# Logstash unable to decode Cisco protobuf

**URL:** <https://discuss.elastic.co/t/logstash-unable-to-decode-cisco-protobuf/313424>\
**Category:** Logstash\
**Created:** [September 1, 2022, 9:13am UTC](https://discuss.elastic.co/t/logstash-unable-to-decode-cisco-protobuf/313424 "2022-09-01T09:13:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Siddarajgj](https://avatars.discourse-cdn.com/v4/letter/s/b5ac83/32.png) [@Siddarajgj](https://discuss.elastic.co/u/Siddarajgj)\
**Post date:** [September 1, 2022, 9:13am UTC](https://discuss.elastic.co/t/logstash-unable-to-decode-cisco-protobuf/313424/1 "2022-09-01T09:13:53Z")

</div>

Hoping someone has configured logstash to receive Cisco telemetry before, I'm able to receive the events but can't decode the telemetry.

I'm getting the folowing error from logstash:

[2022-09-01T09:01:23,341][WARN][logstash.codecs.protobuf][main][5b26f792bafc7856fdecc497707a95dcde8f9f5de9e9b7e97681e3ebe3629795] Couldn't decode protobuf: #\<RuntimeError: Protocol message contained an invalid tag (zero).\>.

Protofile is sourced from Cisco: [[bigmuddy-network-telemetry-proto/telemetry.proto at final · CiscoDevNet/bigmuddy-network-telemetry-proto · GitHub](https://github.com/CiscoDevNet/bigmuddy-network-telemetry-proto/blob/final/proto_archive/telemetry.proto))  
Specifically I'm using the telemetry.proto file which has been compiled with the google protoc binaries.

Logstash configuration file:  
input {  
tcp {  
port =\> 5514  
type =\> syslog  
codec =\> protobuf  
{  
class\_name =\> "telemetry.Telemetry"  
class\_file =\> '/bp2/data/telemetry\_pb.rb'  
protobuf\_root\_directory =\> "/bp2/data/"  
protobuf\_version =\> 3  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 29, 2022, 9:14am UTC](https://discuss.elastic.co/t/logstash-unable-to-decode-cisco-protobuf/313424/2 "2022-09-29T09:14:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.