# Logstash netflow codec says "no template has been received" but it did receive one

**URL:** <https://discuss.elastic.co/t/logstash-netflow-codec-says-no-template-has-been-received-but-it-did-receive-one/352397>\
**Category:** Logstash\
**Created:** [February 2, 2024, 12:33pm UTC](https://discuss.elastic.co/t/logstash-netflow-codec-says-no-template-has-been-received-but-it-did-receive-one/352397 "2024-02-02T12:33:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![m0nkeyc0de](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m0nkeyc0de/32/131368_2.png) [@m0nkeyc0de](https://discuss.elastic.co/u/m0nkeyc0de)\
**Post date:** [February 2, 2024, 12:33pm UTC](https://discuss.elastic.co/t/logstash-netflow-codec-says-no-template-has-been-received-but-it-did-receive-one/352397/1 "2024-02-02T12:33:08Z")

</div>

Hello, the Logstash codec logstash-codec-netflow says it can't decode a flowset because no template has been received. When looking in the packet capture, a template has been sent.

```auto
[2024-02-02T13:10:19,136][WARN][logstash.codecs.netflow][main][bb95707be2d808262891c02debd1c7486b2a28cbba83f5acb495ce1bac18e7eb] Can't (yet) decode flowset id 257 from observation domain id 1, because no template to decode it with has been received. This message will usually go away after 1 minute.
[2024-02-02T13:10:19,136][WARN][logstash.codecs.netflow][main][bb95707be2d808262891c02debd1c7486b2a28cbba83f5acb495ce1bac18e7eb] Can't (yet) decode flowset id 256 from observation domain id 1, because no template to decode it with has been received. This message will usually go away after 1 minute.
[2024-02-02T13:10:19,140][WARN][logstash.codecs.netflow][main][bb95707be2d808262891c02debd1c7486b2a28cbba83f5acb495ce1bac18e7eb] Can't (yet) decode flowset id 258 from observation domain id 1, because no template to decode it with has been received. This message will usually go away after 1 minute.

```

Logstash version: 8.11.4

Configuration

```auto
input {
  udp {
    port => 2055
    codec => netflow {
      cache_save_path => "/tmp"
    }
  }
}
output {
  stdout{}
}

```

In the template cache there is in fact no template with those numbers

```auto
# cat /tmp/ipfix_templates.cache | jq '. |= keys'
[
  "1|259",
  "1|261",
  "1|262",
  "1|273",
  "1|274"
]

```

But in the PCAP a template is transmitted regularly

```auto
Cisco NetFlow/IPFIX
    Version: 10
    Length: 104
    Timestamp: Jan 25, 2024 11:05:29.000000000 W. Europe Standard Time
    FlowSequence: 224
    Observation Domain Id: 1
    Set 1 [id=3] (Options Template): 259,257,256,258
        FlowSet Id: Options Template (V10 [IPFIX]) (3)
        FlowSet Length: 88
        Options Template (Id = 259) (Scope Count = 1; Data Count = 7)
        Options Template (Id = 257) (Scope Count = 1; Data Count = 1)
        Options Template (Id = 256) (Scope Count = 1; Data Count = 1)
        Options Template (Id = 258) (Scope Count = 1; Data Count = 1)

```

It looks like a bug.

Any idea ?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [February 2, 2024, 1:30pm UTC](https://discuss.elastic.co/t/logstash-netflow-codec-says-no-template-has-been-received-but-it-did-receive-one/352397/2 "2024-02-02T13:30:06Z")

</div>

It looks like PR is still [opened](https://github.com/logstash-plugins/logstash-codec-netflow/issues/192)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2024, 1:30pm UTC](https://discuss.elastic.co/t/logstash-netflow-codec-says-no-template-has-been-received-but-it-did-receive-one/352397/3 "2024-03-01T13:30:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.