# Netflow v9 Template (Logstash 5.4, Cisco 4500X, Netflow v9)

**URL:** <https://discuss.elastic.co/t/netflow-v9-template-logstash-5-4-cisco-4500x-netflow-v9/86581>\
**Category:** Logstash\
**Created:** [May 21, 2017, 4:44pm UTC](https://discuss.elastic.co/t/netflow-v9-template-logstash-5-4-cisco-4500x-netflow-v9/86581 "2017-05-21T16:44:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![profrowe](https://avatars.discourse-cdn.com/v4/letter/p/f475e1/32.png) [@profrowe](https://discuss.elastic.co/u/profrowe)\
**Post date:** [May 21, 2017, 4:44pm UTC](https://discuss.elastic.co/t/netflow-v9-template-logstash-5-4-cisco-4500x-netflow-v9/86581/1 "2017-05-21T16:44:46Z")

</div>

Been scouring the forums and can't crack this one. I have a 4500X sending v9 Netflows with the following flow record defined (IOS is 152-4.E4):

flow record elk

```
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
collect routing forwarding-status
collect ipv4 dscp
collect ipv4 ttl minimum
collect ipv4 ttl maximum
collect transport tcp flags
collect interface output
collect counter bytes
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last

```

Even after several hours, logstash is throwing:

```
[2017-05-21T09:57:52,302][WARN][logstash.codecs.netflow] Unsupported field in template 257 {:type=>144, :length=>4}
[2017-05-21T09:57:52,302][WARN][logstash.codecs.netflow] No matching template for flow id 257
[2017-05-21T09:58:07,302][WARN][logstash.codecs.netflow] Unsupported field in template 257 {:type=>144, :length=>4}
[2017-05-21T09:58:07,302][WARN][logstash.codecs.netflow] No matching template for flow id 257
[2017-05-21T09:58:22,300][WARN][logstash.codecs.netflow] Unsupported field in template 257 {:type=>144, :length=>4}
[2017-05-21T09:58:22,301][WARN][logstash.codecs.netflow] No matching template for flow id 257
[2017-05-21T09:58:37,304][WARN][logstash.codecs.netflow] Unsupported field in template 257 {:type=>144, :length=>4}

```

A CFLOW decoded pcap of the data shows:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/7/7/77511b2cfc2f5fa902e6da58bd4483c404d84cc8.png)

Anyone any ideas on this? Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 18, 2017, 4:44pm UTC](https://discuss.elastic.co/t/netflow-v9-template-logstash-5-4-cisco-4500x-netflow-v9/86581/2 "2017-06-18T16:44:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.