# Netflow codec: No matching template

**URL:** <https://discuss.elastic.co/t/netflow-codec-no-matching-template/80150>\
**Category:** Logstash\
**Created:** [March 27, 2017, 2:43pm UTC](https://discuss.elastic.co/t/netflow-codec-no-matching-template/80150 "2017-03-27T14:43:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![prodrg](https://avatars.discourse-cdn.com/v4/letter/p/3bc359/32.png) [@prodrg](https://discuss.elastic.co/u/prodrg)\
**Post date:** [March 27, 2017, 2:43pm UTC](https://discuss.elastic.co/t/netflow-codec-no-matching-template/80150/1 "2017-03-27T14:43:44Z")

</div>

Hello everybody,

I'm receiving the following issues from the Netflow codec in logstash:

```
[2017-03-27T09:40:00,696][WARN][logstash.codecs.netflow] No matching template for flow id 256
[2017-03-27T09:40:00,707][WARN][logstash.codecs.netflow] No matching template for flow id 257

```

Any idea of what is going wrong? From the same issue, if I google it, the logs show some kind of error that brings out what's going wrong. But on logstash-stdout, there is nothing to guide myself to the error.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [March 27, 2017, 6:25pm UTC](https://discuss.elastic.co/t/netflow-codec-no-matching-template/80150/2 "2017-03-27T18:25:14Z")

</div>

Netflow v9 supports a device sending a variety of different fields in the flow record (unlike Netflow v5 which was a static record). In order for the flow collector (in this case logstash) to know which data is in the record it requires a "template" which provides this information. The device will periodically send "template" messages, so usually these errors go away within 5 to 10 minutes of starting logstash. As long as they do, you have nothing to worry about. It is part of the normal operation of Netflow v9. If the errors do not go away, make sure that you are using the latest Netflow codec. There were a lot of enhancements around Logstash 5.1.1 and I have found it works really well.

Rob

---

<div class="post-metadata">

**Author:** ![prodrg](https://avatars.discourse-cdn.com/v4/letter/p/3bc359/32.png) [@prodrg](https://discuss.elastic.co/u/prodrg)\
**Post date:** [March 27, 2017, 7:15pm UTC](https://discuss.elastic.co/t/netflow-codec-no-matching-template/80150/3 "2017-03-27T19:15:15Z")

</div>

@rcowart Thanks for the response. I have Logstash on the most recent version and just upgraded the Netflow codec to 3.4.0, which is the latest. The message keeps going, but I have only just enabled it for less than 3 minutes, just to check the feed flowing. So, I will check your recommendation, and tell the results. Again, thanks!

UPDATE: Effectively, the warning message disappeared. I'm getting Ignoring Netflow v0 (Non-netflow data. No problems) and the real error message from the templates. But this is something to ask for the developers on how to fix it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2017, 7:15pm UTC](https://discuss.elastic.co/t/netflow-codec-no-matching-template/80150/4 "2017-04-24T19:15:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.