{"action":"created","issue":{"url":"https://api.github.com/repos/robcowart/elastiflow/issues/63","repository_url":"https://api.github.com/repos/robcowart/elastiflow","labels_url":"https://api.github.com/repos/robcowart/elastiflow/issues/63/labels{/name}","comments_url":"https://api.github.com/repos/robcowart/elastiflow/issues/63/comments","events_url":"https://api.github.com/repos/robcowart/elastiflow/issues/63/events","html_url":"https://github.com/robcowart/elastiflow/issues/63","id":310464819,"number":63,"title":"{[flow][dst_addr]} is not an IP string literal","user":{"login":"tiotzis73","id":17476923,"avatar_url":"https://avatars0.githubusercontent.com/u/17476923?v=4","gravatar_id":"","url":"https://api.github.com/users/tiotzis73","html_url":"https://github.com/tiotzis73","followers_url":"https://api.github.com/users/tiotzis73/followers","following_url":"https://api.github.com/users/tiotzis73/following{/other_user}","gists_url":"https://api.github.com/users/tiotzis73/gists{/gist_id}","starred_url":"https://api.github.com/users/tiotzis73/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tiotzis73/subscriptions","organizations_url":"https://api.github.com/users/tiotzis73/orgs","repos_url":"https://api.github.com/users/tiotzis73/repos","events_url":"https://api.github.com/users/tiotzis73/events{/privacy}","received_events_url":"https://api.github.com/users/tiotzis73/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-04-02T11:43:21Z","updated_at":"2018-04-02T11:48:48Z","closed_at":null,"author_association":"NONE","body":"Hello,\r\n\r\nI'm trying to use elastiflow to parse jflow IPFIX records exported by a Juniper router, but I have a problem.\r\n\r\nWhen I try to use the netflow type I keep getting the following warning:\r\n\r\n[2018-04-02T07:37:42,387][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>[\"index\", {:_id=>nil, :_index=>\"elastiflow-2018.04.02\", :_type=>\"doc\", :_routing=>nil}, #<LogStash::Event:0xc005308>], :response=>{\"index\"=>{\"_index\"=>\"elastiflow-2018.04.02\", \"_type\"=>\"doc\", \"_id\"=>\"ZgYmhmIBArEl5VHMCLEY\", \"status\"=>400, \"error\"=>{\"type\"=>\"mapper_parsing_exception\", \"reason\"=>\"failed to parse [flow.server_addr]\", \"caused_by\"=>{\"type\"=>\"illegal_argument_exception\", \"reason\"=>\"'%{[flow][dst_addr]}' is not an IP string literal.\"}}}}}\r\n\r\nWhen I try to use the udp IPFIX type I get the following:\r\n\r\n[2018-04-02T07:42:35,235][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>[\"index\", {:_id=>nil, :_index=>\"elastiflow-2018.04.02\", :_type=>\"doc\", :_routing=>nil}, #<LogStash::Event:0x658ad127>], :response=>{\"index\"=>{\"_index\"=>\"elastiflow-2018.04.02\", \"_type\"=>\"doc\", \"_id\"=>\"iAYqhmIBArEl5VHMgPzU\", \"status\"=>400, \"error\"=>{\"type\"=>\"mapper_parsing_exception\", \"reason\"=>\"failed to parse [flow.server_addr]\", \"caused_by\"=>{\"type\"=>\"illegal_argument_exception\", \"reason\"=>\"'%{[flow][src_addr]}' is not an IP string literal.\"}}}}}\r\n\r\nAny ideas?\r\n\r\nThanks in advance,\r\nPantelis"},"comment":{"url":"https://api.github.com/repos/robcowart/elastiflow/issues/comments/377913778","html_url":"https://github.com/robcowart/elastiflow/issues/63#issuecomment-377913778","issue_url":"https://api.github.com/repos/robcowart/elastiflow/issues/63","id":377913778,"user":{"login":"tiotzis73","id":17476923,"avatar_url":"https://avatars0.githubusercontent.com/u/17476923?v=4","gravatar_id":"","url":"https://api.github.com/users/tiotzis73","html_url":"https://github.com/tiotzis73","followers_url":"https://api.github.com/users/tiotzis73/followers","following_url":"https://api.github.com/users/tiotzis73/following{/other_user}","gists_url":"https://api.github.com/users/tiotzis73/gists{/gist_id}","starred_url":"https://api.github.com/users/tiotzis73/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tiotzis73/subscriptions","organizations_url":"https://api.github.com/users/tiotzis73/orgs","repos_url":"https://api.github.com/users/tiotzis73/repos","events_url":"https://api.github.com/users/tiotzis73/events{/privacy}","received_events_url":"https://api.github.com/users/tiotzis73/received_events","type":"User","site_admin":false},"created_at":"2018-04-02T11:48:48Z","updated_at":"2018-04-02T11:48:48Z","author_association":"NONE","body":"I'm using logstash-codec-netflow (3.11.4) and logstash-codec-sflow (2.0.2)."}}
{"actor":{"display_login":"tiotzis73"}}