# =\>"Unsupported Netflow version v10" warning using ipt-netflow

**URL:** <https://discuss.elastic.co/t/unsupported-netflow-version-v10-warning-using-ipt-netflow/54456>\
**Category:** Logstash\
**Created:** [June 30, 2016, 5:55pm UTC](https://discuss.elastic.co/t/unsupported-netflow-version-v10-warning-using-ipt-netflow/54456 "2016-06-30T17:55:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![DRW](https://avatars.discourse-cdn.com/v4/letter/d/7feea3/32.png) [@DRW](https://discuss.elastic.co/u/DRW)\
**Post date:** [June 30, 2016, 5:55pm UTC](https://discuss.elastic.co/t/unsupported-netflow-version-v10-warning-using-ipt-netflow/54456/1 "2016-06-30T17:55:49Z")

</div>

Hi. I'm using ipt-netflow ([https://github.com/aabc/ipt-netflow](https://github.com/aabc/ipt-netflow)) to send netflow data at logstash.

I am getting this.

{:timestamp=\>"2016-06-30T17:26:06.068000+0000", :message=\>"Pipeline main started"}  
{:timestamp=\>"2016-06-30T17:26:13.768000+0000", :message=\>"Unsupported Netflow version v10", :level=\>:warn}  
{:timestamp=\>"2016-06-30T17:26:14.959000+0000", :message=\>"Unsupported Netflow version v10", :level=\>:warn}  
{:timestamp=\>"2016-06-30T17:26:14.960000+0000", :message=\>"Unsupported Netflow version v10", :level=\>:warn}  
{:timestamp=\>"2016-06-30T17:26:14.961000+0000", :message=\>"Unsupported Netflow version v10", :level=\>:warn}  
{:timestamp=\>"2016-06-30T17:26:14.962000+0000", :message=\>"Unsupported Netflow version v10", :level=\>:warn}

It was accepting v5 without a problem, but I really need v10 to work.

I'm using the docker with the logstash:latest container.  
logstash-codec-netflow is installed.

Here is my logstash config.

input {  
udp {  
port =\> 5656  
codec =\> netflow {  
versions =\> [10]  
target =\> ipfix  
}  
type =\> ipfix  
}  
}

filter {  
json {  
source =\> "message"  
}  
}

output {  
elasticsearch {  
hosts =\> "elasticsearch:9200"  
index =\> "netflow-%{+YYYY.MM.dd}"  
}  
}

Here is my ipt-netflow config  
sysctl net.netflow  
net.netflow.active\_timeout = 1800  
net.netflow.debug = 0  
net.netflow.destination = 45.56.96.253:5656  
net.netflow.flush = 0  
net.netflow.hashsize = 127232  
net.netflow.inactive\_timeout = 15  
net.netflow.maxflows = 2000000  
net.netflow.protocol = 10  
net.netflow.refresh-rate = 20  
net.netflow.scan-min = 1  
net.netflow.sndbuf = 212992  
net.netflow.timeout-rate = 30

Happy to include anything else needed, Not sure where else to start.

Any help is appreciated.

Thanks.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 1, 2016, 4:08am UTC](https://discuss.elastic.co/t/unsupported-netflow-version-v10-warning-using-ipt-netflow/54456/2 "2016-07-01T04:08:01Z")

</div>

You should ask on the plugin repo, as this isn't one that is supported by Elastic sorry.

---

<div class="post-metadata">

**Author:** ![DRW](https://avatars.discourse-cdn.com/v4/letter/d/7feea3/32.png) [@DRW](https://discuss.elastic.co/u/DRW)\
**Post date:** [July 1, 2016, 4:11pm UTC](https://discuss.elastic.co/t/unsupported-netflow-version-v10-warning-using-ipt-netflow/54456/3 "2016-07-01T16:11:10Z")

</div>

logstash-codec-netflow isn't supported?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 1, 2016, 10:16pm UTC](https://discuss.elastic.co/t/unsupported-netflow-version-v10-warning-using-ipt-netflow/54456/4 "2016-07-01T22:16:40Z")

</div>

Sorry, I misunderstood the thread.

Per [Netflow codec plugin | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-netflow.html);

> The "netflow" codec is for decoding Netflow v5/v9 flows.

---

<div class="post-metadata">

**Author:** ![DRW](https://avatars.discourse-cdn.com/v4/letter/d/7feea3/32.png) [@DRW](https://discuss.elastic.co/u/DRW)\
**Post date:** [July 7, 2016, 2:12pm UTC](https://discuss.elastic.co/t/unsupported-netflow-version-v10-warning-using-ipt-netflow/54456/5 "2016-07-07T14:12:53Z")

</div>

I missed your reply before, thank you. I misunderstood its compatibility; There is ipfix(v10) code in the codec, but I guess it's not really supported yet.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/unsupported-netflow-version-v10-warning-using-ipt-netflow/54456/6 "2017-07-06T04:49:07Z")

</div>