{"action":"created","comment":{"url":"https://api.github.com/repos/elastic/beats/pulls/comments/238572066","pull_request_review_id":181144161,"id":238572066,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIzODU3MjA2Ng==","diff_hunk":"@@ -0,0 +1,400 @@\n+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one\n+// or more contributor license agreements. Licensed under the Elastic License;\n+// you may not use this file except in compliance with the Elastic License.\n+\n+package v8\n+\n+import (\n+\t\"bytes\"\n+\t\"encoding/binary\"\n+\t\"fmt\"\n+\t\"io\"\n+\t\"log\"\n+\t\"net\"\n+\t\"time\"\n+\n+\t\"github.com/pkg/errors\"\n+\n+\t\"github.com/elastic/beats/x-pack/filebeat/input/netflow/decoder/config\"\n+\t\"github.com/elastic/beats/x-pack/filebeat/input/netflow/decoder/fields\"\n+\t\"github.com/elastic/beats/x-pack/filebeat/input/netflow/decoder/protocol\"\n+\t\"github.com/elastic/beats/x-pack/filebeat/input/netflow/decoder/record\"\n+\t\"github.com/elastic/beats/x-pack/filebeat/input/netflow/decoder/template\"\n+)\n+\n+const (\n+\tProtocolName        = \"v8\"\n+\tLogPrefix           = \"[netflow-v8] \"\n+\tProtocolID   uint16 = 8\n+)\n+\n+// AggType is an enumeration type for Netflow V8 aggregations.\n+// See https://www.cisco.com/c/en/us/td/docs/net_mgmt/netflow_collection_engine/3-6/user/guide/format.html\n+type AggType uint8\n+\n+const (\n+\tRouterAS AggType = iota + 1\n+\tRouterProtoPort\n+\tRouterSrcPrefix\n+\tRouterDstPrefix\n+\tRouterPrefix\n+\tDestOnly\n+\tSrcDst\n+\tFullFlow\n+\tTosAS\n+\tTosProtoPort\n+\tTosSrcPrefix\n+\tTosDstPrefix\n+\tTosPrefix\n+\tPrePortProtocol\n+)\n+\n+var templates = map[AggType]*template.Template{\n+\tRouterAS: {\n+\t\tFields: []template.FieldTemplate{\n+\t\t\t//  observedFlowTotalCount\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"deltaFlowCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"packetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"octetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowStartSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowEndSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"bgpSourceAsNumber\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"bgpDestinationAsNumber\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"ingressInterface\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"egressInterface\", Decoder: fields.Unsigned32}},\n+\t\t},\n+\t\tLength: 28,\n+\t},\n+\tRouterProtoPort: {\n+\t\tFields: []template.FieldTemplate{\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"deltaFlowCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"packetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"octetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowStartSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowEndSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"protocolIdentifier\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 3},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"sourceTransportPort\", Decoder: fields.Unsigned16}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"destinationTransportPort\", Decoder: fields.Unsigned16}},\n+\t\t},\n+\t\tLength: 28,\n+\t},\n+\tRouterDstPrefix: {\n+\t\tFields: []template.FieldTemplate{\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"deltaFlowCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"packetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"octetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowStartSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowEndSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"destinationIPv4Prefix\", Decoder: fields.Ipv4Address}},\n+\t\t\t{Length: 2},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"bgpDestinationAsNumber\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"egressInterface\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2},\n+\t\t},\n+\t\tLength: 32,\n+\t},\n+\tRouterSrcPrefix: {\n+\t\tFields: []template.FieldTemplate{\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"deltaFlowCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"packetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"octetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowStartSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowEndSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"sourceIPv4Prefix\", Decoder: fields.Ipv4Address}},\n+\t\t\t{Length: 2},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"bgpSourceAsNumber\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"ingressInterface\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2},\n+\t\t},\n+\t\tLength: 32,\n+\t},\n+\tRouterPrefix: {\n+\t\tFields: []template.FieldTemplate{\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"deltaFlowCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"packetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"octetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowStartSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowEndSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"sourceIPv4Prefix\", Decoder: fields.Ipv4Address}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"destinationIPv4Prefix\", Decoder: