# Logstack netflow getting error for Netflowversion 9

**URL:** <https://discuss.elastic.co/t/logstack-netflow-getting-error-for-netflowversion-9/69902>\
**Category:** Logstash\
**Created:** [December 23, 2016, 10:27am UTC](https://discuss.elastic.co/t/logstack-netflow-getting-error-for-netflowversion-9/69902 "2016-12-23T10:27:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rajunair](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajunair/32/14112_2.png) [@rajunair](https://discuss.elastic.co/u/rajunair)\
**Post date:** [December 23, 2016, 10:27am UTC](https://discuss.elastic.co/t/logstack-netflow-getting-error-for-netflowversion-9/69902/1 "2016-12-23T10:27:17Z")

</div>

Hi Team ,  
During my testing it seems that logstah 5.1.1 is sending WARN message to process Netflow 9 messages  
In my setup Netflow 5 version is working fine .  
Any body knows root cases for this issue

My error message are given below

[2016-12-23T05:22:30,245][WARN][logstash.codecs.netflow] No matching template for flow id 256  
[2016-12-23T05:22:30,267][WARN][logstash.codecs.netflow] Unsupported field {:type=\>0, :length=\>0}  
[2016-12-23T05:22:30,268][WARN][logstash.codecs.netflow] Unsupported field {:type=\>0, :length=\>0}  
[2016-12-23T05:22:30,270][WARN][logstash.codecs.netflow] Unsupported field {:type=\>0, :length=\>0}  
[2016-12-23T05:22:30,270][WARN][logstash.codecs.netflow] No matching template for flow id 256  
[2016-12-23T05:22:30,275][WARN][logstash.codecs.netflow] Unsupported field {:type=\>0, :length=\>0}  
[2016-12-23T05:22:30,276][WARN][logstash.codecs.netflow] No matching template for flow id 256  
[2016-12-23T05:22:30,305][WARN][logstash.codecs.netflow] Unsupported field {:type=\>0, :length=\>0}  
[2016-12-23T05:22:30,306][WARN][logstash.codecs.netflow] Unsupported field {:type=\>0, :length=\>0}  
[2016-12-23T05:22:30,310][WARN][logstash.codecs.netflow] No matching template for flow id 257  
[2016-12-23T05:22:30,323][WARN][logstash.codecs.netflow] Unsupported field {:type=\>0, :length=\>0}  
[2016-12-23T05:22:30,329][WARN][logstash.codecs.netflow] Unsupported field {:type=\>0, :length=\>0}  
[2016-12-23T05:22:30,330][WARN][logstash.codecs.netflow] No matching template for flow id 256

My logstack conf file content is

input {  
udp{  
port =\> 9995  
## metadata =\> "true"  
codec =\> netflow{

```
                    versions => [5,9,10]
                   ## target => "ipfix"
            }
            type=> "netflow"
    }

```

}

# The filter part of this file is commented out to indicate that it is

# optional.

# filter {

# 

# }

output {  
stdout { codec =\> rubydebug }  
}

Tcp dump is attached with this topic

 ![](https://us1.discourse-cdn.com/elastic/original/2X/5/5efbfd6ad4d206a3ea3872ac0ac6d5dcffe43791.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/5/56872f7d0938b6c3cf5a6d0859e407316264cd41.png)

---

<div class="post-metadata">

**Author:** ![jsvd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsvd/32/6203_2.png) [@jsvd](https://discuss.elastic.co/u/jsvd)\
**Post date:** [December 23, 2016, 11:15am UTC](https://discuss.elastic.co/t/logstack-netflow-getting-error-for-netflowversion-9/69902/2 "2016-12-23T11:15:17Z")

</div>

this could be a bug in the code of the netflow codec, can you open an issue with this information on [https://github.com/logstash-plugins/logstash-codec-netflow](https://github.com/logstash-plugins/logstash-codec-netflow)? thanks!

---

<div class="post-metadata">

**Author:** ![rajunair](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajunair/32/14112_2.png) [@rajunair](https://discuss.elastic.co/u/rajunair)\
**Post date:** [December 24, 2016, 5:14am UTC](https://discuss.elastic.co/t/logstack-netflow-getting-error-for-netflowversion-9/69902/3 "2016-12-24T05:14:12Z")

</div>

> [@rajunair](#):
>
> output { stdout { codec =\> rubydebug }}

Hi ,  
Issue registered

> <https://github.com/logstash-plugins/logstash-codec-netflow/issues/64>
>
> Hi Team ,
> During my testing it seems that logstah 5.1.1 is sending WARN message… to process Netflow 9 messages
> In my setup Netflow 5 version is working fine .
> Any body knows root cases for this issue
> 
> My error message are given below
> 
> \[2016-12-23T05:22:30,245\]\[WARN \]\[logstash.codecs.netflow \] No matching template for flow id 256
> \[2016-12-23T05:22:30,267\]\[WARN \]\[logstash.codecs.netflow \] Unsupported field {:type=\>0, :length=\>0}
> \[2016-12-23T05:22:30,268\]\[WARN \]\[logstash.codecs.netflow \] Unsupported field {:type=\>0, :length=\>0}
> \[2016-12-23T05:22:30,270\]\[WARN \]\[logstash.codecs.netflow \] Unsupported field {:type=\>0, :length=\>0}
> \[2016-12-23T05:22:30,270\]\[WARN \]\[logstash.codecs.netflow \] No matching template for flow id 256
> \[2016-12-23T05:22:30,275\]\[WARN \]\[logstash.codecs.netflow \] Unsupported field {:type=\>0, :length=\>0}
> \[2016-12-23T05:22:30,276\]\[WARN \]\[logstash.codecs.netflow \] No matching template for flow id 256
> \[2016-12-23T05:22:30,305\]\[WARN \]\[logstash.codecs.netflow \] Unsupported field {:type=\>0, :length=\>0}
> \[2016-12-23T05:22:30,306\]\[WARN \]\[logstash.codecs.netflow \] Unsupported field {:type=\>0, :length=\>0}
> \[2016-12-23T05:22:30,310\]\[WARN \]\[logstash.codecs.netflow \] No matching template for flow id 257
> \[2016-12-23T05:22:30,323\]\[WARN \]\[logstash.codecs.netflow \] Unsupported field {:type=\>0, :length=\>0}
> \[2016-12-23T05:22:30,329\]\[WARN \]\[logstash.codecs.netflow \] Unsupported field {:type=\>0, :length=\>0}
> \[2016-12-23T05:22:30,330\]\[WARN \]\[logstash.codecs.netflow \] No matching template for flow id 256
> 
> For all general issues, please provide the following details for fast resolution:
> 
> \- Version:logstash5.1.1
> \- Operating System:CentOs7
> \- Config File (if you have sensitive info, please remove it):
> input {
> udp{
> port =\> 9995
> \## metadata =\> "true"
> codec =\> netflow{
> versions =\> \[5,9,10\]
>                  
> }
> type=\> "netflow"
> }
> }
> 
> output {
> stdout { codec =\> rubydebug }
> }
> 
> \- Sample Data:
> \- Steps to Reproduce:
> 
> Pcap file is attached
> 
> 
> with this issues

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 21, 2017, 5:14am UTC](https://discuss.elastic.co/t/logstack-netflow-getting-error-for-netflowversion-9/69902/4 "2017-01-21T05:14:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.