Logstash: Netflow Module: IPFIX support

[dannygoulder]

Please post all product and debugging questions on our forum. Your questions will reach our wider community members there, and if we confirm that there is a bug, then we can open a new issue here.

Logstash Plugins are located in a different organization: https://github.com/logstash-plugins. For bugs on specific Logstash plugins, for example, if Redis Output has a defect, please open it in the respective Redis Output repository.

For all general issues, please provide the following details for fast resolution:

• Version: 6.2.1
• Operating System: RHEL7
• Config File (if you have sensitive info, please remove it): n/a
• Sample Data:
• Steps to Reproduce: Send IPFIX flows to the netflow module. Logstash 'ignores' the IPFIX flow data

[jorritfolmer]

Can you try to update the logstash-codec-netflow to the most recent version (3.11.4)?
We've just fixed a bug with similar symptoms to what you're getting.

[dannygoulder]

Hi, unfortunately that didn't work. I've looked at the ruby template for the logstash config and it appears that the module's listener is only instructing the netflow codec to handle v5 and v9 flow records.

I guess this is more of a feature request than a bug.

[jorritfolmer]

Logstash-codec-netflow has supported IPFIX for over 2 years now with various known working exporters on the list here: https://github.com/logstash-plugins/logstash-codec-netflow/blob/master/docs/index.asciidoc.
To date the only unsupported device (that we know of) is the Cisco ASR 1k because it sends duplicate fields which this codec doesn't support.

[dannygoulder]

Thanks - my question was referring to the module internal to logstash, rather than the codec plugin.

[jorritfolmer]

Ah oops I didn't know there was an internal netflow module!

[somedatapacket]

It looks like there is no data model normalization for IPFIX events in netflow.conf.erb.

[somedatapacket]

@andrewvc I would like to contribute this normalization to netflow.conf.erb - should I submit a pull request?