Sending through Logstash shows corrupted data

[cloudflare]

Sending through Logstash shows corrupted data

[jcdaniel14]

For anyone falling into this, after reading 300 articles about Kafka and Go and taking a peek at the code I realized flows were being "encoded" by something called Protocol Buffers, which is something I didn't know about until yesterday but in simple terms is JSON on steroids, luckily there was a plugin in Logstash for "deserializing" protocol buffers and I tried it but it didn't quite work, Logstash forums say they're a bit outdated on protobuf tech. Logstash console below.

{ "ForwardingStatus" => 64, "TimeReceived" => 1571337358, "IcmpType" => 0, "TCPFlags" => 16, "DstVlan" => 0, "FragmentId" => 0, "FlowDirection" => 0, "SrcVlan" => 0, "SequenceNum" => 82825472, "SrcAS" => 0, "SrcAddr" => "4S#:", "Packets" => 1, "DstIf" => 219, "SrcPort" => 443, "DstAddr" => "-?=+-?=-?=", "IPTTL" => 0, "Type" => "NETFLOW_V9", "NextHopAS" => 0, "SamplerAddress" => "\ne\v-?=", "Etype" => 2048, "DstPort" => 62650, "IngressVrfID" => 1610612739, "EgressVrfID" => 1610612736, "SamplingRate" => 0, "NextHop" => "\nek-?=",

I decided to create my own function in Golang to send directly to Elasticsearch, and it did work, but I'm not sure if it will have an impact in performance given that I know nothing about how Go implements concurrency, I'm hoping to receive around 15k flows/sec and hardware is not an issue so I'll keep improving as I learn Go.

[lspgn]

Hi @jcdaniel14,
Yes, at the moment, it's only Protobuf. In the future, other serialization format may be enabled.

There was a derived technique to do this that another user showed me, would be to plug the logging output to logstash: #8

I usually advise to use Kafka as it provides automatic message distribution and I am more confident on the performance. Nonetheless, you can use a different "transport" to format into JSON (which is introduced here and here).

The way of creating your own function in Golang to send to ElasticSearch is one way. Kafka helps managing the flow of incoming messages by partitioning it and provides a buffer in case of delays. At 15kflows/sec you should be fine anyway.
If it's in a custom GoFlow version, the risk is to lose UDP packets due to CPU being busy pushing the current ones to ES. If it's an external program plugged on Kafka, it's fine.