# \[netfow codec\] Can't (yet) decode flowset **URL:** \ **Category:** Logstash\ **Created:** [October 4, 2017, 7:30am UTC](https://discuss.elastic.co/t/netfow-codec-cant-yet-decode-flowset/102655 "2017-10-04T07:30:28Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Post date:** [October 4, 2017, 7:30am UTC](https://discuss.elastic.co/t/netfow-codec-cant-yet-decode-flowset/102655/1 "2017-10-04T07:30:28Z")
Another day another something strange happening. Copied a VM running 5.4, upgraded to 5.6.1 =\> 5.6.2. No problem. Same VM, upgraded 5.4 directly to 5.6.2. Now netflow can't decode the flowset and no the problem is not going away after a few minutes. Tried waiting, rebooting etc. but nothing helps. ```auto [2017-10-04T16:21:06,330][WARN][logstash.codecs.netflow] Can't (yet) decode flowset id 261 from source id 1, because no template to decode it with has been received. This message will usually go away after 1 minute. [2017-10-04T16:21:06,330][WARN][logstash.codecs.netflow] Can't (yet) decode flowset id 257 from source id 1, because no template to decode it with has been received. This message will usually go away after 1 minute. [2017-10-04T16:21:06,330][WARN][logstash.codecs.netflow] Can't (yet) decode flowset id 261 from source id 1, because no template to decode it with has been received. This message will usually go away after 1 minute. [2017-10-04T16:21:06,330][WARN][logstash.codecs.netflow] Can't (yet) decode flowset id 257 from source id 1, because no template to decode it with has been received. This message will usually go away after 1 minute. [2017-10-04T16:21:06,330][WARN][logstash.codecs.netflow] Can't (yet) decode flowset id 257 from source id 1, because no template to decode it with has been received. This message will usually go away after 1 minute. [2017-10-04T16:21:06,330][WARN][logstash.codecs.netflow] Can't (yet) decode flowset id 261 from source id 1, because no template to decode it with has been received. This message will usually go away after 1 minute. [2017-10-04T16:21:06,331][WARN][logstash.codecs.netflow] Can't (yet) decode flowset id 261 from source id 1, because no template to decode it with has been received. This message will usually go away after 1 minute. [2017-10-04T16:21:08,502][WARN][logstash.codecs.netflow] Can't (yet) decode flowset id 261 from source id 1, because no template to decode it with has been received. This message will usually go away after 1 minute. ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 6, 2017, 5:37am UTC](https://discuss.elastic.co/t/netfow-codec-cant-yet-decode-flowset/102655/2 "2017-10-06T05:37:43Z")
Can you show us your config? ---
**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Post date:** [October 10, 2017, 2:01am UTC](https://discuss.elastic.co/t/netfow-codec-cant-yet-decode-flowset/102655/3 "2017-10-10T02:01:16Z")
I can. ```auto input { udp { port => 9995 type => "netflow" codec => netflow { versions => [9] } } } filter { if [type] == "netflow" { mutate { add_field => { "[netflow][ipv4_dst_host]" => "%{[netflow][ipv4_dst_addr]}" "[netflow][ipv4_src_host]" => "%{[netflow][ipv4_src_addr]}" } } if ([netflow][l4_dst_port]) { mutate { add_field => { "[netflow][l4_dst_port_translation]" => "%{[netflow][l4_dst_port]}" } } } translate { dictionary_path => '/etc/logstash/port_translation.yaml' field => "[netflow][l4_dst_port_translation]" override => true destination => "[netflow][l4_dst_port_translation]" } dns { action => 'replace' reverse => "[netflow][ipv4_dst_host]" } dns { action => 'replace' reverse => "[netflow][ipv4_src_host]" } } } output { if [type] == "netflow" { elasticsearch { hosts => localhost index => "netflow-%{+YYYY.MM.dd}" } } } ``` I made no changes to the config between 5.4 and 5.6. ---
**Author:** ![scherma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/scherma/32/23571_2.png) [@scherma](https://discuss.elastic.co/u/scherma)\ **Post date:** [October 30, 2017, 5:25pm UTC](https://discuss.elastic.co/t/netfow-codec-cant-yet-decode-flowset/102655/4 "2017-10-30T17:25:31Z")
Definitely interested to hear if anyone's been able to solve this. ---
**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Post date:** [November 2, 2017, 12:43am UTC](https://discuss.elastic.co/t/netfow-codec-cant-yet-decode-flowset/102655/5 "2017-11-02T00:43:22Z")
I couldn't get it working on my Ubuntu install that is shared with Elastic but I did a separate Logstash only install on Xubuntu and that one works. ---
**Author:** ![scherma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/scherma/32/23571_2.png) [@scherma](https://discuss.elastic.co/u/scherma)\ **Post date:** [November 8, 2017, 11:47pm UTC](https://discuss.elastic.co/t/netfow-codec-cant-yet-decode-flowset/102655/6 "2017-11-08T23:47:56Z")
Sjaak01, do you have the java dev kit installed, or just the JRE? Not 100% sure yet but starting to think that this is because when the plugin is downloaded it needs the JDK to build it locally. At least, that's assuming our issues have a common cause. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 6, 2017, 11:48pm UTC](https://discuss.elastic.co/t/netfow-codec-cant-yet-decode-flowset/102655/7 "2017-12-06T23:48:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.