# Logstash.codec.sflow doesn't understand some record formats (1003, 1008, 1009 etc)

**URL:** <https://discuss.elastic.co/t/logstash-codec-sflow-doesnt-understand-some-record-formats-1003-1008-1009-etc/145221>\
**Category:** Logstash\
**Created:** [August 20, 2018, 6:29pm UTC](https://discuss.elastic.co/t/logstash-codec-sflow-doesnt-understand-some-record-formats-1003-1008-1009-etc/145221 "2018-08-20T18:29:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheZeke](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thezeke/32/13784_2.png) [@TheZeke](https://discuss.elastic.co/u/TheZeke)\
**Post date:** [August 20, 2018, 6:29pm UTC](https://discuss.elastic.co/t/logstash-codec-sflow-doesnt-understand-some-record-formats-1003-1008-1009-etc/145221/1 "2018-08-20T18:29:37Z")

</div>

I'm using [ElastiFlow](https://github.com/robcowart/elastiflow) but seeing hundreds of warnings every minute for sFlow records saying logstash.codec.sflow does not understand records with certain formats. The [logstash.codecs.flow GitHub](https://github.com/ashangit/logstash-codec-sflow) hasn't had any activity on it for a few years. I've updated a [GitHub issue on that repo](https://github.com/ashangit/logstash-codec-sflow/issues/8) and provided a PCAP but there's no response there.

The hundreds of warning messages I see are as follows: (this repeats at random for ever)

```
[2018-08-20T18:18:13,759][WARN][logstash.codecs.sflow] Unknown record entreprise 0, format 1003
[2018-08-20T18:18:13,759][WARN][logstash.codecs.sflow] Unknown record entreprise 0, format 1009
[2018-08-20T18:18:13,759][WARN][logstash.codecs.sflow] Unknown record entreprise 0, format 1008
[2018-08-20T18:18:13,763][WARN][logstash.codecs.sflow] Unknown record entreprise 0, format 1003
[2018-08-20T18:18:13,767][WARN][logstash.codecs.sflow] Unknown record entreprise 0, format 1003

```

The PCAP is [available here](https://www.dropbox.com/s/a8epeheccdyq3rp/sflow_data_sample.pcap). I _am_ seeing data in Kibana from the ElastiFlow (sFlow data) but it's _all_ ingress (no egress) and besides that I'm also certain we are missing data from the sFlow records that cannot be parsed due to the unknown format issue.

The formats are defined in [sFlowV5FlowData.pdf](https://sflow.org/developers/diagrams/sFlowV5FlowData.pdf). With that information I tried to clone the logstash.codecs.sflow repo and figure out the additional record types myself but the format is more complicated than I can handle. I'm not a ruby programmer. I thought I could, perhaps, just take another record type and expand on it but I don't know how to deal with the field types beyond the uint32 ones.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 17, 2018, 6:29pm UTC](https://discuss.elastic.co/t/logstash-codec-sflow-doesnt-understand-some-record-formats-1003-1008-1009-etc/145221/2 "2018-09-17T18:29:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.