# Logstash Stop Working : Invalid netflow packet format
**URL:** https://discuss.elastic.co/t/logstash-stop-working-invalid-netflow-packet-format/88598
**Category:** Logstash
**Created:** [June 7, 2017, 2:44pm UTC](https://discuss.elastic.co/t/logstash-stop-working-invalid-netflow-packet-format/88598 "2017-06-07T14:44:39Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Diyal](https://discuss.elastic.co/u/Diyal)
#### Post date: [June 7, 2017, 2:44pm UTC](https://discuss.elastic.co/t/logstash-stop-working-invalid-netflow-packet-format/88598/1 "2017-06-07T14:44:39Z")
Hi all,
I configured Logstash to collect netflow packet.
Since few weeks ago, routinely Logstash stop directly when we receive Invalid netflow packet
Configurations on device side about sending netflow packet for specific port number are good.
[2017-06-02T11:51:20,298][WARN][logstash.codecs.netflow] Invalid netflow packet received (End of file reached)
[2017-06-02T11:51:20,299][ERROR][logstash.inputs.udp] Exception in inputworker {"exception"=\>#\, "backtrace"=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow.rb:200:in`decode'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208:in `each'", "org/jruby/RubyArray.java:1613:in`each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208:in `each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow.rb:196:in`decode'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1.0/lib/logstash/inputs/udp.rb:118:in `inputworker'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1.0/lib/logstash/inputs/udp.rb:89:in`udp\_listener'"]}
I recover the last packet that I received before logstash stop.
Packet protocol =\> ICMP
port number =\> 0
So why a packet error format can stop logstash to continue working ?
Thanks,
---
### Author:  [@Diyal](https://discuss.elastic.co/u/Diyal)
#### Post date: [June 19, 2017, 7:53am UTC](https://discuss.elastic.co/t/logstash-stop-working-invalid-netflow-packet-format/88598/2 "2017-06-19T07:53:36Z")
I have an also regularly issues like this :
["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow/util.rb:92:in `get'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208:in`each'", "org/jruby/RubyArray.java:1613:in `each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208:in`each'", "org/jruby/RubyEnumerable.java:752:in `collect'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow/util.rb:92:in`get'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/primitive.rb:112:in `sensible_default'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/base_primitive.rb:147:in`\_value'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/primitive.rb:104:in `do_num_bytes'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/struct.rb:258:in`sum\_num\_bytes\_below\_index'", "org/jruby/RubyRange.java:479:in `each'", "org/jruby/RubyEnumerable.java:852:in`inject'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/struct.rb:255:in `sum_num_bytes_below_index'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/struct.rb:251:in`sum\_num\_bytes\_for\_all\_fields'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/struct.rb:149:in `do_num_bytes'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/base.rb:168:in`num\_bytes'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow.rb:300:in `decode_netflow9'", "org/jruby/RubyKernel.java:1242:in`catch'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow.rb:262:in `decode_netflow9'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208:in`each'", "org/jruby/RubyArray.java:1613:in `each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208:in`each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow.rb:261:in `decode_netflow9'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow.rb:200:in`decode'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208:in `each'", "org/jruby/RubyArray.java:1613:in`each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208:in `each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow/lib/logstash/codecs/netflow.rb:196:in`decode'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1.0/lib/logstash/inputs/udp.rb:118:in `inputworker'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1.0/lib/logstash/inputs/udp.rb:89:in`udp\_listener'"]}
For your information I use logstash V 5.3.2
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 17, 2017, 7:53am UTC](https://discuss.elastic.co/t/logstash-stop-working-invalid-netflow-packet-format/88598/3 "2017-07-17T07:53:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.