# Netflow codec. Wrong data

**URL:** <https://discuss.elastic.co/t/netflow-codec-wrong-data/238029>\
**Category:** Logstash\
**Created:** [June 22, 2020, 7:52am UTC](https://discuss.elastic.co/t/netflow-codec-wrong-data/238029 "2020-06-22T07:52:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![swb](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@swb](https://discuss.elastic.co/u/swb)\
**Post date:** [June 22, 2020, 7:52am UTC](https://discuss.elastic.co/t/netflow-codec-wrong-data/238029/1 "2020-06-22T07:52:21Z")

</div>

Hello friends,  
We want to replace our old system for viewing Netflow (Nfsen) information with ELK. For this, we used the netflow module for Logstash. But we see fewer packets and bytes than it actually is.  
For example:  
In Nfsen - it is correct information:

| Dst IP Addr | Flows | Packets | Bytes |
| --- | --- | --- | --- |
| 172.26.0.2 | 335 | 34200 | 17.5 M |
| 172.27.227.135 | 283 | 358500 | 26.0 M |
| 172.27.227.131 | 204 | 33300 | 5.5 M |

Time window: 2020-06-22 08:59:07 - 2020-06-22 09:19:06

during the same time in ELK:

| netflow.dst\_addr.keyword | flow | packets | bytes |
| --- | --- | --- | --- |
| 172.26.0.2 | 335 | 342 | 175,391 |
| 172.27.227.135 | 283 | 3,585 | 260,164 |
| 172.27.227.131 | 204 | 333 | 55,476 |

I do not understand why the number of packets and bytes is 100 times less.

ELK version - 7.3.2. Netflow codec v5, equipment - juniper mx80.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2020, 7:52am UTC](https://discuss.elastic.co/t/netflow-codec-wrong-data/238029/2 "2020-07-20T07:52:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.