# Logstash 6.4.1 Ignoring Netflow 10 **URL:** \ **Category:** Logstash\ **Created:** [September 21, 2018, 4:00pm UTC](https://discuss.elastic.co/t/logstash-6-4-1-ignoring-netflow-10/149488 "2018-09-21T16:00:29Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Post date:** [September 21, 2018, 4:00pm UTC](https://discuss.elastic.co/t/logstash-6-4-1-ignoring-netflow-10/149488/1 "2018-09-21T16:00:29Z")
Hi, I have installed Logstash 6.4.1 and I have enabled the netflow module but I'm getting "Ignoring Netflow version v10". As far as I understand, netflow 10 is supported in this version. Am I correct? Here is the error ``` [2018-09-21T17:04:25,549][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"6.4.1"} 2018-09-21T17:18:38,966][INFO][logstash.inputs.udp] UDP listener started {:address=>"0.0.0.0:4001", :receive_buffer_bytes=>"212992", :queue_size=>"2000"} [2018-09-21T17:18:39,254][WARN][logstash.codecs.netflow] Ignoring Netflow version v10 [2018-09-21T17:18:39,253][WARN][logstash.codecs.netflow] Ignoring Netflow version v10 ``` Thank you Regards Ana ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [October 2, 2018, 8:32am UTC](https://discuss.elastic.co/t/logstash-6-4-1-ignoring-netflow-10/149488/2 "2018-10-02T08:32:45Z")
The Logstash Netflow Module only support Netflow v5/v9, not IPFIX (aka v10). You may want to try out Elastiflow... > **[robcowart/elastiflow](https://github.com/robcowart/elastiflow)** > > Network flow Monitoring (Netflow, sFlow and IPFIX) with the Elastic Stack - robcowart/elastiflow The Logstash Netflow Module was based on ElastiFlow v1.0.0. It is now very dated, and the functionality is **_very_** far behind the current release of ElastiFlow... v3.3.0. ---
**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Post date:** [October 4, 2018, 7:51am UTC](https://discuss.elastic.co/t/logstash-6-4-1-ignoring-netflow-10/149488/3 "2018-10-04T07:51:34Z")
Thank you! Does elasticflow use logstash with another plugin? Regards Ana ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [October 4, 2018, 9:32am UTC](https://discuss.elastic.co/t/logstash-6-4-1-ignoring-netflow-10/149488/4 "2018-10-04T09:32:20Z")
For sFlow you need to install logstash-codec-sflow. That is the only optional plugin that is required. For IPFIX it uses the standard logstash-codec-netflow. ---
**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Post date:** [October 4, 2018, 9:45am UTC](https://discuss.elastic.co/t/logstash-6-4-1-ignoring-netflow-10/149488/5 "2018-10-04T09:45:51Z")
So using elasticflow does something extra to support IPFIX, but using the standard logstash-codec-netflow. Am I correct? Regards Ana ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [October 4, 2018, 10:08am UTC](https://discuss.elastic.co/t/logstash-6-4-1-ignoring-netflow-10/149488/6 "2018-10-04T10:08:52Z")
The standard codec can **decode** Netflow v5, v9 and IPFIX (v10). Decoding, is really just the first step. What you do with that decoded data is what makes the difference. There is a big difference between Netflow and IPFIX field names, and the Logstash Netflow Module processes and provides visualizations _ONLY_ for Netflow fields, _NOT_ IPFIX fields. As ElastiFlow evolved it was enhanced to normalize the various flow types into a common schema, so that ALL of your network flow data can be visualized and analyzed with a common set of dashboards. It has since become the most popular solution to collect network flow data with the Elastic Stack, and is used by well over 1000 organizations world-wide. ![29](https://us1.discourse-cdn.com/elastic/original/3X/4/a/4a933da298dba4684f09f0be9eeafec1a55c8e8a.png) ![53](https://us1.discourse-cdn.com/elastic/original/3X/7/8/7813d13372ce78f3ff2b4302205a2f50bedf5dd3.png) ---
**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Post date:** [October 4, 2018, 10:09am UTC](https://discuss.elastic.co/t/logstash-6-4-1-ignoring-netflow-10/149488/7 "2018-10-04T10:09:57Z")
Thank you. I'll try it. Regards Ana ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 1, 2018, 10:09am UTC](https://discuss.elastic.co/t/logstash-6-4-1-ignoring-netflow-10/149488/8 "2018-11-01T10:09:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.