# Netflow Reduced-size encoding

**URL:** <https://discuss.elastic.co/t/netflow-reduced-size-encoding/130499>\
**Category:** Logstash\
**Created:** [May 3, 2018, 5:00pm UTC](https://discuss.elastic.co/t/netflow-reduced-size-encoding/130499 "2018-05-03T17:00:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dalamar666](https://avatars.discourse-cdn.com/v4/letter/d/e9bcb4/32.png) [@dalamar666](https://discuss.elastic.co/u/dalamar666)\
**Post date:** [May 3, 2018, 5:00pm UTC](https://discuss.elastic.co/t/netflow-reduced-size-encoding/130499/1 "2018-05-03T17:00:08Z")

</div>

Hi,

Has anyone seen this warning before? Logstash 6.2

[2018-05-03T12:57:47,142][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :fwd\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,151][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :rev\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,190][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :fwd\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,199][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :rev\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,227][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :fwd\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,231][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :rev\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,243][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :fwd\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,244][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :rev\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,255][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :fwd\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,259][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :rev\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,267][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :fwd\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,267][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :rev\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,279][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :fwd\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,279][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :rev\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,280][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :fwd\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,289][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :rev\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,295][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :fwd\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,297][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :fwd\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,298][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :rev\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,303][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :rev\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,316][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :fwd\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,327][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :rev\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,348][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :fwd\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,348][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :rev\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,378][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :fwd\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,383][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :rev\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,406][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :fwd\_flow\_delta\_bytes], :length=\>8}  
[2018-05-03T12:57:47,415][WARN][logstash.codecs.netflow] Reduced-size encoding for uint32 is larger than uint32 {:field=\>[:uint32, :rev\_flow\_delta\_bytes], :length=\>8}

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [May 4, 2018, 8:47am UTC](https://discuss.elastic.co/t/netflow-reduced-size-encoding/130499/2 "2018-05-04T08:47:44Z")

</div>

There were recent commits to the Netflow codec which are source of these logs. I recommend that you open an issue at [https://github.com/logstash-plugins/logstash-codec-netflow/issues](https://github.com/logstash-plugins/logstash-codec-netflow/issues) as I am aware of a number of users seeing this.

---

<div class="post-metadata">

**Author:** ![dalamar666](https://avatars.discourse-cdn.com/v4/letter/d/e9bcb4/32.png) [@dalamar666](https://discuss.elastic.co/u/dalamar666)\
**Post date:** [May 4, 2018, 1:18pm UTC](https://discuss.elastic.co/t/netflow-reduced-size-encoding/130499/3 "2018-05-04T13:18:05Z")

</div>

Thanks Robert!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 1, 2018, 1:18pm UTC](https://discuss.elastic.co/t/netflow-reduced-size-encoding/130499/4 "2018-06-01T13:18:14Z")

</div>

Closed on June 1, 2018, 1:18pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.