logstash netflow template broken for elasticsearch 6.0+

[robcowart]

logstash netflow template broken for elasticsearch 6.0+

[robcowart]

You will notice that there is an es-6.0.0-pre branch. I will be completing a new release for 6.0.0 now that it is GA. In the meantime the index template from the es-6.0.0-pre branch should work.

[dhermans]

hi -thanks for developing this tool - looks amazing.

i tried your es-6.0.0-pre branch ( had other issues trying to get 5.x working ) and attempted to push some captures into logstash..

i'm not sure i'm pushing the captures in correctly, is
cat my.pcap | nc -4 -u 10.1.1.1 2055
enough?

none get indexed - i just get ( i think i got same result with live data ):

[2017-12-02T13:24:43,194][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v0
[2017-12-02T13:24:43,194][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v54467
[2017-12-02T13:24:43,195][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v1780
[2017-12-02T13:24:43,196][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v36618
[2017-12-02T13:24:43,196][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v28416
[2017-12-02T13:24:43,197][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v34054
[2017-12-02T13:24:43,197][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v1860
[2017-12-02T13:24:43,197][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v42071
[2017-12-02T13:24:43,198][WARN ][logstash.codecs.netflow ] Ignoring Netflow version v36618

every now and then:
[2017-12-02T13:24:43,343][WARN ][logstash.codecs.netflow ] Invalid netflow packet received (value '56330' not as expected for obj.flow_records)

[2017-12-02T13:24:43,632][WARN ][logstash.codecs.netflow ] Can't (yet) decode flowset id 257 from source id 1, because no template to decode it with has been received. This message will usually go away after 1 minute.

obviously no indexes are created...

any help appreciated...

[robcowart]

Modified index template for compatibility with Elasticsearch versions 5.4.x thru 6.1.x. 638f958