Netflow Reduced-size encoding

Hi,

Has anyone seen this warning before? Logstash 6.2

[2018-05-03T12:57:47,142][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :fwd_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,151][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :rev_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,190][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :fwd_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,199][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :rev_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,227][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :fwd_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,231][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :rev_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,243][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :fwd_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,244][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :rev_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,255][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :fwd_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,259][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :rev_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,267][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :fwd_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,267][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :rev_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,279][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :fwd_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,279][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :rev_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,280][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :fwd_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,289][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :rev_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,295][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :fwd_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,297][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :fwd_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,298][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :rev_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,303][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :rev_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,316][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :fwd_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,327][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :rev_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,348][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :fwd_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,348][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :rev_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,378][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :fwd_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,383][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :rev_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,406][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :fwd_flow_delta_bytes], :length=>8}
[2018-05-03T12:57:47,415][WARN ][logstash.codecs.netflow ] Reduced-size encoding for uint32 is larger than uint32 {:field=>[:uint32, :rev_flow_delta_bytes], :length=>8}

There were recent commits to the Netflow codec which are source of these logs. I recommend that you open an issue at https://github.com/logstash-plugins/logstash-codec-netflow/issues as I am aware of a number of users seeing this.

1 Like

Thanks Robert!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.