fields.Ipv4Address}},\n+\t\t\t{Length: 4},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"bgpSourceAsNumber\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"bgpDestinationAsNumber\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"ingressInterface\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"egressInterface\", Decoder: fields.Unsigned32}},\n+\t\t},\n+\t\tLength: 40,\n+\t},\n+\tTosAS: {\n+\t\tFields: []template.FieldTemplate{\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"deltaFlowCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"packetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"octetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowStartSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowEndSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"bgpSourceAsNumber\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"bgpDestinationAsNumber\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"ingressInterface\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"egressInterface\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"ipClassOfService\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 3},\n+\t\t},\n+\t\tLength: 32,\n+\t},\n+\tTosProtoPort: {\n+\t\tFields: []template.FieldTemplate{\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"deltaFlowCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"packetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"octetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowStartSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowEndSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"protocolIdentifier\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"ipClassOfService\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 2},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"sourceTransportPort\", Decoder: fields.Unsigned16}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"destinationTransportPort\", Decoder: fields.Unsigned16}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"ingressInterface\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"egressInterface\", Decoder: fields.Unsigned32}},\n+\t\t},\n+\t\tLength: 32,\n+\t},\n+\tPrePortProtocol: {\n+\t\tFields: []template.FieldTemplate{\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"deltaFlowCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"packetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"octetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowStartSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowEndSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"sourceIPv4Prefix\", Decoder: fields.Ipv4Address}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"destinationIPv4Prefix\", Decoder: fields.Ipv4Address}},\n+\t\t\t// Warning: according to CISCO docs, this is reversed (dest, src)\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"destinationIPv4PrefixLength\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"sourceIPv4PrefixLength\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"ipClassOfService\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"protocolIdentifier\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"sourceTransportPort\", Decoder: fields.Unsigned16}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"destinationTransportPort\", Decoder: fields.Unsigned16}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"ingressInterface\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"egressInterface\", Decoder: fields.Unsigned32}},\n+\t\t},\n+\t\tLength: 40,\n+\t},\n+\tTosSrcPrefix: {\n+\t\tFields: []template.FieldTemplate{\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"deltaFlowCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"packetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"octetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowStartSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowEndSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"sourceIPv4Prefix\", Decoder: fields.Ipv4Address}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"sourceIPv4PrefixLength\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"ipClassOfService\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"bgpSourceAsNumber\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"ingressInterface\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2},\n+\t\t},\n+\t\tLength: 32,\n+\t},\n+\tTosDstPrefix: {\n+\t\tFields: []template.FieldTemplate{\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"deltaFlowCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"packetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"octetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowStartSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowEndSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"destinationIPv4Prefix\", Decoder: fields.Ipv4Address}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"destinationIPv4PrefixLength\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"ipClassOfService\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"bgpDestinationAsNumber\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"egressInterface\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2},\n+\t\t},\n+\t\tLength: 