Question regarding new logstash / netflow config

Elastic Stack Logstash
1

Hello All,

I have a new ubuntu 16.04 instance in which I have just loaded a fresh install of the ELK stack on. I currently have logstash 2.3.4-1 installed and have also installed the netflow codec using the following command:
"/opt/logstash/bin/logstash-plugin install logstash-codec-netflow".

I am now trying to configure the conf file in order to start sending netflow traffic to my server and have ran into some issues. I have tried a few of the configurations that I have found in other posts for version 2.x, and I seem to be having issues actually getting these configurations to be excepted. I have reverted to a very simplistic configuration which is still giving me the same error when I attempt to run a configtest on it.

logstash-netflow.conf:
input {
udp {
port => 2055
codec => netflow
}
}

output {
elasticsearch { hosts => ["localhost:9200"] }
}

results of running "/opt/logstash/bin/logstash --configtest -f /etc/logstash/conf.d/20-logstash-staticfile-netflow.conf ":
The given configuration is invalid. Reason: field 'fields' is a reserved name in BinData::Array {:level=>:fatal}

Any have any ideas on what I am doing wrong?

2

As an update I now have it working, however the fix isn't a good answer. It seems that the netflow codec isn't properly supporting logstash 2.3.x. After I downgraded to 2.2.4 I am now able to successfully use the codec.

Anyone have any thoughts on getting the codec to work with 2.3.4 without modification? If not, I can submit a request with the codec maintainer.

3

Might be best to raise something on the repo, if you can pop the link back in here too it may help others :slight_smile:

4

I have the same problem. All was working fine until upgrading to logstash 2.3.4 this morning. I get the same message.

/var/log/logstash.log:

input {\n udp {\n port => 9996\n type => \"netflow\"\n codec => netflow {\n versions => [5,9,10]\n }\n }\n}\n\noutput {\n if [type] == \"netflow\" {\n elasticsearch {\n hosts => localhost\n index => \"netflow-%{+YYYY.MM.dd}\"\n }\n }\n}\n\n", :reason=>"field 'fields' is a reserved name in BinData::Array", :level=>:error}

Config test:

# service logstash configtest The given configuration is invalid. Reason: field 'fields' is a reserved name in BinData::Array {:level=>:fatal}

6

Fixed in https://github.com/logstash-plugins/logstash-codec-netflow/issues/41

2 Likes
7

Fixed in version 2.1.1. Thanks to @jorritfolmer

1 Like