The “netflow” codec is for decoding Netflow v5/v9 flows.
# with an input plugin:
# you can also use this codec with an output.
input {
file {
codec => netflow {
cache_ttl => ... # number (optional), default: 4000
definitions => ... # a valid filesystem path (optional)
target => ... # string (optional), default: "netflow"
versions => ... # array (optional), default: [5, 9]
}
}
}
Netflow v9 template cache TTL (minutes)
Override YAML file containing Netflow field definitions
Each Netflow field is defined like so:
id: - default length in bytes - :name id: - :uintN or :ip4_addr or :ip6_addr or :mac_addr or :string - :name id: - :skip
See https://github.com/logstash/logstash/tree/v1.4.2/lib/logstash/codecs/netflow/netflow.yaml for the base set.
Specify into what field you want the Netflow data.
Specify which Netflow versions you will accept.