# No matching template for flow id 257

**URL:** <https://discuss.elastic.co/t/no-matching-template-for-flow-id-257/49233>\
**Category:** Logstash\
**Created:** [May 4, 2016, 10:23pm UTC](https://discuss.elastic.co/t/no-matching-template-for-flow-id-257/49233 "2016-05-04T22:23:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![stecino](https://avatars.discourse-cdn.com/v4/letter/s/ea666f/32.png) [@stecino](https://discuss.elastic.co/u/stecino)\
**Post date:** [May 4, 2016, 10:23pm UTC](https://discuss.elastic.co/t/no-matching-template-for-flow-id-257/49233/1 "2016-05-04T22:23:53Z")

</div>

Hello,

I have the following Netflow config:

input {  
udp {  
host =\> "0.0.0.0"  
port =\> 5599  
codec =\> netflow {  
definitions =\> "/home/t/logstash-2.2.2/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-2.0.3/lib/logstash/codecs/netflow/netflow.yaml"  
versions =\> [5,9,10]  
}  
}  
}

I have a CIsco ASR1002 router sending the message with following configuration:

flow record NETFLOW\_RECORD  
match ipv4 tos  
match ipv4 protocol  
match ipv4 source address  
match ipv4 destination address  
match transport source-port  
match transport destination-port  
match interface input  
collect routing next-hop address ipv4  
collect ipv4 dscp  
collect ipv4 ttl minimum  
collect ipv4 ttl maximum  
collect transport tcp flags  
collect interface output  
collect counter bytes  
collect counter packets  
collect timestamp sys-uptime first  
collect timestamp sys-uptime last  
collect application name

Getting this message:

{:timestamp=\>"2016-05-04T22:05:32.909000+0000", :message=\>"No matching template for flow id 257", :level=\>:warn}  
{:timestamp=\>"2016-05-04T22:05:32.915000+0000", :message=\>"No matching template for flow id 257", :level=\>:warn}

Some of the topics recommend to update netflow.yaml, but non of them mention anything about this 257 id. If someone has something specific would really appreciate it

---

<div class="post-metadata">

**Author:** ![stecino](https://avatars.discourse-cdn.com/v4/letter/s/ea666f/32.png) [@stecino](https://discuss.elastic.co/u/stecino)\
**Post date:** [May 6, 2016, 1:49am UTC](https://discuss.elastic.co/t/no-matching-template-for-flow-id-257/49233/2 "2016-05-06T01:49:39Z")

</div>

I also was able to get 257 template from our Network Team

Client: Flow Monitor NETFLOW\_MONITOR  
Exporter Format: NetFlow Version 9  
Template ID : 257  
Source ID : 131073  
Record Size : 50  
Template layout

* * *

## | Field | Type | Offset | Size |

## | ipv4 source address | 8 | 0 | 4 | | ipv4 destination address | 12 | 4 | 4 | | ip tos | 5 | 8 | 1 | | ip dscp | 195 | 9 | 1 | | ip protocol | 4 | 10 | 1 | | ip ttl minimum | 52 | 11 | 1 | | ip ttl maximum | 53 | 12 | 1 | | transport source-port | 7 | 13 | 2 | | transport destination-port | 11 | 15 | 2 | | transport tcp flags | 6 | 17 | 1 | | interface input snmp | 10 | 18 | 4 | | routing next-hop address ipv4 | 15 | 22 | 4 | | interface output snmp | 14 | 26 | 4 | | application id | 95 | 30 | 4 | | counter bytes | 1 | 34 | 4 | | counter packets | 2 | 38 | 4 | | timestamp sys-uptime first | 22 | 42 | 4 | | timestamp sys-uptime last | 21 | 46 | 4 |

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:59am UTC](https://discuss.elastic.co/t/no-matching-template-for-flow-id-257/49233/3 "2017-07-06T04:59:06Z")

</div>