# Netflow9 Data from Cisco ISR
**URL:** https://discuss.elastic.co/t/netflow9-data-from-cisco-isr/97632
**Category:** Logstash
**Created:** [August 18, 2017, 7:42pm UTC](https://discuss.elastic.co/t/netflow9-data-from-cisco-isr/97632 "2017-08-18T19:42:52Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@eman3242](https://discuss.elastic.co/u/eman3242)
#### Post date: [August 18, 2017, 7:42pm UTC](https://discuss.elastic.co/t/netflow9-data-from-cisco-isr/97632/1 "2017-08-18T19:42:53Z")
Having trouble getting my Netflow9 data to load into Elasticsearch properly. I'm feeding logs from multiple beats sources--and those are working 100% correctly. All of the other sources are creating indices like "firewall1-2017-08-01", "device2-2017-08-01", etc.
For some reason though, my Netflow9 data is creating indices with literal names like %{[@metadata][type]}-2017-08-01. Looks like I'm missing metadata, but I don't know how to add it. I tried adding "metadata =\> true" in the udp input section, but Logstash wouldn't even start with it there.
Any ideas?
My config is pretty simple:
input {
beats {
```
port => 5044
```
}
udp {
port =\> 9995
#metadata =\> true
codec =\> netflow {
versions =\> [9]
}
type =\> netflow
}
}
output {
elasticsearch {
hosts =\> [":9200"]
sniffing =\> true
manage\_template =\> false
index =\> "%{[@metadata][type]}-%{+YYYY.MM.dd}"
document\_type =\> "%{[@metadata][type]}"
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 15, 2017, 7:42pm UTC](https://discuss.elastic.co/t/netflow9-data-from-cisco-isr/97632/2 "2017-09-15T19:42:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.