logstash-codec-netflow

logstash-codec-netflow copied to clipboard

Can't (yet) decode flowset id 274 from source id 256 - Cisco ASR 1001-X

7

Hello, I have some issues with logstash Netflow codec and Cisco ASR 1000. I am using Netflow Version 9 and have following messages in my logstash logs: [2019-10-08T15:36:22,517][ERROR][logstash.inputs.udp ] Exception...

imuab

IPFIX multiple identical fields (Was: Can't decode flowset id 258 from observation domain id 256)

10

For IPFIX exporter (Cisco router of 4321 model and IOS 16), I am getting this message. I run the flow for hours. But this message is not going away. Using...

AshHaque

Some Juniper IPFIX flows are not parsed correctly

4

- Logstash version: 6.5.1 - Codec Version: 4.2.1 - Operating System: Ubuntu 14.04 - Exporter device: Juniper MX480 running JUNOS 17.3R3-S3.3 - Config File (if you have sensitive info, please...

cvicente

Can't (yet) decode flowset id 5000 from source id 0

1

Please post all product and debugging questions on our [forum](https://discuss.elastic.co/c/logstash). Your questions will reach our wider community members there, and if we confirm that there is a bug, then we...

giovanirorato

[first.pcap.zip](https://github.com/logstash-plugins/logstash-codec-netflow/files/3089372/first.pcap.zip) Logstash receives the attached packets (template and flow packets) but it seems to drop the flow packet with the error [WARN ][logstash.codecs.netflow ] Can't (yet) decode flowset id 2048...

rajuuu1992

Crash collecting IPFIX from Juniper once every few months.

1

Hello, We are seeing this error once every few months on our logstash instances that collect flows from Juniper IPFIX. We've tried upgraded netflow codec from 4.1.2 to 4.2.0 and...

s1sfa

RIverbed Netflow support (Was: Can’t yet decode flow set id)

16

- Version:6.3 - Operating System:red hat7.1 - Config File (if you have sensitive info, please remove it): - Sample Data: [2018-07-03T07:17:16,724][WARN ][logstash.codecs.netflow ] Can't (yet) decode flowset id 300 from...

venki522

In /lib/logstash/codecs/netflow.rb the calculation of absolute timestamps for "first_switched" and "last_switched" is incorrect due to syntax error: Ruby doesn't support --/++ operators. Unfortunately jruby doesn't even show an error; it...

ghost

Exception in inputworker - Value for year must be in range

4

Hi, I recently upgraded my IPFIX-ELK-installation to version 6.3.2 on "Ubuntu 16.04.5 LTS" and I get following logstash error message: ``` [2018-08-23T06:40:52,762][ERROR][logstash.inputs.udp ] Exception in inputworker {"exception"=>#, "backtrace"=>["org/jruby/RubyTime.java:1166:in `at'", "org/logstash/ext/JrubyTimestampExtLibrary.java:188:in...

pgastinger

Ingesting IPFIX Flows From YAF Oddly Slow

8

I've been benchmarking the netflow codec for a tool that stitches IPFIX/ netflow data together into bi-directional sessions. The codec seems to run well when ingesting data from SonicWall and...

Zalgo2462