logstash-plugins/logstash-codec-netflow

Netflow still reporting errors with H3C devices

Heriam opened this issue · 2 comments

Hi all. I tried to use Logstash to collect h3c netflow v9 messages but the following errors are reported:

[2018-07-18T11:00:50,548][WARN ][logstash.codecs.netflow  ] Template length exceeds flowset length, skipping {:template_id=>3281, :template_length=>65615, :record_length=>84}

[2018-07-18T11:00:53,546][WARN ][logstash.codecs.netflow  ] Template length exceeds flowset length, skipping {:template_id=>3281, :template_length=>65615, :record_length=>84}

[2018-07-18T11:00:56,546][WARN ][logstash.codecs.netflow  ] Template length exceeds flowset length, skipping {:template_id=>3281, :template_length=>65615, :record_length=>84}

[2018-07-18T11:01:08,546][WARN ][logstash.codecs.netflow  ] Template length exceeds flowset length, skipping {:template_id=>3281, :template_length=>65615, :record_length=>84}

[2018-07-18T11:01:23,550][WARN ][logstash.codecs.netflow  ] Template length exceeds flowset length, skipping {:template_id=>3281, :template_length=>65615, :record_length=>84}

[2018-07-18T11:01:23,558][WARN ][logstash.codecs.netflow  ] Template length exceeds flowset length, skipping {:template_id=>3281, :template_length=>65615, :record_length=>84}

Both logstash and the netflow-codec plugin are most updated. Could anyone help identify what the problem is? Packet captures are attached here:
http://p3s9jxyns.bkt.clouddn.com/tmp/h3c-netstream.cap

Thank you very much!

@jorritfolmer could you kindly have a look at this please?

Thanks for the pcap!
I've just released v4.1.0 with support for devices using VarString in Netflow v9, like H3C Netstream

Problem solved! Thank you @jorritfolmer !