# Logstash netflow V9

**URL:** <https://discuss.elastic.co/t/logstash-netflow-v9/40789>\
**Category:** Logstash\
**Created:** [February 2, 2016, 9:17pm UTC](https://discuss.elastic.co/t/logstash-netflow-v9/40789 "2016-02-02T21:17:39Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![jdambly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jdambly/32/44286_2.png) [@jdambly](https://discuss.elastic.co/u/jdambly)\
**Post date:** [February 2, 2016, 9:17pm UTC](https://discuss.elastic.co/t/logstash-netflow-v9/40789/1 "2016-02-02T21:17:39Z")

</div>

I'm getting the following from logstash

Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>936, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>1320, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>1432, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>388, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>936, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>828, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>1432, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>1048, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>936, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>1376, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>440, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>1268, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>1100, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>1432, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>772, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>1100, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>1432, :level=\>:warn}  
Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>608, :level=\>:warn}

how do I figure out what the issue is here? some of the netflow data is not looking accurate

---

<div class="post-metadata">

**Author:** ![ssi](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@ssi](https://discuss.elastic.co/u/ssi)\
**Post date:** [February 17, 2016, 8:58am UTC](https://discuss.elastic.co/t/logstash-netflow-v9/40789/2 "2016-02-17T08:58:30Z")

</div>

did you find a solution for this?

---

<div class="post-metadata">

**Author:** ![marke72](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marke72/32/10832_2.png) [@marke72](https://discuss.elastic.co/u/marke72)\
**Post date:** [February 17, 2016, 6:40pm UTC](https://discuss.elastic.co/t/logstash-netflow-v9/40789/3 "2016-02-17T18:40:34Z")

</div>

We just had this issue recently. It came up after a few devices' firmware was updated. The mix of the old firmware sending with the new firmware caused this error to occur. Once we updated the rest of the devices to the same firmware, the errors stopped.  
I have also heard that a mix of devices such as Cisco and another device that sends Netflow might cause this to happen. The fix was to have Logstash receive the devices' Netflow on different ports from each other. Is that right, @jystol?

---

<div class="post-metadata">

**Author:** ![jdambly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jdambly/32/44286_2.png) [@jdambly](https://discuss.elastic.co/u/jdambly)\
**Post date:** [February 17, 2016, 7:31pm UTC](https://discuss.elastic.co/t/logstash-netflow-v9/40789/4 "2016-02-17T19:31:20Z")

</div>

I installed logstash using Yum, it turns out the repo does not have the  
most up to date code. I manually downloaded the latest RPM of elasticsearch  
and logstash, this resolved the issue for me.

--Jeff

---

<div class="post-metadata">

**Author:** ![ssi](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@ssi](https://discuss.elastic.co/u/ssi)\
**Post date:** [February 17, 2016, 8:03pm UTC](https://discuss.elastic.co/t/logstash-netflow-v9/40789/5 "2016-02-17T20:03:44Z")

</div>

thanks will try that, are you using version9 of netflow, what does your logstash conf and netflow.yaml look like?

---

<div class="post-metadata">

**Author:** ![jdambly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jdambly/32/44286_2.png) [@jdambly](https://discuss.elastic.co/u/jdambly)\
**Post date:** [February 17, 2016, 8:41pm UTC](https://discuss.elastic.co/t/logstash-netflow-v9/40789/6 "2016-02-17T20:41:44Z")

</div>

here is what my config looks like. Since I have a lot of devices I made an  
index for each deivce, and day. this lets my delete old indexs to save  
space.

input {  
udp {  
port =\> 6343  
type =\> "netflow"  
codec =\> netflow {  
definitions =\> "/etc/logstash/codecs/netflow.yaml"  
versions =\> [9]  
}  
}  
}  
output {  
if [type] == "netflow"{  
elasticsearch {  
index =\> "netflow-%{host}-%{+YYYY.MM.dd}"  
hosts =\> ["10.1.1.17:9200"]  
}  
}  
}

pd7sjc-es-05:/root# cat /etc/logstash/codecs/netflow.yaml  
1:

- 4
- :in\_bytes  
2:
- 4
- :in\_pkts  
3:
- 4
- :flows  
4:
- :uint8
- :protocol  
5:
- :uint8
- :src\_tos  
6:
- :uint8
- :tcp\_flags  
7:
- :uint16
- :l4\_src\_port  
8:
- :ip4\_addr
- :ipv4\_src\_addr  
9:
- :uint8
- :src\_mask  
10:
- 4
- :input\_snmp  
11:
- :uint16
- :l4\_dst\_port  
12:
- :ip4\_addr
- :ipv4\_dst\_addr  
13:
- :uint8
- :dst\_mask  
14:
- 4
- :output\_snmp  
15:
- :ip4\_addr
- :ipv4\_next\_hop  
16:
- 2
- :src\_as  
17:
- 2
- :dst\_as  
18:
- :ip4\_addr
- :bgp\_ipv4\_next\_hop  
19:
- 4
- :mul\_dst\_pkts  
20:
- 4
- :mul\_dst\_bytes  
21:
- :uint32
- :last\_switched  
22:
- :uint32
- :first\_switched  
23:
- 4
- :out\_bytes  
24:
- 4
- :out\_pkts  
25:
- :uint16
- :min\_pkt\_length  
26:
- :uint16
- :max\_pkt\_length  
27:
- :ip6\_addr
- :ipv6\_src\_addr  
28:
- :ip6\_addr
- :ipv6\_dst\_addr  
29:
- :uint8
- :ipv6\_src\_mask  
30:
- :uint8
- :ipv6\_dst\_mask  
31:
- :uint32
- :ipv6\_flow\_label  
32:
- :uint16
- :icmp\_type  
33:
- :uint8
- :mul\_igmp\_type  
34:
- :uint32
- :sampling\_interval  
35:
- :uint8
- :sampling\_algorithm  
36:
- :uint16
- :flow\_active\_timeout  
37:
- :uint16
- :flow\_inactive\_timeout  
38:
- :uint8
- :engine\_type  
39:
- :uint8
- :engine\_id  
40:
- 4
- :total\_bytes\_exp  
41:
- 4
- :total\_pkts\_exp  
42:
- 4
- :total\_flows\_exp  
43:
- :skip  
44:
- :ip4\_addr
- :ipv4\_src\_prefix  
45:
- :ip4\_addr
- :ipv4\_dst\_prefix  
46:
- :uint8
- :mpls\_top\_label\_type  
47:
- :uint32
- :mpls\_top\_label\_ip\_addr  
48:
- 4
- :flow\_sampler\_id  
49:
- :uint8
- :flow\_sampler\_mode  
50:
- :uint32
- :flow\_sampler\_random\_interval  
51:
- :skip  
52:
- :uint8
- :min\_ttl  
53:
- :uint8
- :max\_ttl  
54:
- :uint16
- :ipv4\_ident  
55:
- :uint8
- :dst\_tos  
56:
- :mac\_addr
- :in\_src\_max  
57:
- :mac\_addr
- :out\_dst\_max  
58:
- :uint16
- :src\_vlan  
59:
- :uint16
- :dst\_vlan  
60:
- :uint8
- :ip\_protocol\_version  
61:
- :uint8
- :direction  
62:
- :ip6\_addr
- :ipv6\_next\_hop  
63:
- :ip6\_addr
- :bgp\_ipv6\_next\_hop  
64:
- :uint32
- :ipv6\_option\_headers  
64:
- :skip  
65:
- :skip  
66:
- :skip  
67:
- :skip  
68:
- :skip  
69:
- :skip  
80:
- :mac\_addr
- :in\_dst\_mac  
81:
- :mac\_addr
- :out\_src\_mac  
82:
- :string
- :if\_name  
83:
- :string
- :if\_desc  
225:
- :ip4\_addr
- :ipv4\_src\_addr\_postnat  
226:
- :ip4\_addr
- :ipv4\_dst\_addr\_postnat  
227:
- :uint16
- :l4\_src\_port\_postnat  
228:
- :uint16
- :l4\_dst\_port\_postnat

---

<div class="post-metadata">

**Author:** ![ssi](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@ssi](https://discuss.elastic.co/u/ssi)\
**Post date:** [February 17, 2016, 8:51pm UTC](https://discuss.elastic.co/t/logstash-netflow-v9/40789/7 "2016-02-17T20:51:51Z")

</div>

thanks!

and this is working with netflow v9 from a cisco device

---

<div class="post-metadata">

**Author:** ![ssi](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@ssi](https://discuss.elastic.co/u/ssi)\
**Post date:** [February 18, 2016, 8:49am UTC](https://discuss.elastic.co/t/logstash-netflow-v9/40789/8 "2016-02-18T08:49:09Z")

</div>

hi i tried with your config on newest version of logstash. it runs with missing template for id 263&256 for a while and then throws this error

Exception in inputworker {"exception"=\>#\<BinData::UnRegisteredTypeError: acl\_id\_asa\>, "backtrace"=\>["/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/registry.rb:41:in `lookup'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/sanitize.rb:19:in`initialize'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/sanitize.rb:49:in `initialize'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/sanitize.rb:84:in`add\_field'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/struct.rb:372:in `sanitize_fields'", "org/jruby/RubyArray.java:1613:in`each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/struct.rb:371:in `sanitize_fields'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/struct.rb:340:in`sanitize\_parameters!'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/sanitize.rb:290:in `sanitize!'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/sanitize.rb:207:in`initialize'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/sanitize.rb:189:in `sanitize'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/base.rb:284:in`extract\_args'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/base.rb:254:in `extract_args'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/base.rb:80:in`initialize'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/warnings.rb:22:in `initialize_with_warning'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-2.0.3/lib/logstash/codecs/netflow.rb:147:in`decode\_netflow9'", "org/jruby/RubyKernel.java:1242:in `catch'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-2.0.3/lib/logstash/codecs/netflow.rb:137:in`decode\_netflow9'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/array.rb:208:in `each'", "org/jruby/RubyArray.java:1613:in`each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/array.rb:208:in `each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-2.0.3/lib/logstash/codecs/netflow.rb:136:in`decode\_netflow9'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-2.0.3/lib/logstash/codecs/netflow.rb:86:in `decode'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/array.rb:208:in`each'", "org/jruby/RubyArray.java:1613:in `each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.2.0/lib/bindata/array.rb:208:in`each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-2.0.3/lib/logstash/codecs/netflow.rb:85:in `decode'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:96:in`inputworker'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.3/lib/logstash/inputs/udp.rb:73:in `udp\_listener'"], :level=\>:error}  
E

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:10am UTC](https://discuss.elastic.co/t/logstash-netflow-v9/40789/9 "2017-07-06T05:10:55Z")

</div>