32,\n+\t},\n+\tTosPrefix: {\n+\t\tFields: []template.FieldTemplate{\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"deltaFlowCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"packetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"octetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowStartSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowEndSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"sourceIPv4Prefix\", Decoder: fields.Ipv4Address}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"destinationIPv4Prefix\", Decoder: fields.Ipv4Address}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"destinationIPv4PrefixLength\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"sourceIPv4PrefixLength\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"ipClassOfService\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 1},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"bgpSourceAsNumber\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"bgpDestinationAsNumber\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"ingressInterface\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"egressInterface\", Decoder: fields.Unsigned32}},\n+\t\t},\n+\t\tLength: 40,\n+\t},\n+\tDestOnly: {\n+\t\tFields: []template.FieldTemplate{\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"destinationIPv4Address\", Decoder: fields.Ipv4Address}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"packetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"octetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowStartSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowEndSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"egressInterface\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"ipClassOfService\", Decoder: fields.Unsigned8}},\n+\t\t\t// Warning: This is documented as \"marked_tos: Type of Service of the packets that exceeded the contract\"\n+\t\t\t//          but I can't find a V9 field for it.\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"postIpClassOfService\", Decoder: fields.Unsigned8}},\n+\t\t\t// Warning: This is documented as \"extraPkts: Packets that exceeded the contract\"\n+\t\t\t//          but I can't find a V9 field for it.\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"droppedPacketDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"ipv4RouterSc\", Decoder: fields.Ipv4Address}},\n+\t\t},\n+\t\tLength: 32,\n+\t},\n+\tSrcDst: {\n+\t\tFields: []template.FieldTemplate{\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"destinationIPv4Address\", Decoder: fields.Ipv4Address}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"sourceIPv4Address\", Decoder: fields.Ipv4Address}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"packetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"octetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowStartSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowEndSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"egressInterface\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"ingressInterface\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"ipClassOfService\", Decoder: fields.Unsigned8}},\n+\t\t\t// Warning: This is documented as \"marked_tos: Type of Service of the packets that exceeded the contract\"\n+\t\t\t//          but I can't find a V9 field for it.\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"postIpClassOfService\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 2}, // Padding\n+\t\t\t// Warning: This is documented as \"extraPkts: Packets that exceeded the contract\"\n+\t\t\t//          but I can't find a V9 field for it.\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"droppedPacketDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"ipv4RouterSc\", Decoder: fields.Ipv4Address}},\n+\t\t},\n+\t\tLength: 40,\n+\t},\n+\tFullFlow: {\n+\t\tFields: []template.FieldTemplate{\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"destinationIPv4Address\", Decoder: fields.Ipv4Address}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"sourceIPv4Address\", Decoder: fields.Ipv4Address}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"destinationTransportPort\", Decoder: fields.Unsigned16}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"sourceTransportPort\", Decoder: fields.Unsigned16}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"packetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"octetDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowStartSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"flowEndSysUpTime\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"egressInterface\", Decoder: fields.Unsigned32}},\n+\t\t\t{Length: 2, Info: &fields.Field{Name: \"ingressInterface\", Decoder: fields.Unsigned32}},\n+\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"ipClassOfService\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"protocolIdentifier\", Decoder: fields.Unsigned8}},\n+\t\t\t// Warning: This is documented as \"marked_tos: Type of Service of the packets that exceeded the contract\"\n+\t\t\t//          but I can't find a V9 field for it.