---
title: Netflow codec plugin v3.4.1
description: Plugin version: v3.4.1, Released on: 2017-06-23, Changelog. For other versions, see the overview list. To learn more about Logstash, see the Logstash...
url: https://www.elastic.co/docs/reference/logstash/versioned-plugins/v3-4-1-plugins-codecs-netflow
products:
  - Logstash
applies_to:
  - Elastic Stack: Generally available
---

# Netflow codec plugin v3.4.1
- Plugin version: v3.4.1
- Released on: 2017-06-23
- [Changelog](https://github.com/logstash-plugins/logstash-codec-netflow/blob/v3.4.1/CHANGELOG.md)

For other versions, see the [overview list](https://www.elastic.co/docs/reference/logstash/versioned-plugins/codec-netflow-index).
To learn more about Logstash, see the [Logstash Reference](https://www.elastic.co/guide/en/logstash/current/index.html).

## Getting help

For questions about the plugin, open a topic in the [Discuss](http://discuss.elastic.co) forums. For bugs or feature requests, open an issue in [Github](https://github.com/logstash-plugins/logstash-codec-netflow). For the list of Elastic supported plugins, please consult the [Elastic Support Matrix](https://www.elastic.co/support/matrix#matrix_logstash_plugins).

## Description

The "netflow" codec is used for decoding Netflow v5/v9/v10 (IPFIX) flows.

## Supported Netflow/IPFIX exporters

The following Netflow/IPFIX exporters are known to work with the most recent version of the netflow codec:

| Netflow exporter      | v5  | v9  | IPFIX | Remarks                                                 |
|-----------------------|-----|-----|-------|---------------------------------------------------------|
| Softflowd             | y   | y   | y     | IPFIX supported in                                      |
| nProbe                | y   | y   | y     |                                                         |
| ipt_NETFLOW           | y   | y   | y     |                                                         |
| Cisco ASA             |     | y   |       |                                                         |
| Cisco IOS 12.x        |     | y   |       |                                                         |
| fprobe                | y   |     |       |                                                         |
| Juniper MX80          | y   |     |       | SW > 12.3R8                                             |
| OpenBSD pflow         | y   | n   | y     |                                                         |
| Mikrotik 6.35.4       | y   |     | n     |                                                         |
| Ubiquiti Edgerouter X |     | y   |       | With MPLS labels                                        |
| Citrix Netscaler      |     |     | y     | Still some unknown fields, labeled netscalerUnknown<id> |


## Usage

Example Logstash configuration:
```
input {
  udp {
    host => localhost
    port => 2055
    codec => netflow {
      versions => [5, 9]
    }
    type => netflow
  }
  udp {
    host => localhost
    port => 4739
    codec => netflow {
      versions => [10]
      target => ipfix
   }
   type => ipfix
  }
  tcp {
    host => localhost
    port => 4739
    codec => netflow {
      versions => [10]
      target => ipfix
    }
    type => ipfix
  }
}
```


## Netflow Codec Configuration Options


| Setting                                                                     | Input type                                                      | Required |
|-----------------------------------------------------------------------------|-----------------------------------------------------------------|----------|
| [`cache_save_path`](#v3.4.1-plugins-codecs-netflow-cache_save_path)         | a valid filesystem path                                         | No       |
| [`cache_ttl`](#v3.4.1-plugins-codecs-netflow-cache_ttl)                     | [number](/docs/reference/logstash/plugins/value-types#number)   | No       |
| [`include_flowset_id`](#v3.4.1-plugins-codecs-netflow-include_flowset_id)   | [boolean](/docs/reference/logstash/plugins/value-types#boolean) | No       |
| [`ipfix_definitions`](#v3.4.1-plugins-codecs-netflow-ipfix_definitions)     | a valid filesystem path                                         | No       |
| [`netflow_definitions`](#v3.4.1-plugins-codecs-netflow-netflow_definitions) | a valid filesystem path                                         | No       |
| [`target`](#v3.4.1-plugins-codecs-netflow-target)                           | [string](/docs/reference/logstash/plugins/value-types#string)   | No       |
| [`versions`](#v3.4.1-plugins-codecs-netflow-versions)                       | [array](/docs/reference/logstash/plugins/value-types#array)     | No       |


### `cache_save_path`

- Value type is [path](/docs/reference/logstash/plugins/value-types#path)
- There is no default value for this setting.

Where to save the template cache This helps speed up processing when restarting logstash (So you don’t have to await the arrival of templates) cache will save as path/netflow_templates.cache and/or path/ipfix_templates.cache

### `cache_ttl`

- Value type is [number](/docs/reference/logstash/plugins/value-types#number)
- Default value is `4000`

Netflow v9/v10 template cache TTL (minutes)

### `include_flowset_id`

- Value type is [boolean](/docs/reference/logstash/plugins/value-types#boolean)
- Default value is `false`

Only makes sense for ipfix, v9 already includes this Setting to true will include the flowset_id in events Allows you to work with sequences, for instance with the aggregate filter

### `ipfix_definitions`

- Value type is [path](/docs/reference/logstash/plugins/value-types#path)
- There is no default value for this setting.

Override YAML file containing IPFIX field definitions
Very similar to the Netflow version except there is a top level Private Enterprise Number (PEN) key added:
```
pen:
id:
- :uintN or :ip4_addr or :ip6_addr or :mac_addr or :string
- :name
id:
- :skip
```

There is an implicit PEN 0 for the standard fields.
See  for the base set.

### `netflow_definitions`

- Value type is [path](/docs/reference/logstash/plugins/value-types#path)
- There is no default value for this setting.

Override YAML file containing Netflow field definitions
Each Netflow field is defined like so:
```
id:
- default length in bytes
- :name
id:
- :uintN or :ip4_addr or :ip6_addr or :mac_addr or :string
- :name
id:
- :skip
```

See  for the base set.

### `target`

- Value type is [string](/docs/reference/logstash/plugins/value-types#string)
- Default value is `"netflow"`

Specify into what field you want the Netflow data.

### `versions`

- Value type is [array](/docs/reference/logstash/plugins/value-types#array)
- Default value is `[5, 9, 10]`

Specify which Netflow versions you will accept.