# Parsing netflow data
**URL:** https://discuss.elastic.co/t/parsing-netflow-data/35334
**Category:** Logstash
**Created:** [November 23, 2015, 5:33pm UTC](https://discuss.elastic.co/t/parsing-netflow-data/35334 "2015-11-23T17:33:47Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Ian\_Hayes](https://discuss.elastic.co/u/Ian_Hayes)
#### Post date: [November 23, 2015, 5:33pm UTC](https://discuss.elastic.co/t/parsing-netflow-data/35334/1 "2015-11-23T17:33:47Z")
Hello all-
I'm trying to have Logstash help out with some Netflow data. It receives data nicely and sends it to Elasticsearch with no problem, but I'm trying to add an extra field that contains the connection duration.
My basic Logstash config file is pretty simple:
input {
udp {
port =\> 12345
codec =\> netflow
type =\> "netflow"
}
}
output {
stdout { codec =\> "rubydebug" }
#elasticsearch {
#host =\> "elastichost"
#protocol =\> "http"
#index =\> "logstash\_netflow-%{+YYYY.MM.dd}"
}
}
And the output:
{
"@timestamp" =\> "2015-11-23T16:57:07.000Z",
"netflow" =\> {
"version" =\> 9,
"flow\_seq\_num" =\> 0,
"flowset\_id" =\> 1024,
"ipv4\_src\_addr" =\> "xxxx.xxxx.xxxx.xxxx",
"ipv4\_dst\_addr" =\> "yyyy.yyyy.yyyy.yyyy",
"last\_switched" =\> "2015-12-31T06:36:25.999Z",
"first\_switched" =\> "2015-12-31T06:35:12.999Z",
"in\_bytes" =\> 12098,
"in\_pkts" =\> 215,
"input\_snmp" =\> 0,
"output\_snmp" =\> 0,
"l4\_src\_port" =\> 54065,
"l4\_dst\_port" =\> 80,
"protocol" =\> 6,
"tcp\_flags" =\> 26,
"ip\_protocol\_version" =\> 4
},
"@version" =\> "1",
"type" =\> "netflow",
"host" =\> "elastichost"
}
I tried adding a Ruby filter to do a date diff of netflow.last\_switched - netflow.first\_switched, but Ruby complains about Nil values.
filter {
ruby {
init =\> "require 'time'"
ruby =\> "event['duration'] = Time.parse(event['netflow.last\_switched']) - Time.parse(event['netflow.first\_switched'])"
}
}
I've also tried copying netflow.first\_switched and netflow.last\_switched to new fields by using mutate, but that doesn't seem to work very well. I figured maybe Ruby didn't like the event field names being used:
mutate {
add\_field { "flow\_start" =\> "%{netflow.first\_switched}"}
add\_field { "flow\_end" =\> "%{netflow.last\_switched}"}
}
It seems that I'm copying the literal name of "netflow.first\_switched" into the new field rather than the value.
So what obvious thing am I missing to get the duration of the flow added into my data?
---
### Author:  [@Ian\_Hayes](https://discuss.elastic.co/u/Ian_Hayes)
#### Post date: [November 23, 2015, 11:04pm UTC](https://discuss.elastic.co/t/parsing-netflow-data/35334/2 "2015-11-23T23:04:22Z")
The correct answer is:
`filter { ruby { init => "require 'time'" code => "event['duration'] = Time.parse(event['[netflow][last_switched]]) - Time.parse(event['[netflow][first_switched]])" } }`
---
### Author:  [@ugosan](https://discuss.elastic.co/u/ugosan)
#### Post date: [June 6, 2017, 10:28pm UTC](https://discuss.elastic.co/t/parsing-netflow-data/35334/3 "2017-06-06T22:28:56Z")
@Ian_Hayes , I think there might be something wrong with the syntax here, wouldnt it be something like this:
```
filter {
ruby {
init => "require 'time'"
code => "event['duration'] = Time.parse(event['[netflow][last_switched]']) - Time.parse(event['[netflow][first_switched]'])"
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2022, 4:09am UTC](https://discuss.elastic.co/t/parsing-netflow-data/35334/4 "2022-11-04T04:09:58Z")