# Netflow Template length doesn't fit cleanly into flowset

**URL:** https://discuss.elastic.co/t/netflow-template-length-doesnt-fit-cleanly-into-flowset/101698
**Category:** Logstash
**Created:** [September 25, 2017, 12:12pm UTC](https://discuss.elastic.co/t/netflow-template-length-doesnt-fit-cleanly-into-flowset/101698 "2017-09-25T12:12:51Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![lumi](https://avatars.discourse-cdn.com/v4/letter/l/b38774/32.png) [@lumi](https://discuss.elastic.co/u/lumi)
#### Post date: [September 25, 2017, 12:12pm UTC](https://discuss.elastic.co/t/netflow-template-length-doesnt-fit-cleanly-into-flowset/101698/1 "2017-09-25T12:12:51Z")

</div>

Hello

I have got a fortigate. It should send Netflow Data to my elk stack.  
But i alway get this message:

```
[2017-09-25T14:02:53,313][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>258, :template_length=>57, :record_length=>64}
[2017-09-25T14:02:53,317][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>258, :template_length=>57, :record_length=>64}
[2017-09-25T14:02:53,321][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>258, :template_length=>57, :record_length=>64}
[2017-09-25T14:02:53,329][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>258, :template_length=>57, :record_length=>64}
[2017-09-25T14:02:53,325][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>262, :template_length=>69, :record_length=>76}
[2017-09-25T14:02:53,347][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>262, :template_length=>69, :record_length=>76}
[2017-09-25T14:02:53,353][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>262, :template_length=>69, :record_length=>76}
[2017-09-25T14:02:53,370][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>262, :template_length=>69, :record_length=>76}
[2017-09-25T14:02:53,385][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>262, :template_length=>69, :record_length=>76}
[2017-09-25T14:02:53,390][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>262, :template_length=>69, :record_length=>76}
[2017-09-25T14:02:53,542][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>262, :template_length=>69, :record_length=>76}
[2017-09-25T14:02:53,871][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>262, :template_length=>69, :record_length=>76}
[2017-09-25T14:02:53,877][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>262, :template_length=>69, :record_length=>76}
[2017-09-25T14:02:53,969][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>262, :template_length=>69, :record_length=>76}
[2017-09-25T14:02:53,972][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>262, :template_length=>69, :record_length=>76}
[2017-09-25T14:02:53,996][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>262, :template_length=>69, :record_length=>76}
[2017-09-25T14:02:54,051][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>262, :template_length=>69, :record_length=>76}
[2017-09-25T14:02:54,058][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>262, :template_length=>69, :record_length=>76}
[2017-09-25T14:02:54,097][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>262, :template_length=>69, :record_length=>76}
[2017-09-25T14:02:54,111][WARN][logstash.codecs.netflow] Template length doesn't fit cleanly into flowset {:template_id=>262, :template_length=>69, :record_length=>76}

```

Can anybody help me?  
Is it possible to change the Template ?

Kind regards  
Lumi

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 26, 2017, 5:00am UTC](https://discuss.elastic.co/t/netflow-template-length-doesnt-fit-cleanly-into-flowset/101698/2 "2017-09-26T05:00:02Z")

</div>

Please show your config and what version of the stack you are using.

---

<div class="post-metadata">

### Author: ![lumi](https://avatars.discourse-cdn.com/v4/letter/l/b38774/32.png) [@lumi](https://discuss.elastic.co/u/lumi)
#### Post date: [September 26, 2017, 7:11am UTC](https://discuss.elastic.co/t/netflow-template-length-doesnt-fit-cleanly-into-flowset/101698/3 "2017-09-26T07:11:45Z")

</div>

Thats the netflow part of my config in /etc/logstash/conf.d

```
input {
 udp {
                port => XXX
                type => netflow
                codec => netflow
                }

}

output {

        if ( [type] == "netflow" ) {
         elasticsearch {
                hosts => ["XXX:9200"]
                index => "netflow-%{+YYYY.MM.dd}"
                user => XX
                password => XX
  }
 }
}

```

I am using the elk version 5.6.1  
The logstash-output-elasticsearch plugin is 7.4.1

---

<div class="post-metadata">

### Author: ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)
#### Post date: [September 27, 2017, 2:41am UTC](https://discuss.elastic.co/t/netflow-template-length-doesnt-fit-cleanly-into-flowset/101698/4 "2017-09-27T02:41:22Z")

</div>

NVM, not the same error.

---

<div class="post-metadata">

### Author: ![lumi](https://avatars.discourse-cdn.com/v4/letter/l/b38774/32.png) [@lumi](https://discuss.elastic.co/u/lumi)
#### Post date: [September 27, 2017, 5:59am UTC](https://discuss.elastic.co/t/netflow-template-length-doesnt-fit-cleanly-into-flowset/101698/6 "2017-09-27T05:59:01Z")

</div>

Do you think there is no solution available ?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 25, 2017, 5:59am UTC](https://discuss.elastic.co/t/netflow-template-length-doesnt-fit-cleanly-into-flowset/101698/7 "2017-10-25T05:59:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
