# Netflow codec: how to decode and define a field outside a flowset?

**URL:** <https://discuss.elastic.co/t/netflow-codec-how-to-decode-and-define-a-field-outside-a-flowset/355538>\
**Category:** Logstash\
**Created:** [March 16, 2024, 2:15pm UTC](https://discuss.elastic.co/t/netflow-codec-how-to-decode-and-define-a-field-outside-a-flowset/355538 "2024-03-16T14:15:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Catwoolfii](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/catwoolfii/32/132695_2.png) [@Catwoolfii](https://discuss.elastic.co/u/Catwoolfii)\
**Post date:** [March 16, 2024, 2:15pm UTC](https://discuss.elastic.co/t/netflow-codec-how-to-decode-and-define-a-field-outside-a-flowset/355538/1 "2024-03-16T14:15:26Z")

</div>

Hello everyone!

I'm decoding a netflow stream, here's an example:

> **Спойлер**
>
> Cisco NetFlow/IPFIX  
> Version: 10  
> Length: 380  
> Timestamp: Jan 2, 2024 14:21:25.000000000 RTZ 2 (winter)  
> ExportTime: 1704194485  
> FlowSequence: 2793787977  
> Observation Domain Id: 524288  
> Set 1 [id=256] (4 flows)  
> FlowSet Id: (Data) (256)  
> FlowSet Length: 364  
> [Template Frame: 1521 (received after this frame)]  
> Flow 1  
> SrcAddr: 23.109.245.252  
> DstAddr: 85.143.64.233  
> IP ToS: 0x00  
> Protocol: TCP (6)  
> SrcPort: 443 (443)  
> DstPort: 58194 (58194)  
> ICMP Type: 0x0000  
> InputInt: 789  
> Vlan Id: 701  
> SrcMask: 24  
> DstMask: 20  
> SrcAS: 39134  
> DstAS: 5567  
> NextHop: 194.85.43.229  
> TCP Flags: 0x10, ACK  
> 00.. .... = Reserved: 0x0  
> ..0. .... = URG: Not used  
> ...1 .... = ACK: Used  
> .... 0... = PSH: Not used  
> .... .0.. = RST: Not used  
> .... ..0. = SYN: Not used  
> .... ...0 = FIN: Not used  
> OutputInt: 836  
> MinTTL: 62  
> MaxTTL: 62  
> Flow End Reason: Active timeout (2)  
> IPVersion: 4  
> BGPNextHop: 194.85.40.19  
> Direction: Unknown (255)  
> Dot1q Vlan Id: 0  
> Dot1q Customer Vlan Id: 0  
> fragIdent: 0  
> Octets: 1500  
> Packets: 1  
> [Duration: 0.000000000 seconds (milliseconds)]  
> StartTime: Jan 2, 2024 14:20:24.064000000 RTZ 2 (winter)  
> EndTime: Jan 2, 2024 14:20:24.064000000 RTZ 2 (winter)  
> Flow 2  
> Flow 3  
> Flow 4

I would like to additionally decode the "Observation Domain Id" field, which has ElementID 149.  
How can this be configured?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 13, 2024, 2:16pm UTC](https://discuss.elastic.co/t/netflow-codec-how-to-decode-and-define-a-field-outside-a-flowset/355538/2 "2024-04-13T14:16:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.