# Netflow influxdb - parse error
**URL:** https://discuss.elastic.co/t/netflow-influxdb-parse-error/116046
**Category:** Logstash
**Created:** [January 18, 2018, 12:19pm UTC](https://discuss.elastic.co/t/netflow-influxdb-parse-error/116046 "2018-01-18T12:19:11Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Sviks](https://discuss.elastic.co/u/Sviks)
#### Post date: [January 18, 2018, 12:19pm UTC](https://discuss.elastic.co/t/netflow-influxdb-parse-error/116046/1 "2018-01-18T12:19:11Z")
I get this error
[2018-01-18T12:23:11,400][WARN][logstash.outputs.influxdb] 28.999Z"}
1516278190000': invalid boolean\nunable to parse 'logstash,[host=xxx.xxx.xxx.xxx](http://host=xxx.xxx.xxx.xxx) netflow={"ingressVRFID"=\u003e1610612736, "output\_snmp"=\u003e40, "protocol"=\u003e1, "in\_pkts"=\u003e1, "bgp\_ipv4\_next\_hop"=\u003e"149.6.186.9", "version"=\u003e9, "in\_bytes"=\u003e92, "flow\_sampler\_id"=\u003e8, "ipv4\_dst\_addr"=\u003e"211.233.10.82", "flowset\_id"=\u003e260, "ipv4\_src\_addr"=\u003e"46.227.113.134", "egressVRFID"=\u003e1610612736, "src\_mask"=\u003e32, "tcp\_flags"=\u003e0, "first\_switched"=\u003e"2018-01-18T12:22:28.999Z", "forwarding\_status"=\u003e{"reason"=\u003e0, "status"=\u003e1}, "src\_as"=\u003e0, "l4\_src\_port"=\u003e0, "dst\_as"=\u003e3786, "direction"=\u003e1, "l4\_dst\_port"=\u003e0, "flow\_seq\_num"=\u003e14305323, "dst\_mask"=\u003e18, "src\_tos"=\u003e0, "input\_snmp"=\u003e59, "last\_switched"=\u003e"2018-01-18T12:22:28.999Z"}
1516278190000': invalid boolean\nunable to parse 'logstash,[host=xxx.xxx.xxx.xxx](http://host=xxx.xxx.xxx.xxx) netflow={"ingressVRFID"=\u003e1610612736, "output\_snmp"=\u003e39, "protocol"=\u003e1, "in\_pkts"=\u003e1, "bgp\_ipv4\_next\_hop"=\u003e"80.77.137.150", "version"=\u003e9, "in\_bytes"=\u003e64, "flow\_sampler\_id"=\u003e8, "ipv4\_dst\_addr"=\u003e"80.77.131.130", "flowset\_id"=\u003e260, "ipv4\_src\_addr"=\u003e"80.67.81.45", "egressVRFID"=\u003e1610612736, "src\_mask"=\u003e24, "tcp\_flags"=\u003e0, "first\_switched"=\u003e"2018-01-18T12:22:28.999Z", "forwarding\_status"=\u003e{"reason"=\u003e0, "status"=\u003e1}, "src\_as"=\u003e34164, "l4\_src\_port"=\u003e0, "dst\_as"=\u003e0, "direction"=\u003e0, "l4\_dst\_port"=\u003e2048, "flow\_seq\_num"=\u003e14305323, "dst\_mask"=\u003e25, "src\_tos"=\u003e72, "input\_snmp"=\u003e40, "last\_switched"=\u003e"2018-01-18T12:22:28.999Z"}
config:
input {
udp {
port =\> 2055
codec =\> netflow
}
}
output {
influxdb {
host =\> "[xxx.xxx.xxx.xxx](http://xxx.xxx.xxx.xxx)"
db =\> "netflow\_logstash"
use\_event\_fields\_for\_data\_points =\> true
}
stdout { codec =\> rubydebug }
}
---
### Author:  [@Sviks](https://discuss.elastic.co/u/Sviks)
#### Post date: [January 19, 2018, 2:47pm UTC](https://discuss.elastic.co/t/netflow-influxdb-parse-error/116046/2 "2018-01-19T14:47:36Z")
a tcp dump of http packet shows that it contains data after the }
logstash,[host=xxx.xxx.xxx.xxx](http://host=xxx.xxx.xxx.xxx) netflow={"egressVRFID"=\>1610612736, "ipv4\_dst\_addr"=\>"[xxx.xxx.xxx.xxx](http://xxx.xxx.xxx.xxx)", "flow\_sampler\_id"=\>10, "input\_snmp"=\>67, "forwarding\_status"=\>{"reason"=\>0, "status"=\>1}, "direction"=\>1, "first\_switched"=\>"2018-01-19T14:41:54.999Z", "last\_switched"=\>"2018-01-19T14:41:54.999Z", "dst\_mask"=\>10, "dst\_as"=\>xxxxxx, "output\_snmp"=\>23, "in\_pkts"=\>9, "flow\_seq\_num"=\>20334520, "bgp\_ipv4\_next\_hop"=\>"[xxx.xxx.xxx.xxx](http://xxx.xxx.xxx.xxx)", "src\_tos"=\>0, "tcp\_flags"=\>26, "l4\_src\_port"=\>53599, "flowset\_id"=\>260, "version"=\>9, "in\_bytes"=\>3532, "ipv4\_src\_addr"=\>"[xxx.xxx.xxx.xxx](http://xxx.xxx.xxx.xxx)", "l4\_dst\_port"=\>443, "src\_as"=\>xxxxxx, "src\_mask"=\>32, "protocol"=\>6, "ingressVRFID"=\>1610612736} 1 **516372929000**
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 16, 2018, 2:47pm UTC](https://discuss.elastic.co/t/netflow-influxdb-parse-error/116046/3 "2018-02-16T14:47:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.