Netflow: Unsupported field in template

Working with sarlacpit on this issue, I've found the 'unsupported field in template' warning appears in log when passing the following field from a Cisco flow record to logstash:

collect ipv4 ttl

After removing the field from the Cisco flow record template, we've seen the error no longer appears in the logstash logs, and flows are received.

1 Like