# Problems with the Netflow Module - Possible ElasticSearch 6 Regression?

**URL:** <https://discuss.elastic.co/t/problems-with-the-netflow-module-possible-elasticsearch-6-regression/156385>\
**Category:** Logstash\
**Created:** [November 13, 2018, 4:32am UTC](https://discuss.elastic.co/t/problems-with-the-netflow-module-possible-elasticsearch-6-regression/156385 "2018-11-13T04:32:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zamiell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zamiell/32/51665_2.png) [@Zamiell](https://discuss.elastic.co/u/Zamiell)\
**Post date:** [November 13, 2018, 4:32am UTC](https://discuss.elastic.co/t/problems-with-the-netflow-module-possible-elasticsearch-6-regression/156385/1 "2018-11-13T04:32:48Z")

</div>

Hello ElasticSearch community,

I'm attempting to to use the Logstash Netflow Module, as documented here:  
[https://www.elastic.co/guide/en/logstash/current/netflow-module.html](https://www.elastic.co/guide/en/logstash/current/netflow-module.html)

I have a vanilla CentOS 7 installation with a default Logstash installation (installed with "yum install logstash").

However, upon entering the "logstash --modules netflow --setup -M netflow.var.input.udp.port=2055" command, I get this error:

```auto
[2018-11-12T23:15:20,611][INFO][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"}
[2018-11-12T23:15:21,113][FATAL][logstash.runner] An unexpected error occurred! {:error=>#<LogStash::ConfigLoadingError: Failed to parse the module configuration: [[400] {"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"[include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field."}],"type":"mapper_parsing_exception","reason":"Failed to parse mapping [_default_]: [include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field.","caused_by":{"type":"mapper_parsing_exception","reason":"[include_in_all] is not allowed for indices created on or after version 6.0.0 as [_all] is deprecated. As a replacement, you can use an [copy_to] on mapping fields to create your own catch all field."}},"status":400}]>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-5.0.4/lib/elasticsearch/transport/transport/base.rb:202:in `__raise_transport_error'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-5.0.4/lib/elasticsearch/transport/transport/base.rb:319:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-5.0.4/lib/elasticsearch/transport/transport/http/manticore.rb:67:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-5.0.4/lib/elasticsearch/transport/client.rb:131:in `perform_request'", "/usr/share/logstash/logstash-core/lib/logstash/elasticsearch_client.rb:77:in `put'", "/usr/share/logstash/logstash-core/lib/logstash/elasticsearch_client.rb:128:in `put'", "/usr/share/logstash/logstash-core/lib/logstash/modules/elasticsearch_importer.rb:29:in `put_overwrite'", "/usr/share/logstash/logstash-core/lib/logstash/modules/elasticsearch_importer.rb:19:in `put'", "/usr/share/logstash/logstash-core/lib/logstash/modules/scaffold.rb:30:in `import'", "org/jruby/RubyArray.java:1613:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/modules/scaffold.rb:29:in `import'", "/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:78:in `pipeline_configs'", "org/jruby/RubyArray.java:1613:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/config/modules_common.rb:56:in `pipeline_configs'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:276:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:204:in `run'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:71:in `(root)'"]}

```

Is this a regression in the 6+ version of ElasticSearch? I would expect that a vanilla version of the module would work out of the box. Or am I doing something wrong?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 11, 2018, 4:32am UTC](https://discuss.elastic.co/t/problems-with-the-netflow-module-possible-elasticsearch-6-regression/156385/2 "2018-12-11T04:32:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.