{"action":"created","issue":{"url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/48","repository_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow","labels_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/48/labels{/name}","comments_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/48/comments","events_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/48/events","html_url":"https://github.com/logstash-plugins/logstash-codec-netflow/issues/48","id":176180623,"number":48,"title":"Add support for YAF","user":{"login":"bmagistro","id":19505408,"avatar_url":"https://avatars.githubusercontent.com/u/19505408?v=3","gravatar_id":"","url":"https://api.github.com/users/bmagistro","html_url":"https://github.com/bmagistro","followers_url":"https://api.github.com/users/bmagistro/followers","following_url":"https://api.github.com/users/bmagistro/following{/other_user}","gists_url":"https://api.github.com/users/bmagistro/gists{/gist_id}","starred_url":"https://api.github.com/users/bmagistro/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bmagistro/subscriptions","organizations_url":"https://api.github.com/users/bmagistro/orgs","repos_url":"https://api.github.com/users/bmagistro/repos","events_url":"https://api.github.com/users/bmagistro/events{/privacy}","received_events_url":"https://api.github.com/users/bmagistro/received_events","type":"User","site_admin":false},"labels":[{"id":133717391,"url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/labels/enhancement","name":"enhancement","color":"009800","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2016-09-10T13:49:00Z","updated_at":"2016-12-25T14:08:33Z","closed_at":null,"body":"Currently running ELK with the logstash-codec (2.1.1) and trying to add support for YAF IPFIX (https://tools.netsa.cert.org/yaf/index.html).  I've gotten a portion of the entries added to ipfix.yaml based on their docs (https://tools.netsa.cert.org/yaf/yaf.html) and have filled in \":skip\" for others but am having issues getting all templates to load.  This was confirmed by adding some debug lines to the module to dump what templates are loaded.  One of the key templates uses IE 293 Ent 0 which is a variable length field.  I am able to get the stats templates loaded but not the actual flow templates, error is \"{:timestamp=>\"2016-09-10T12:13:15.464000+0000\", :message=>\"No matching template for flow id ####\", :level=>:warn}\" where #### is one of the templates that were not loaded.\n\nWhat is the expected behavior of variable length fields?  I thought they (just the field) would just be skipped.\n\nPCAP of templates and/or flow available.  PR will be coming for the ipfix.yaml component.\n"},"comment":{"url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/comments/269124195","html_url":"https://github.com/logstash-plugins/logstash-codec-netflow/issues/48#issuecomment-269124195","issue_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/48","id":269124195,"user":{"login":"jorritfolmer","id":11555154,"avatar_url":"https://avatars.githubusercontent.com/u/11555154?v=3","gravatar_id":"","url":"https://api.github.com/users/jorritfolmer","html_url":"https://github.com/jorritfolmer","followers_url":"https://api.github.com/users/jorritfolmer/followers","following_url":"https://api.github.com/users/jorritfolmer/following{/other_user}","gists_url":"https://api.github.com/users/jorritfolmer/gists{/gist_id}","starred_url":"https://api.github.com/users/jorritfolmer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jorritfolmer/subscriptions","organizations_url":"https://api.github.com/users/jorritfolmer/orgs","repos_url":"https://api.github.com/users/jorritfolmer/repos","events_url":"https://api.github.com/users/jorritfolmer/events{/privacy}","received_events_url":"https://api.github.com/users/jorritfolmer/received_events","type":"User","site_admin":false},"created_at":"2016-12-25T14:08:33Z","updated_at":"2016-12-25T14:08:33Z","body":"I've added basic support in the `yaf` branch.\r\nDon't get too excited, because it won't handle the subtemplatelists (293)\r\n\r\nSo basically it handles a scenario where yaf was started without plugins like this:\r\n\r\n```\r\n/usr/local/bin/yaf --silk --ipfix=udp --live=pcap --out=host02 --ipfix-port=2055 --in=eth0 --applabel --verbose --mac --verbose --max-payload 384\r\n```\r\n\r\n"}}
{"actor":{"display_login":"jorritfolmer"}}