Been scouring the forums and can't crack this one. I have a 4500X sending v9 Netflows with the following flow record defined (IOS is 152-4.E4):
flow record elk
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
collect routing forwarding-status
collect ipv4 dscp
collect ipv4 ttl minimum
collect ipv4 ttl maximum
collect transport tcp flags
collect interface output
collect counter bytes
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last
Even after several hours, logstash is throwing:
[2017-05-21T09:57:52,302][WARN ][logstash.codecs.netflow ] Unsupported field in template 257 {:type=>144, :length=>4}
[2017-05-21T09:57:52,302][WARN ][logstash.codecs.netflow ] No matching template for flow id 257
[2017-05-21T09:58:07,302][WARN ][logstash.codecs.netflow ] Unsupported field in template 257 {:type=>144, :length=>4}
[2017-05-21T09:58:07,302][WARN ][logstash.codecs.netflow ] No matching template for flow id 257
[2017-05-21T09:58:22,300][WARN ][logstash.codecs.netflow ] Unsupported field in template 257 {:type=>144, :length=>4}
[2017-05-21T09:58:22,301][WARN ][logstash.codecs.netflow ] No matching template for flow id 257
[2017-05-21T09:58:37,304][WARN ][logstash.codecs.netflow ] Unsupported field in template 257 {:type=>144, :length=>4}
A CFLOW decoded pcap of the data shows:
Anyone any ideas on this? Thanks!