# Logstash Netflow Codec Issues

**URL:** https://discuss.elastic.co/t/logstash-netflow-codec-issues/241500
**Category:** Logstash
**Created:** [July 16, 2020, 4:04pm UTC](https://discuss.elastic.co/t/logstash-netflow-codec-issues/241500 "2020-07-16T16:04:59Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![csgeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/csgeek/32/72144_2.png) [@csgeek](https://discuss.elastic.co/u/csgeek)
#### Post date: [July 16, 2020, 4:04pm UTC](https://discuss.elastic.co/t/logstash-netflow-codec-issues/241500/1 "2020-07-16T16:04:59Z")

</div>

I'm having issues handling netflow data through the logstash codec. I was wondering if anyone had any insight that could help.

Logstash version: 7.6.2 (I'm happy to upgrade if need be not tied to a specific version)

for reference adding the Dockerfile as well:

```auto
FROM logstash:7.6.2

#Create symlink so can use paths from production with logstash docker defaults
USER root

COPY compose/logstash/runner.sh /tmp/

RUN yum makecache && \
    yum install -y wget && \
    mkdir -p /etc/logstash && \
    ln -s /usr/share/logstash/pipeline /etc/logstash/conf.d && \
    curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.6.2-x86_64.rpm && \
    rpm -vi filebeat-7.6.2-x86_64.rpm && \
    filebeat modules enable netflow && \ # probably not needed
    logstash-plugin install logstash-codec-sflow logstash-codec-netflow

## NOTE: default is port 2055

#USER logstash

VOLUME /var/cache/netsage

ENTRYPOINT ["/tmp/runner.sh"]

```

Input:

```auto
    udp {
    port => 2055
    codec => netflow
    receive_buffer_bytes => 16777216
    workers => 4
    type => "netflow"
    }

```

filter:

```auto
None, disabled for now.

```

output:

```auto
output {
    file {
        path => "/data/all.json"
         codec => json_lines 
      }
      stdout { codec => rubydebug { metadata => true } }

}

```

First issue I'm seeing is messages like these.

```auto
 [2020-07-16T02:13:31,092][WARN][logstash.codecs.netflow][main] Can't (yet) decode flowset id 256 from source id 1, because no template to decode it with has been received. This message will usually go away after 1 minute.

```

I know there is a filebeat netflow module which I don't fully understand how to utilize yet, but I believe I should be able simply use the codec. Or is that deprecated in favor of the module?

---

<div class="post-metadata">

### Author: ![csgeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/csgeek/32/72144_2.png) [@csgeek](https://discuss.elastic.co/u/csgeek)
#### Post date: [July 16, 2020, 8:26pm UTC](https://discuss.elastic.co/t/logstash-netflow-codec-issues/241500/2 "2020-07-16T20:26:26Z")

</div>

Just an update, filebeat seems to work flawlessly. The message format is different but it seems to work.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 13, 2020, 8:26pm UTC](https://discuss.elastic.co/t/logstash-netflow-codec-issues/241500/3 "2020-08-13T20:26:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.