# Unknown setting 'definitions' for netflow!

**URL:** <https://discuss.elastic.co/t/unknown-setting-definitions-for-netflow/54120>\
**Category:** Logstash\
**Created:** [June 28, 2016, 7:00am UTC](https://discuss.elastic.co/t/unknown-setting-definitions-for-netflow/54120 "2016-06-28T07:00:09Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![bzaki](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bzaki/32/10579_2.png) [@bzaki](https://discuss.elastic.co/u/bzaki)\
**Post date:** [June 28, 2016, 7:00am UTC](https://discuss.elastic.co/t/unknown-setting-definitions-for-netflow/54120/1 "2016-06-28T07:00:09Z")

</div>

Hello,

I'm trying to use ELK to collect netflows. I'm using logstash 2.3.3 . But when I use the configuration option 'definitions' I get the error "_Unknown setting 'definitions' for netflow_". Here's my config file below:

```
udp {
  port => 4739
  codec => netflow {
    definitions => "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-2.1.0/lib/logstash/codecs/netflow/netflow.yaml"
    versions => [9]
 }

```

}

---

<div class="post-metadata">

**Author:** ![solidz](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@solidz](https://discuss.elastic.co/u/solidz)\
**Post date:** [June 28, 2016, 1:41pm UTC](https://discuss.elastic.co/t/unknown-setting-definitions-for-netflow/54120/2 "2016-06-28T13:41:59Z")

</div>

+1 !!

It works with Logstash 2.3.2, but not with Logstash 2.3.3 for me

---

<div class="post-metadata">

**Author:** ![bzaki](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bzaki/32/10579_2.png) [@bzaki](https://discuss.elastic.co/u/bzaki)\
**Post date:** [June 29, 2016, 6:41am UTC](https://discuss.elastic.co/t/unknown-setting-definitions-for-netflow/54120/3 "2016-06-29T06:41:42Z")

</div>

So you mean that I should downgrade to 2.3.2 ??

---

<div class="post-metadata">

**Author:** ![solidz](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@solidz](https://discuss.elastic.co/u/solidz)\
**Post date:** [June 29, 2016, 7:14am UTC](https://discuss.elastic.co/t/unknown-setting-definitions-for-netflow/54120/4 "2016-06-29T07:14:15Z")

</div>

I downgrade to 2.3.2 because I can't resolve this issue in 2.3.3

But I will try to find the problem, and if I find the solution, I will post a comment here.

---

<div class="post-metadata">

**Author:** ![bzaki](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bzaki/32/10579_2.png) [@bzaki](https://discuss.elastic.co/u/bzaki)\
**Post date:** [June 29, 2016, 7:15am UTC](https://discuss.elastic.co/t/unknown-setting-definitions-for-netflow/54120/5 "2016-06-29T07:15:28Z")

</div>

Thank you. 🙂

---

<div class="post-metadata">

**Author:** ![bzaki](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bzaki/32/10579_2.png) [@bzaki](https://discuss.elastic.co/u/bzaki)\
**Post date:** [June 29, 2016, 7:16am UTC](https://discuss.elastic.co/t/unknown-setting-definitions-for-netflow/54120/6 "2016-06-29T07:16:27Z")

</div>

Did you try to capture ipfix or you are just capturing netflow?

---

<div class="post-metadata">

**Author:** ![solidz](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@solidz](https://discuss.elastic.co/u/solidz)\
**Post date:** [June 29, 2016, 7:23am UTC](https://discuss.elastic.co/t/unknown-setting-definitions-for-netflow/54120/7 "2016-06-29T07:23:12Z")

</div>

Just "Flexible NetFlow (v9)" (for Cisco NX-OS and Cisco ASA) but one day I will try with IPFIX to see differences between IPFIX and NF

---

<div class="post-metadata">

**Author:** ![solidz](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@solidz](https://discuss.elastic.co/u/solidz)\
**Post date:** [June 29, 2016, 7:44am UTC](https://discuss.elastic.co/t/unknown-setting-definitions-for-netflow/54120/8 "2016-06-29T07:44:06Z")

</div>

It's very strange.  
When I test the configuration file with "service logstash configtest" in Logstash 2.3.2, the output is :  
"Configuration OK"

But in Logstash 2.3.3 I have :  
"Unknown setting 'definitions' for netflow {:level=\>:error}  
The given configuration is invalid. Reason: Something is wrong with your configuration. {:level=\>:fatal}"

It's the same for you ? Do you tried with Logstash 2.3.2 ?

Your configuration file seems good. I think that this issue is bound to the version of Logstash. Maybe plugin NetFlow is not compatible with this upgrade. I continue to search.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 29, 2016, 7:51am UTC](https://discuss.elastic.co/t/unknown-setting-definitions-for-netflow/54120/9 "2016-06-29T07:51:33Z")

</div>

Logstash 2.3.3 included a upgrade of the netflow codec from 2.0.5 to 2.1.0. It appears 2.1.0 replaced `definitions` with `netflow_definitions` and `ipfix_definitions`. It seems the Logstash 2.3 documentation listed as current on [elastic.co](http://elastic.co) doesn't actually include this update, but you can read the raw documentation at [https://github.com/logstash-plugins/logstash-codec-netflow/blob/v2.1.0/lib/logstash/codecs/netflow.rb](https://github.com/logstash-plugins/logstash-codec-netflow/blob/v2.1.0/lib/logstash/codecs/netflow.rb).

---

<div class="post-metadata">

**Author:** ![solidz](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@solidz](https://discuss.elastic.co/u/solidz)\
**Post date:** [June 29, 2016, 8:06am UTC](https://discuss.elastic.co/t/unknown-setting-definitions-for-netflow/54120/10 "2016-06-29T08:06:58Z")

</div>

Oh nice it works !! Thanks

---

<div class="post-metadata">

**Author:** ![bzaki](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bzaki/32/10579_2.png) [@bzaki](https://discuss.elastic.co/u/bzaki)\
**Post date:** [June 29, 2016, 8:56am UTC](https://discuss.elastic.co/t/unknown-setting-definitions-for-netflow/54120/11 "2016-06-29T08:56:04Z")

</div>

Yes, thank you it worked perfectly. But I just have one more inquiry, Is there a problem to collect ipfix flows using netflow codec if I used ipfix definitions like the configuration below? Or do I have to use ipfix codec? Because I'm facing dependency problems while installing logstash-codec-ipfix.

input { udp { port =\> 4739 codec =\> netflow { netflow\_definitions =\> "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-2.1.0/lib/logstash/codecs/netflow/ipfix.yaml" versions =\> [10] target =\> ipfix } type =\> ipfix } }

output {  
stdout { codec =\> rubydebug }  
elasticsearch {  
index =\> "logstash\_ipfix-%{+YYYY.MM.dd}"  
hosts =\> "localhost"  
}  
}

Error log:

No matching template for flow id 271 {:level=\>:warn, :file=\>"logstash/codecs/netflow.rb", :line=\>"409", :method=\>"decode\_ipfix"}

---

<div class="post-metadata">

**Author:** ![solidz](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@solidz](https://discuss.elastic.co/u/solidz)\
**Post date:** [June 29, 2016, 10:43am UTC](https://discuss.elastic.co/t/unknown-setting-definitions-for-netflow/54120/12 "2016-06-29T10:43:04Z")

</div>

I know this error. You recover a field who is not referency in the netflow codec.  
What is your IPFIX configuration on your router ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/unknown-setting-definitions-for-netflow/54120/13 "2017-07-06T04:50:27Z")

</div>