Logstash Stop Working : Invalid netflow packet format

[Diyal]

Hi all,

I configured Logstash to collect netflow packet.
Since few weeks ago, routinely Logstash stop directly when we receive Invalid netflow packet

Configurations on device side about sending netflow packet for specific port number are good.

[2017-06-02T11:51:20,298][WARN ][logstash.codecs.netflow ] Invalid netflow packet received (End of file reached)

[2017-06-02T11:51:20,299][ERROR][logstash.inputs.udp ] Exception in inputworker {"exception"=>#<NoMethodError: undefined method each' for nil:NilClass>, "backtrace"=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow.rb:200:indecode'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208:in each'", "org/jruby/RubyArray.java:1613:ineach'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208:in each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow.rb:196:indecode'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1.0/lib/logstash/inputs/udp.rb:118:in inputworker'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1.0/lib/logstash/inputs/udp.rb:89:inudp_listener'"]}

I recover the last packet that I received before logstash stop.
Packet protocol => ICMP
port number => 0

So why a packet error format can stop logstash to continue working ?

Thanks,

[Diyal]

I have an also regularly issues like this :

["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow/util.rb:92:in get'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208:ineach'", "org/jruby/RubyArray.java:1613:in each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208:ineach'", "org/jruby/RubyEnumerable.java:752:in collect'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow/util.rb:92:inget'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/primitive.rb:112:in sensible_default'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/base_primitive.rb:147:in_value'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/primitive.rb:104:in do_num_bytes'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/struct.rb:258:insum_num_bytes_below_index'", "org/jruby/RubyRange.java:479:in each'", "org/jruby/RubyEnumerable.java:852:ininject'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/struct.rb:255:in sum_num_bytes_below_index'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/struct.rb:251:insum_num_bytes_for_all_fields'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/struct.rb:149:in do_num_bytes'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/base.rb:168:innum_bytes'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow.rb:300:in decode_netflow9'", "org/jruby/RubyKernel.java:1242:incatch'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow.rb:262:in decode_netflow9'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208:ineach'", "org/jruby/RubyArray.java:1613:in each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208:ineach'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow.rb:261:in decode_netflow9'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow.rb:200:indecode'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208:in each'", "org/jruby/RubyArray.java:1613:ineach'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208:in each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow.rb:196:indecode'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1.0/lib/logstash/inputs/udp.rb:118:in inputworker'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1.0/lib/logstash/inputs/udp.rb:89:inudp_listener'"]}

For your information I use logstash V 5.3.2