\n+\t\t\t{Length: 1, Info: &fields.Field{Name: \"postIpClassOfService\", Decoder: fields.Unsigned8}},\n+\t\t\t{Length: 1}, // Padding\n+\t\t\t// Warning: This is documented as \"extraPkts: Packets that exceeded the contract\"\n+\t\t\t//          but I can't find a V9 field for it.\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"droppedPacketDeltaCount\", Decoder: fields.Unsigned64}},\n+\t\t\t{Length: 4, Info: &fields.Field{Name: \"ipv4RouterSc\", Decoder: fields.Ipv4Address}},\n+\t\t},\n+\t\tLength: 44,\n+\t},\n+}\n+\n+type NetflowV8Protocol struct {\n+\tlogger *log.Logger\n+}\n+\n+func init() {\n+\tprotocol.Registry.Register(ProtocolName, New)\n+}\n+\n+func New(config config.Config) protocol.Protocol {","path":"x-pack/filebeat/input/netflow/decoder/v8/v8.go","position":312,"original_position":312,"commit_id":"b9c3ae183c5d850ebf7603070860e6d38007be9d","original_commit_id":"b9c3ae183c5d850ebf7603070860e6d38007be9d","user":{"login":"houndci-bot","id":6697940,"node_id":"MDQ6VXNlcjY2OTc5NDA=","avatar_url":"https://avatars0.githubusercontent.com/u/6697940?v=4","gravatar_id":"","url":"https://api.github.com/users/houndci-bot","html_url":"https://github.com/houndci-bot","followers_url":"https://api.github.com/users/houndci-bot/followers","following_url":"https://api.github.com/users/houndci-bot/following{/other_user}","gists_url":"https://api.github.com/users/houndci-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/houndci-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/houndci-bot/subscriptions","organizations_url":"https://api.github.com/users/houndci-bot/orgs","repos_url":"https://api.github.com/users/houndci-bot/repos","events_url":"https://api.github.com/users/houndci-bot/events{/privacy}","received_events_url":"https://api.github.com/users/houndci-bot/received_events","type":"User","site_admin":false},"body":"exported function New should have comment or be unexported","created_at":"2018-12-04T08:54:06Z","updated_at":"2018-12-04T08:54:07Z","html_url":"https://github.com/elastic/beats/pull/9365#discussion_r238572066","pull_request_url":"https://api.github.com/repos/elastic/beats/pulls/9365","author_association":"NONE","_links":{"self":{"href":"https://api.github.com/repos/elastic/beats/pulls/comments/238572066"},"html":{"href":"https://github.com/elastic/beats/pull/9365#discussion_r238572066"},"pull_request":{"href":"https://api.github.com/repos/elastic/beats/pulls/9365"}}},"pull_request":{"url":"https://api.github.com/repos/elastic/beats/pulls/9365","id":235608758,"node_id":"MDExOlB1bGxSZXF1ZXN0MjM1NjA4NzU4","html_url":"https://github.com/elastic/beats/pull/9365","diff_url":"https://github.com/elastic/beats/pull/9365.diff","patch_url":"https://github.com/elastic/beats/pull/9365.patch","issue_url":"https://api.github.com/repos/elastic/beats/issues/9365","number":9365,"state":"open","locked":false,"title":"NetFlow input for filebeat","user":{"login":"adriansr","id":15056957,"node_id":"MDQ6VXNlcjE1MDU2OTU3","avatar_url":"https://avatars1.githubusercontent.com/u/15056957?v=4","gravatar_id":"","url":"https://api.github.com/users/adriansr","html_url":"https://github.com/adriansr","followers_url":"https://api.github.com/users/adriansr/followers","following_url":"https://api.github.com/users/adriansr/following{/other_user}","gists_url":"https://api.github.com/users/adriansr/gists{/gist_id}","starred_url":"https://api.github.com/users/adriansr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adriansr/subscriptions","organizations_url":"https://api.github.com/users/adriansr/orgs","repos_url":"https://api.github.com/users/adriansr/repos","events_url":"https://api.github.com/users/adriansr/events{/privacy}","received_events_url":"https://api.github.com/users/adriansr/received_events","type":"User","site_admin":false},"body":"This adds a netflow input to Elastic licensed filebeat.\r\n\r\nIt supports NetFlow v1, v5, v6, v7, v8, v9 and IPFIX.\r\n\r\n","created_at":"2018-12-03T22:05:38Z","updated_at":"2018-12-04T08:54:06Z","closed_at":null,"merged_at":null,"merge_commit_sha":"eef225ef03641af9902a3f8c5f514a01f0f68f1b","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":294278645,"node_id":"MDU6TGFiZWwyOTQyNzg2NDU=","url":"https://api.github.com/repos/elastic/beats/labels/Filebeat","name":"Filebeat","color":"008000","default":false},{"id":1096959716,"node_id":"MDU6TGFiZWwxMDk2OTU5NzE2","url":"https://api.github.com/repos/elastic/beats/labels/SecOps","name":"SecOps","color":"1d76db","default":false},{"id":216798909,"node_id":"MDU6TGFiZWwyMTY3OTg5MDk=","url":"https://api.github.com/repos/elastic/beats/labels/in%20progress","name":"in