# Netflow missing field

**URL:** <https://discuss.elastic.co/t/netflow-missing-field/110520>\
**Category:** Logstash\
**Created:** [December 6, 2017, 1:33pm UTC](https://discuss.elastic.co/t/netflow-missing-field/110520 "2017-12-06T13:33:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tim-timmer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tim-timmer/32/25021_2.png) [@tim-timmer](https://discuss.elastic.co/u/tim-timmer)\
**Post date:** [December 6, 2017, 1:33pm UTC](https://discuss.elastic.co/t/netflow-missing-field/110520/1 "2017-12-06T13:33:38Z")

</div>

Hi everyone!  
I'm very new to ELK... So, I've got the following:  
Elasticsearch v6.0.0 + X-Pack  
Logstash v6.0.0 + X-Pack  
Kibana v6.0.0 + X-Pack

I want to collect netflow data. The issue is:  
I've executed  
`/usr/share/logastash/bin/logstash --modules netflow --setup`  
and got installed template, dashboards and etc. in Kibana. OK.  
Then I've start to send netflow data from my ASA, after 10 minutes messages about missing "template to decode" gone and I've got data in Kibana. BUT!  
There are two fields in template - **netflow.bytes** and **netflow.packets** - and there are no such data in Discover app in Kibana. What should I do with this? Almost all graphs and charts referrs to this fields. Am I missing something?

Please help to solve this problem!

---

<div class="post-metadata">

**Author:** ![tim-timmer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tim-timmer/32/25021_2.png) [@tim-timmer](https://discuss.elastic.co/u/tim-timmer)\
**Post date:** [December 7, 2017, 6:33am UTC](https://discuss.elastic.co/t/netflow-missing-field/110520/2 "2017-12-07T06:33:10Z")

</div>

It seems the issue is in updated Netflow format: Cisco ASA 9.6(1) doesn't send IN\_PACKETS and IN\_BYTES fields - [ASA Netflow spec](https://www.cisco.com/c/en/us/td/docs/security/asa/special/netflow/guide/asa_netflow.html). For bytes count it sends the following fields:  
NF\_F\_FWD\_FLOW\_DELTA\_BYTES - The delta number of bytes from source to destination.  
NF\_F\_REV\_FLOW\_DELTA\_BYTES - The delta number of bytes from destination to source.  
and no data for packets count ☹

Any ideas how to update templates and dashboards?

---

<div class="post-metadata">

**Author:** ![Diogo](https://avatars.discourse-cdn.com/v4/letter/d/ea666f/32.png) [@Diogo](https://discuss.elastic.co/u/Diogo)\
**Post date:** [December 15, 2017, 12:22pm UTC](https://discuss.elastic.co/t/netflow-missing-field/110520/3 "2017-12-15T12:22:11Z")

</div>

Hitting the same issue right now. Trying to find if it is possible to tweak the dashboards.

---

<div class="post-metadata">

**Author:** ![Diogo](https://avatars.discourse-cdn.com/v4/letter/d/ea666f/32.png) [@Diogo](https://discuss.elastic.co/u/Diogo)\
**Post date:** [December 15, 2017, 1:07pm UTC](https://discuss.elastic.co/t/netflow-missing-field/110520/4 "2017-12-15T13:07:22Z")

</div>

Basically have to adjust the visualisations.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 12, 2018, 1:07pm UTC](https://discuss.elastic.co/t/netflow-missing-field/110520/5 "2018-01-12T13:07:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.