[logstash.codecs.netflow ] Template length exceeds flowset length, skipping {:template_id=>256, :template_length=>53, :record_length=>48}

Elastic Stack Logstash
1

Hi,
I have a running implementation of the ELK stack (6.X), with elastiflow module configured (with Elastiflow Dashboard configured on Kibana). I however get the following error on running logstash. The netflow logs are coming directly from network devices (routers) that are on the local network. I have read a number of threads concerning this issue, and they all seem to attribute this problem to the logstash-codec-netflow codec,and its tendency to assign the same Template ID (in this case 256). I have updated the 'logstash-codec-netflow' , but that seems not to solve the problem. Any ideas on how to resolve this issue?

[2019-01-11T10:03:37,755][WARN ][logstash.codecs.netflow ] Template length exceeds flowset length, skipping {:template_id=>256, :template_length=>53, :record_length=>48}
[2019-01-11T10:04:56,749][WARN ][logstash.codecs.netflow ] Template length exceeds flowset length, skipping {:template_id=>256, :template_length=>53, :record_length=>48}
[2019-01-11T10:10:47,725][WARN ][logstash.codecs.netflow ] Template length exceeds flowset length, skipping {:template_id=>256, :template_length=>53, :record_length=>48}
[2019-01-11T10:18:00,694][WARN ][logstash.codecs.netflow ] Template length exceeds flowset length, skipping {:template_id=>256, :template_length=>53, :record_length=>48}

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.