progress","color":"207de5","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/elastic/beats/pulls/9365/commits","review_comments_url":"https://api.github.com/repos/elastic/beats/pulls/9365/comments","review_comment_url":"https://api.github.com/repos/elastic/beats/pulls/comments{/number}","comments_url":"https://api.github.com/repos/elastic/beats/issues/9365/comments","statuses_url":"https://api.github.com/repos/elastic/beats/statuses/b9c3ae183c5d850ebf7603070860e6d38007be9d","head":{"label":"adriansr:netflow","ref":"netflow","sha":"b9c3ae183c5d850ebf7603070860e6d38007be9d","user":{"login":"adriansr","id":15056957,"node_id":"MDQ6VXNlcjE1MDU2OTU3","avatar_url":"https://avatars1.githubusercontent.com/u/15056957?v=4","gravatar_id":"","url":"https://api.github.com/users/adriansr","html_url":"https://github.com/adriansr","followers_url":"https://api.github.com/users/adriansr/followers","following_url":"https://api.github.com/users/adriansr/following{/other_user}","gists_url":"https://api.github.com/users/adriansr/gists{/gist_id}","starred_url":"https://api.github.com/users/adriansr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adriansr/subscriptions","organizations_url":"https://api.github.com/users/adriansr/orgs","repos_url":"https://api.github.com/users/adriansr/repos","events_url":"https://api.github.com/users/adriansr/events{/privacy}","received_events_url":"https://api.github.com/users/adriansr/received_events","type":"User","site_admin":false},"repo":{"id":107399581,"node_id":"MDEwOlJlcG9zaXRvcnkxMDczOTk1ODE=","name":"beats","full_name":"adriansr/beats","private":false,"owner":{"login":"adriansr","id":15056957,"node_id":"MDQ6VXNlcjE1MDU2OTU3","avatar_url":"https://avatars1.githubusercontent.com/u/15056957?v=4","gravatar_id":"","url":"https://api.github.com/users/adriansr","html_url":"https://github.com/adriansr","followers_url":"https://api.github.com/users/adriansr/followers","following_url":"https://api.github.com/users/adriansr/following{/other_user}","gists_url":"https://api.github.com/users/adriansr/gists{/gist_id}","starred_url":"https://api.github.com/users/adriansr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adriansr/subscriptions","organizations_url":"https://api.github.com/users/adriansr/orgs","repos_url":"https://api.github.com/users/adriansr/repos","events_url":"https://api.github.com/users/adriansr/events{/privacy}","received_events_url":"https://api.github.com/users/adriansr/received_events","type":"User","site_admin":false},"html_url":"https://github.com/adriansr/beats","description":":tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash ","fork":true,"url":"https://api.github.com/repos/adriansr/beats","forks_url":"https://api.github.com/repos/adriansr/beats/forks","keys_url":"https://api.github.com/repos/adriansr/beats/keys{/key_id}","collaborators_url":"https://api.github.com/repos/adriansr/beats/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/adriansr/beats/teams","hooks_url":"https://api.github.com/repos/adriansr/beats/hooks","issue_events_url":"https://api.github.com/repos/adriansr/beats/issues/events{/number}","events_url":"https://api.github.com/repos/adriansr/beats/events","assignees_url":"https://api.github.com/repos/adriansr/beats/assignees{/user}","branches_url":"https://api.github.com/repos/adriansr/beats/branches{/branch}","tags_url":"https://api.github.com/repos/adriansr/beats/tags","blobs_url":"https://api.github.com/repos/adriansr/beats/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/adriansr/beats/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/adriansr/beats/git/refs{/sha}","trees_url":"https://api.github.com/repos/adriansr/beats/git/trees{/sha}","statuses_url":"https://api.github.com/repos/adriansr/beats/statuses/{sha}","languages_url":"https://api.github.com/repos/adriansr/beats/languages","stargazers_url":"https://api.github.com/repos/adriansr/beats/stargazers","contributors_url":"https://api.github.com/repos/adriansr/beats/contributors","subscribers_url":"https://api.github.com/repos/adriansr/beats/subscribers","subscription_url":"https://api.github.com/repos/adriansr/beats/subscription","commits_url":"https://api.github.com/repos/adriansr/beats/commits{/sha}","git_commits_url":"https://api.github.com/repos/adriansr/beats/git/commits{/sha}","comments_url":"https://api.github.com/repos/adriansr/beats/comments{/number}","issue_comment_url":"https://api.github.com/repos/adriansr/beats/issues/comments{/number}","contents_url":"https://api.github.com/repos/adriansr/beats/contents/{+path}","compare_url":"https://api.github.com/repos/adriansr/beats/compare/{base}...{head}","merges_url":"https://api.github.com/repos/adriansr/beats/merges","archive_url":"https://api.github.com/repos/adriansr/beats/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/adriansr/beats/downloads","issues_url":"https://api.github.com/repos/adriansr/beats/issues{/number}","pulls_url":"https://api.github.com/repos/adriansr/beats/pulls{/number}","milestones_url":"https://api.github.com/repos/adriansr/beats/milestones{/number}","notifications_url":"https://api.github.com/repos/adriansr/beats/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/adriansr/beats/labels{/name}","releases_url":"https://api.github.com/repos/adriansr/beats/releases{/id}","deployments_url":"https://api.github.com/repos/adriansr/beats/deployments","created_at":"2017-10-18T11:36:46Z","updated_at":"2018-09-21T09:28:43Z","pushed_at":"2018-12-04T08:53:31Z","git_url":"git://github.com/adriansr/beats.git","ssh_url":"git@github.com:adriansr/beats