# Netflow codec application\_id field incorrect translation

**URL:** https://discuss.elastic.co/t/netflow-codec-application-id-field-incorrect-translation/112967
**Category:** Logstash
**Created:** [December 22, 2017, 8:29am UTC](https://discuss.elastic.co/t/netflow-codec-application-id-field-incorrect-translation/112967 "2017-12-22T08:29:53Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)
#### Post date: [December 22, 2017, 8:29am UTC](https://discuss.elastic.co/t/netflow-codec-application-id-field-incorrect-translation/112967/1 "2017-12-22T08:29:53Z")

</div>

Hi,

I've noticed that in case of Fortigate devices the application\_id field is translated incorrectly.

By default logstash outputs 20:53068615909376 as the application\_id. However it should look something like 15921.

The reply I got from our Fortinet reseller is this:

> [@](#):
>
> The HEX in the packet capture that represents the application\_id is 00 00 30 44 00 00 3e 31.
> 
> 3e 31 is the actual application ID and 30 44 is the Fortigate enterprise ID.

Is there any way to have Logstash process this field correctly?

---

<div class="post-metadata">

### Author: ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)
#### Post date: [December 23, 2017, 10:56am UTC](https://discuss.elastic.co/t/netflow-codec-application-id-field-incorrect-translation/112967/2 "2017-12-23T10:56:07Z")

</div>

I assume that your issue is with the Logstash Netflow Module. That module was based on the v1.0.0 release of the [ElastiFlow](https://github.com/robcowart/elastiflow) solution. ElastiFlow is currently on [v1.2.0](https://github.com/robcowart/elastiflow/releases/tag/v1.2.0) and includes a number of enhancements and fixes that aren't in the Logstash Netflow Module, including the fix for `application_id`. So the easiest solution to your problem is just to use [ElastiFlow](https://github.com/robcowart/elastiflow/releases/tag/v1.2.0).

NOTE: While not directly related to your problem, I recommend keeping the Logstash Netflow Codec up to date, even if you are not updating Logstash itself. This is achieved with the following command...

`LOGSTASH_HOME/bin/logstash-plugins update logstash-codec-logstash`

---

<div class="post-metadata">

### Author: ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)
#### Post date: [December 25, 2017, 3:05am UTC](https://discuss.elastic.co/t/netflow-codec-application-id-field-incorrect-translation/112967/3 "2017-12-25T03:05:40Z")

</div>

Hi Robert,

I found out about ElastiFlow while googling for this issue. Unfortunately I'm not only collecting netflow data so I need to stick with Logstash.

I'm using the netflow codec 3.9.0 however data output is still 20:xxxxx for the application\_id field.

I've tried changing the type from string to keyword (seems to be the issue?) in /usr/share/logstash/modules/netflow/configuration/elasticsearch/netflow.json but in stdout I still get the incorrect data.

```auto
{
    "order": 0,
    "template": "netflow-*",
    "mappings": {
        "_default_": {
            "_meta": {
                "version": "6.0.0"
            },
            "dynamic_templates": [
                {
                    "application_id": {
                        "path_match": "netflow.application_id",
                        "mapping": {
                            "type": "keyword"
                        }
                    }
                },
```

Is it possible to fix this using the netflow codec that ships with logstash?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 22, 2018, 3:05am UTC](https://discuss.elastic.co/t/netflow-codec-application-id-field-incorrect-translation/112967/4 "2018-01-22T03:05:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.