Logstash netscaler citrix input

Elastic Stack Logstash
1

Hello,

I'm trying to collect logs from Netscaler Citrix using ipfix protocol, but I'm not able to decode properly the message.

This is my input configuration file:

input {
  udp {
    port => 9913
    codec => netflow {
      versions => [10]
    }
  }
}

I received this warning from logstash: Can't (yet) decode flowset id 257 from observation domain id 0, because no template to decode it with has been received. This message will usually go away after 1 minute.

And I'm not able to see the content of the message from Netscaler.

Does anyone know what could be the issue?

2

According to documentation of my logstash version (Netflow codec plugin | Logstash Reference [8.4] | Elastic) seems to be able to decode:

image
image862×709 41.2 KB

But we are not able to decode based on this error:

Can't (yet) decode flowset id 257 from observation domain id 0, because no template to decode it with has been received. This message will usually go away after 1 minute.

4

Logstash lacks support for most of the Netscaler IEs. You should try a trial license of ElastiFlow, which provides support for all vendor-specific IEs.