.git","clone_url":"https://github.com/adriansr/beats.git","svn_url":"https://github.com/adriansr/beats","homepage":"https://www.elastic.co/products/beats","size":100944,"stargazers_count":1,"watchers_count":1,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":0,"watchers":1,"default_branch":"master"}},"base":{"label":"elastic:master","ref":"master","sha":"a4b06ae0f035889416ceb0df0b552ec3c573ca1a","user":{"login":"elastic","id":6764390,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY3NjQzOTA=","avatar_url":"https://avatars0.githubusercontent.com/u/6764390?v=4","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"repo":{"id":16554739,"node_id":"MDEwOlJlcG9zaXRvcnkxNjU1NDczOQ==","name":"beats","full_name":"elastic/beats","private":false,"owner":{"login":"elastic","id":6764390,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY3NjQzOTA=","avatar_url":"https://avatars0.githubusercontent.com/u/6764390?v=4","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/elastic/beats","description":":tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash ","fork":false,"url":"https://api.github.com/repos/elastic/beats","forks_url":"https://api.github.com/repos/elastic/beats/forks","keys_url":"https://api.github.com/repos/elastic/beats/keys{/key_id}","collaborators_url":"https://api.github.com/repos/elastic/beats/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/elastic/beats/teams","hooks_url":"https://api.github.com/repos/elastic/beats/hooks","issue_events_url":"https://api.github.com/repos/elastic/beats/issues/events{/number}","events_url":"https://api.github.com/repos/elastic/beats/events","assignees_url":"https://api.github.com/repos/elastic/beats/assignees{/user}","branches_url":"https://api.github.com/repos/elastic/beats/branches{/branch}","tags_url":"https://api.github.com/repos/elastic/beats/tags","blobs_url":"https://api.github.com/repos/elastic/beats/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/elastic/beats/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/elastic/beats/git/refs{/sha}","trees_url":"https://api.github.com/repos/elastic/beats/git/trees{/sha}","statuses_url":"https://api.github.com/repos/elastic/beats/statuses/{sha}","languages_url":"https://api.github.com/repos/elastic/beats/languages","stargazers_url":"https://api.github.com/repos/elastic/beats/stargazers","contributors_url":"https://api.github.com/repos/elastic/beats/contributors","subscribers_url":"https://api.github.com/repos/elastic/beats/subscribers","subscription_url":"https://api.github.com/repos/elastic/beats/subscription","commits_url":"https://api.github.com/repos/elastic/beats/commits{/sha}","git_commits_url":"https://api.github.com/repos/elastic/beats/git/commits{/sha}","comments_url":"https://api.github.com/repos/elastic/beats/comments{/number}","issue_comment_url":"https://api.github.com/repos/elastic/beats/issues/comments{/number}","contents_url":"https://api.github.com/repos/elastic/beats/contents/{+path}","compare_url":"https://api.github.com/repos/elastic/beats/compare/{base}...{head}","merges_url":"https://api.github.com/repos/elastic/beats/merges","archive_url":"https://api.github.com/repos/elastic/beats/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/elastic/beats/downloads","issues_url":"https://api.github.com/repos/elastic/beats/issues{/number}","pulls_url":"https://api.github.com/repos/elastic/beats/pulls{/number}","milestones_url":"https://api.github.com/repos/elastic/beats/milestones{/number}","notifications_url":"https://api.github.com/repos/elastic/beats/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/elastic/beats/labels{/name}","releases_url":"https://api.github.com/repos/elastic/beats/releases{/id}","deployments_url":"https://api.github.com/repos/elastic/beats/deployments","created_at":"2014-02-05T19:01:02Z","updated_at":"2018-12-04T08:46:18Z","pushed_at":"2018-12-04T08:53:33Z","git_url":"git://github.com/elastic/beats.git","ssh_url":"git@github.com:elastic/beats.git","clone_url":"https://github.com/elastic/beats.git","svn_url":"https://github.com/elastic/beats","homepage":"https://www.elastic.co/products/beats","size":105920,"stargazers_count":6488,"watchers_count":6488,"language":"Go","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":2067,"mirror_url":null,"archived":false,"open_issues_count":1112,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":2067,"open_issues":1112,"watchers":6488,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/elastic/beats/pulls/9365"},"html":{"href":"https://github.com/elastic/beats/pull/9365"},"issue":{"href":"https://api.github.com/repos/elastic/beats/issues/9365"},"comments":{"href":"https://api.github.com/repos/elastic/beats/issues/9365/comments"},"review_comments":{"href":"https://api.github.com/repos/elastic/beats/pulls/9365/comments"},"review_comment":{"href":"https://api.github.com/repos/elastic/beats/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/elastic/beats/pulls/9365/commits"},"statuses":{"href":"https://api.github.com/repos/elastic/beats/statuses/b9c3ae183c5d850ebf7603070860e6d38007be9d"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"houndci-bot"}}