Logstash netscaler citrix input

Hello,

I'm trying to collect logs from Netscaler Citrix using ipfix protocol, but I'm not able to decode properly the message.

This is my input configuration file:

input {
  udp {
    port => 9913
    codec => netflow {
      versions => [10]
    }
  }
}

I received this warning from logstash: Can't (yet) decode flowset id 257 from observation domain id 0, because no template to decode it with has been received. This message will usually go away after 1 minute.

And I'm not able to see the content of the message from Netscaler.

Does anyone know what could be the issue?

According to documentation of my logstash version (Netflow codec plugin | Logstash Reference [8.4] | Elastic) seems to be able to decode:

But we are not able to decode based on this error:

Can't (yet) decode flowset id 257 from observation domain id 0, because no template to decode it with has been received. This message will usually go away after 1 minute.

Logstash lacks support for most of the Netscaler IEs. You should try a trial license of ElastiFlow, which provides support for all vendor-specific IEs.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.