# Logstash netflow codec v9 First/EndSwitched timestamps **URL:** https://discuss.elastic.co/t/logstash-netflow-codec-v9-first-endswitched-timestamps/128415 **Category:** Logstash **Created:** [April 17, 2018, 6:42pm UTC](https://discuss.elastic.co/t/logstash-netflow-codec-v9-first-endswitched-timestamps/128415 "2018-04-17T18:42:49Z") **Posts on this page:** 2 **Page:** 1
### Author: ![fc4min0s](https://avatars.discourse-cdn.com/v4/letter/f/eada6e/32.png) [@fc4min0s](https://discuss.elastic.co/u/fc4min0s) #### Post date: [April 17, 2018, 6:42pm UTC](https://discuss.elastic.co/t/logstash-netflow-codec-v9-first-endswitched-timestamps/128415/1 "2018-04-17T18:42:50Z")
Hello all !! I am testing the netflow logstash plugin and there seems to me there is a problem with the timestamps as the documents are not showing millisecond precision. A wireshark capture shows StartTime/EndTime fields with millisecond precision. All first\_switched/last\_switched fields will show with .999 precision: "flow\_seq\_num": 35409291, "last\_switched": "2018-04-17T15:13:47. **999** Z", "dst\_as": 0, "ipv4\_src\_addr": "10.20.9.216", "dst\_mask": 24, "first\_switched": "2018-04-17T15:13:46. **999** Z", Am I missing something ?? # ./logstash --version logstash 6.2.3 # ./logstash-plugin list --verbose | grep netflow logstash-codec-netflow (3.11.2) ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/a/ca8d00a40206d26730ef0cec12a4a5e15139b69b.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/a/6a18acbaf9737249ddbf23d0093102abd82c676c.png) ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [May 15, 2018, 6:42pm UTC](https://discuss.elastic.co/t/logstash-netflow-codec-v9-first-endswitched-timestamps/128415/2 "2018-05-15T18:42:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.