# Only netflow v5 is shown although both v9 and v5 are collected **URL:** \ **Category:** Kibana\ **Created:** [May 24, 2017, 9:09am UTC](https://discuss.elastic.co/t/only-netflow-v5-is-shown-although-both-v9-and-v5-are-collected/86929 "2017-05-24T09:09:18Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![massimo](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@massimo](https://discuss.elastic.co/u/massimo)\ **Post date:** [May 24, 2017, 9:09am UTC](https://discuss.elastic.co/t/only-netflow-v5-is-shown-although-both-v9-and-v5-are-collected/86929/1 "2017-05-24T09:09:19Z")
Hello, as the topic says netflow information (v5 and v9) is sent to logstash. Both are processed and stored in elasticsearch as expected. When opening the index in Kibana **only** v5 logs are shown although there are much less of this version than of v9, a ration of 1:30. Only after defining a filter which excludes v5 logs v9 logs are shown. Any ideas? complete stack on version 5.4 Regards, massimo ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 24, 2017, 9:27am UTC](https://discuss.elastic.co/t/only-netflow-v5-is-shown-although-both-v9-and-v5-are-collected/86929/2 "2017-05-24T09:27:55Z")
Providing your config would be helpful 🙂 ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [May 24, 2017, 9:57am UTC](https://discuss.elastic.co/t/only-netflow-v5-is-shown-although-both-v9-and-v5-are-collected/86929/3 "2017-05-24T09:57:14Z")
I have been doing A LOT with Flow technologies lately. I have posted files for a basic Netflow v5 and v9 solution on [Github](https://github.com/robcowart/elastiflow). It uses only out-of-the-box components and there is definitely more possible with plugins, but maybe you will find it useful to figure out your issue. Rob ---
**Author:** ![massimo](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@massimo](https://discuss.elastic.co/u/massimo)\ **Post date:** [May 24, 2017, 10:17am UTC](https://discuss.elastic.co/t/only-netflow-v5-is-shown-although-both-v9-and-v5-are-collected/86929/4 "2017-05-24T10:17:42Z")
Robert, I already know your efforts in this area. I am familiar with Netflow and other tools and I've also already tried this setup with version 2.4 which did not show this behaviour. I guess this is anyhow not really related to v5/v9 since I noticed that Kibana shows me for this index and its available fields very few, sometimes only one value for a particular field although there a more distinct values available. ---
**Author:** ![massimo](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@massimo](https://discuss.elastic.co/u/massimo)\ **Post date:** [May 24, 2017, 10:20am UTC](https://discuss.elastic.co/t/only-netflow-v5-is-shown-although-both-v9-and-v5-are-collected/86929/5 "2017-05-24T10:20:21Z")
Nothing special in the logstash config, i.e., input is udp with codec netflow. One filter translation for protocol (number) to protocol name conversion and an output to elasticsearch. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 24, 2017, 10:29am UTC](https://discuss.elastic.co/t/only-netflow-v5-is-shown-although-both-v9-and-v5-are-collected/86929/6 "2017-05-24T10:29:05Z")
Providing the config would be very helpful 😉 It may look simple, but that's entirely relative and you may have something in there that explains that. If we cannot see it, we cannot be sure. ---
**Author:** ![massimo](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@massimo](https://discuss.elastic.co/u/massimo)\ **Post date:** [May 24, 2017, 10:32am UTC](https://discuss.elastic.co/t/only-netflow-v5-is-shown-although-both-v9-and-v5-are-collected/86929/7 "2017-05-24T10:32:56Z")
``` input { udp { port => 2055 tags => ["netflow"] codec => netflow { versions => [5,9] } } } filter { if "netflow" in [tags] { translate { dictionary => [ "1", "icmp", "6", "tcp", "17", "udp", "41", "ipv6", "47", "gre", "50", "esp", "50", "ah", "89", "ospf" ] field => "[netflow][protocol]" destination => "[netflow][protocolname]" } translate { dictionary_path => '/tmp/devices.yaml' field => "host" destination => "hostname" } } } output { if "netflow" in [tags] { elasticsearch { hosts => localhost index => "netflow-logs" } } } ``` ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [May 24, 2017, 12:39pm UTC](https://discuss.elastic.co/t/only-netflow-v5-is-shown-although-both-v9-and-v5-are-collected/86929/8 "2017-05-24T12:39:01Z")
I tried your config (other than the translate filter). While there are things that can be done to make the data more usable, I can't see anything that looks incorrect based on your config. ![](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3edc3f01b554919b1ef27255a5fa7e257c0591fc.png) Can you share what you are seeing that you feel is wrong? ---
**Author:** ![massimo](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@massimo](https://discuss.elastic.co/u/massimo)\ **Post date:** [May 29, 2017, 9:17am UTC](https://discuss.elastic.co/t/only-netflow-v5-is-shown-although-both-v9-and-v5-are-collected/86929/9 "2017-05-29T09:17:07Z")
As I said, the table to the left on _Discover_ only presents v5 as available value for any given timeframe although there are are many more logs for v9. ![](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9a4abcbf3d1ea4178560ee2dab40316f564dae72.png) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 29, 2017, 9:01pm UTC](https://discuss.elastic.co/t/only-netflow-v5-is-shown-although-both-v9-and-v5-are-collected/86929/10 "2017-05-29T21:01:49Z")
Do the fields show in the index management page? ---
**Author:** ![massimo](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@massimo](https://discuss.elastic.co/u/massimo)\ **Post date:** [May 30, 2017, 5:21am UTC](https://discuss.elastic.co/t/only-netflow-v5-is-shown-although-both-v9-and-v5-are-collected/86929/11 "2017-05-30T05:21:51Z")
All fields are there but Kibana does not show me "9" as shown in the screenshot above - only "5" is shown. If I exclude "5" using a filter "9" is shown: ![](https://us1.discourse-cdn.com/elastic/original/3X/8/4/84ed42c127e20ea1a4af4b4c5ba91cde3cc4cbbe.png) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 30, 2017, 5:34am UTC](https://discuss.elastic.co/t/only-netflow-v5-is-shown-although-both-v9-and-v5-are-collected/86929/12 "2017-05-30T05:34:36Z")
The values shown in the field list are based on the sample of 500 documents that is retrieved, not the entire data set. This is why you might only be seeing some of the available values at first and then the rest once a subset of documents have been excluded from the data fetched. ---
**Author:** ![massimo](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@massimo](https://discuss.elastic.co/u/massimo)\ **Post date:** [May 30, 2017, 5:36am UTC](https://discuss.elastic.co/t/only-netflow-v5-is-shown-although-both-v9-and-v5-are-collected/86929/13 "2017-05-30T05:36:11Z")
This is confusing since there is much more data coming in with "9". ---
**Author:** ![massimo](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@massimo](https://discuss.elastic.co/u/massimo)\ **Post date:** [June 7, 2017, 7:04am UTC](https://discuss.elastic.co/t/only-netflow-v5-is-shown-although-both-v9-and-v5-are-collected/86929/14 "2017-06-07T07:04:29Z")
The initial tests when it comes to dealing with netflow in elasticStack have been completed. After disabling the sending of netflow information of various devices I noticed that one of the devices' system time was 2 hours in the future, i.e., although nothing was being sent anymore it still looked like as if data was coming in for another 2 hours. This is the very same device which was sending netflow v5 data - maybe this is related why Kibana was only showing this device's data as mentioned earlier. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 7:05am UTC](https://discuss.elastic.co/t/only-netflow-v5-is-shown-although-both-v9-and-v5-are-collected/86929/15 "2017-07-05T07:05:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.