Thanks for your prompt response.
Yes, we are using the netflow codec and we checked the data on the wire using wireshark to ensure that the timestamps and other fields are correct..
As you will notice in the following packet structure, there are 2 fields in the Flow Header of the netflow and there 2 others in each data record.
We have confirmed that unix_secs are in the UTC (time epoch), the sys_uptime value is correct and the last_switched and first_switched fields are correct relative to sys_uptime field.
Another question, we are wondering if @timestamp value is derived from the unix_secs in the header or from somewhere?
Flow header format
NetFlow export format version number
Number of flow sets exported in this packet, both template and data (1-30).
Current time in milliseconds since the export device booted.
Current count of seconds since 0000 UTC 1970.
Sequence counter of all export packets sent by the export device. Note: This is a change from the Version 5 and Version 8 headers, where this number represented “total flows.”
A 32-bit value that is used to guarantee uniqueness for all flows exported from a particular device. (The Source ID field is the equivalent of the engine type and engine ID fields found in the NetFlow Version 5 and Version 8 headers). The format of this field is vendor specific. In Cisco's implementation, the first two bytes are reserved for future expansion, and will always be zero. Byte 3 provides uniqueness with respect to the routing engine on the exporting device. Byte 4 provides uniqueness with respect to the particular line card or Versatile Interface Processor on the exporting device. Collector devices should use the combination of the source IP address plus the Source ID field to associate an incoming NetFlow export packet with a unique instance of NetFlow on a particular device.
Template FlowSet Format
System uptime at which the last packet of this flow was switched
System uptime at which the first packet of this flow was switched