# Question regarding new logstash / netflow config

**URL:** <https://discuss.elastic.co/t/question-regarding-new-logstash-netflow-config/54992>\
**Category:** Logstash\
**Created:** [July 7, 2016, 7:36pm UTC](https://discuss.elastic.co/t/question-regarding-new-logstash-netflow-config/54992 "2016-07-07T19:36:36Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gary\_Wright](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_wright/32/10785_2.png) [@Gary\_Wright](https://discuss.elastic.co/u/Gary_Wright)\
**Post date:** [July 7, 2016, 7:36pm UTC](https://discuss.elastic.co/t/question-regarding-new-logstash-netflow-config/54992/1 "2016-07-07T19:36:36Z")

</div>

Hello All,

I have a new ubuntu 16.04 instance in which I have just loaded a fresh install of the ELK stack on. I currently have logstash 2.3.4-1 installed and have also installed the netflow codec using the following command:  
"/opt/logstash/bin/logstash-plugin install logstash-codec-netflow".

I am now trying to configure the conf file in order to start sending netflow traffic to my server and have ran into some issues. I have tried a few of the configurations that I have found in other posts for version 2.x, and I seem to be having issues actually getting these configurations to be excepted. I have reverted to a very simplistic configuration which is still giving me the same error when I attempt to run a configtest on it.

logstash-netflow.conf:  
input {  
udp {  
port =\> 2055  
codec =\> netflow  
}  
}

output {  
elasticsearch { hosts =\> ["localhost:9200"] }  
}

results of running "/opt/logstash/bin/logstash --configtest -f /etc/logstash/conf.d/20-logstash-staticfile-netflow.conf ":  
The given configuration is invalid. Reason: field 'fields' is a reserved name in BinData::Array {:level=\>:fatal}

Any have any ideas on what I am doing wrong?

---

<div class="post-metadata">

**Author:** ![Gary\_Wright](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_wright/32/10785_2.png) [@Gary\_Wright](https://discuss.elastic.co/u/Gary_Wright)\
**Post date:** [July 7, 2016, 10:59pm UTC](https://discuss.elastic.co/t/question-regarding-new-logstash-netflow-config/54992/2 "2016-07-07T22:59:56Z")

</div>

As an update I now have it working, however the fix isn't a good answer. It seems that the netflow codec isn't properly supporting logstash 2.3.x. After I downgraded to 2.2.4 I am now able to successfully use the codec.

Anyone have any thoughts on getting the codec to work with 2.3.4 without modification? If not, I can submit a request with the codec maintainer.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 7, 2016, 11:06pm UTC](https://discuss.elastic.co/t/question-regarding-new-logstash-netflow-config/54992/3 "2016-07-07T23:06:20Z")

</div>

Might be best to raise something on the repo, if you can pop the link back in here too it may help others 🙂

---

<div class="post-metadata">

**Author:** ![renevdm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/renevdm/32/5730_2.png) [@renevdm](https://discuss.elastic.co/u/renevdm)\
**Post date:** [July 8, 2016, 12:30pm UTC](https://discuss.elastic.co/t/question-regarding-new-logstash-netflow-config/54992/4 "2016-07-08T12:30:41Z")

</div>

I have the same problem. All was working fine until upgrading to logstash 2.3.4 this morning. I get the same message.

/var/log/logstash.log:

`input {\n udp {\n port => 9996\n type => \"netflow\"\n codec => netflow {\n versions => [5,9,10]\n }\n }\n}\n\noutput {\n if [type] == \"netflow\" {\n elasticsearch {\n hosts => localhost\n index => \"netflow-%{+YYYY.MM.dd}\"\n }\n }\n}\n\n", :reason=>"field 'fields' is a reserved name in BinData::Array", :level=>:error}`

Config test:

`# service logstash configtest The given configuration is invalid. Reason: field 'fields' is a reserved name in BinData::Array {:level=>:fatal}`

---

<div class="post-metadata">

**Author:** ![renevdm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/renevdm/32/5730_2.png) [@renevdm](https://discuss.elastic.co/u/renevdm)\
**Post date:** [July 8, 2016, 9:50pm UTC](https://discuss.elastic.co/t/question-regarding-new-logstash-netflow-config/54992/6 "2016-07-08T21:50:45Z")

</div>

Fixed in [https://github.com/logstash-plugins/logstash-codec-netflow/issues/41](https://github.com/logstash-plugins/logstash-codec-netflow/issues/41)

---

<div class="post-metadata">

**Author:** ![suyograo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suyograo/32/44898_2.png) [@suyograo](https://discuss.elastic.co/u/suyograo)\
**Post date:** [July 11, 2016, 11:33pm UTC](https://discuss.elastic.co/t/question-regarding-new-logstash-netflow-config/54992/7 "2016-07-11T23:33:14Z")

</div>

Fixed in version 2.1.1. Thanks to @jorritfolmer

---

<div class="post-metadata">

**Author:** ![suyograo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suyograo/32/44898_2.png) [@suyograo](https://discuss.elastic.co/u/suyograo)\
**Post date:** [July 11, 2016, 11:33pm UTC](https://discuss.elastic.co/t/question-regarding-new-logstash-netflow-config/54992/8 "2016-07-11T23:33:44Z")

</div>