=>0}
[2016-12-23T05:22:30,306][WARN ][logstash.codecs.netflow ] Unsupported field {:type=>0, :length=>0}
[2016-12-23T05:22:30,310][WARN ][logstash.codecs.netflow ] No matching template for flow id 257
[2016-12-23T05:22:30,323][WARN ][logstash.codecs.netflow ] Unsupported field {:type=>0, :length=>0}
[2016-12-23T05:22:30,329][WARN ][logstash.codecs.netflow ] Unsupported field {:type=>0, :length=>0}
[2016-12-23T05:22:30,330][WARN ][logstash.codecs.netflow ] No matching template for flow id 256

My logstack conf file content is

input {
udp{
port => 9995
## metadata => "true"
codec => netflow{

                    versions => [5,9,10]
                   ## target => "ipfix"
            }
            type=> "netflow"
    }

}

The filter part of this file is commented out to indicate that it is

optional.

filter {

}

output {
stdout { codec => rubydebug }
}

Tcp dump is attached with this topic

flow2.png1366×768 67.3 KB
netflow9_1.png1366×768 70.7 KB

2

this could be a bug in the code of the netflow codec, can you open an issue with this information on https://github.com/logstash-plugins/logstash-codec-netflow? thanks!

3

Hi ,
Issue registered

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.