search

logstash-plugins / logstash-codec-netflow

Apache License 2.0
79 stars 88 forks source link

Support for ESXi 6.7+ & NSX 6.4+ #189

Open Aqualie opened 4 years ago

Aqualie commented 4 years ago

Running Logstash 7.5 I've updated the ipfix.yaml to include all the latest ids:

--- ipfix.yaml  2019-11-26 03:03:02.000000000 -0500
+++ /mnt/c/logstash-7.5.0/conf.d/ipfix.yaml     2019-12-15 12:54:11.028935000 -0500
@@ -2481,6 +2481,45 @@
   890:
   - :uint16
   - :vmwareIngressInterfaceAttr
+  898:
+  - :string
+  - :vmwareVirtualObsId
+  950:
+  - :uint32
+  - :vmwareRuleId
+  951:
+  - :string
+  - :vmwareVmUuid
+  952:
+  - :unit32
+  - :vmwareVnicIndex
+  953:
+  - :uint8
+  - :vmwareSessionFlags
+  954:
+  - :unit8
+  - :vmwareFlowDirection
+  955:
+  - :unit64
+  - :vmwareAlgControlFlowId
+  956:
+  - :unit8
+  - :vmwareAlgType
+  957:
+  - :unit8
+  - :vmwareAlgFlowtype
+  958:
+  - :unit32
+  - :vmwareAverageLatency
+  959:
+  - :unit32
+  - :vmwareRetransmissionCount
+  960:
+  - :octetarray
+  - :vmwareVifUuid
+  961:
+  - :string
+  - :vmwareVifId

Source: https://docs.vmware.com/en/VMware-NSX-T-Data-Center/2.4/administration/GUID-F7304386-EFAE-4479-9E3B-251519969D4C.html

Problem I'm having is is the input worker is having some error when VMWare sends the template information not sure why...

[2019-12-15T13:01:18,039][ERROR][logstash.inputs.udp      ][main] Exception in inputworker {"exception"=>java.lang.ClassCastException: org.jruby.gen.RubyObject4 cannot be cast to org.jruby.RubyFixnum, "backtrace"=>["org.jruby.runtime.invokedynamic.MathLinker.fixnum_op_minus(MathLinker.java:221)", "java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:627)", "org.jruby.runtime.invokedynamic.MathLinker.fixnumOperator(MathLinker.java:171)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_codec_minus_netflow_minus_4_dot_2_dot_1.lib.logstash.codecs.netflow.util.RUBY$block$IpfixTemplateFlowset$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/logstash-codec-netflow-4.2.1/lib/logstash/codecs/netflow/util.rb:432)", "org.jruby.runtime.CompiledIRBlockBody.yieldDirect(CompiledIRBlockBody.java:146)", "org.jruby.runtime.MixedModeIRBlockBody.yieldDirect(MixedModeIRBlockBody.java:124)", "org.jruby.runtime.BlockBody.yield(BlockBody.java:122)", "org.jruby.runtime.Block.yieldArray(Block.java:182)", "org.jruby.RubyBasicObject.yieldUnder(RubyBasicObject.java:1767)", "org.jruby.RubyBasicObject.instance_exec(RubyBasicObject.java:2680)", "org.jruby.RubyBasicObject$INVOKER$i$0$3$instance_exec.call(RubyBasicObject$INVOKER$i$0$3$instance_exec.gen)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:223)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:230)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.lazy.RUBY$method$lazy_eval$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/lazy.rb:33)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:91)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:127)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:189)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:276)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.base.RUBY$method$eval_parameter$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/base.rb:113)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:91)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:127)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:189)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:265)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.array.RUBY$block$do_read$1(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/array.rb:299)", "org.jruby.runtime.CompiledIRBlockBody.yieldDirect(CompiledIRBlockBody.java:146)", "org.jruby.runtime.IRBlockBody.yieldSpecific(IRBlockBody.java:85)", "org.jruby.runtime.Block.yieldSpecific(Block.java:139)", "org.jruby.RubyKernel.loop(RubyKernel.java:1425)", "org.jruby.RubyKernel$INVOKER$s$0$0$loop.call(RubyKernel$INVOKER$s$0$0$loop.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodZeroBlock.call(JavaMethod.java:555)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:223)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:230)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.array.RUBY$method$do_read$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/array.rb:295)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:117)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:156)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:253)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.struct.RUBY$block$do_read$1(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/struct.rb:139)", "org.jruby.runtime.CompiledIRBlockBody.yieldDirect(CompiledIRBlockBody.java:146)", "org.jruby.runtime.BlockBody.yield(BlockBody.java:114)", "org.jruby.runtime.Block.yield(Block.java:170)", "org.jruby.RubyArray.each(RubyArray.java:1800)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.struct.RUBY$method$do_read$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/struct.rb:139)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.struct.RUBY$method$do_read$0$__VARARGS__(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/struct.rb)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:91)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:90)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:183)", "$_28_eval_29_.RUBY$method$do_read$0((eval):2)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:91)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:114)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:156)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:253)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.struct.RUBY$block$do_read$1(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/struct.rb:139)", "org.jruby.runtime.CompiledIRBlockBody.yieldDirect(CompiledIRBlockBody.java:146)", "org.jruby.runtime.BlockBody.yield(BlockBody.java:114)", "org.jruby.runtime.Block.yield(Block.java:170)", "org.jruby.RubyArray.each(RubyArray.java:1800)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.struct.RUBY$method$do_read$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/struct.rb:139)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:117)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:156)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:253)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.array.RUBY$block$do_read$1(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/array.rb:297)", "org.jruby.runtime.CompiledIRBlockBody.yieldDirect(CompiledIRBlockBody.java:146)", "org.jruby.runtime.IRBlockBody.yieldSpecific(IRBlockBody.java:85)", "org.jruby.runtime.Block.yieldSpecific(Block.java:139)", "org.jruby.RubyKernel.loop(RubyKernel.java:1425)", "org.jruby.RubyKernel$INVOKER$s$0$0$loop.call(RubyKernel$INVOKER$s$0$0$loop.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodZeroBlock.call(JavaMethod.java:555)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:223)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:230)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.array.RUBY$method$do_read$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/array.rb:295)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:117)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:156)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:253)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.struct.RUBY$block$do_read$1(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/struct.rb:139)", "org.jruby.runtime.CompiledIRBlockBody.yieldDirect(CompiledIRBlockBody.java:146)", "org.jruby.runtime.BlockBody.yield(BlockBody.java:114)", "org.jruby.runtime.Block.yield(Block.java:170)", "org.jruby.RubyArray.each(RubyArray.java:1800)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.struct.RUBY$method$do_read$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/struct.rb:139)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:117)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:156)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:253)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.base.RUBY$block$read$1(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/base.rb:147)", "org.jruby.runtime.CompiledIRBlockBody.yieldDirect(CompiledIRBlockBody.java:146)", "org.jruby.runtime.IRBlockBody.yieldSpecific(IRBlockBody.java:85)", "org.jruby.runtime.Block.yieldSpecific(Block.java:139)", "org.jruby.ir.targets.YieldSite.yieldSpecific(YieldSite.java:141)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.base.RUBY$method$start_read$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/base.rb:254)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.base.RUBY$method$start_read$0$__VARARGS__(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/base.rb)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:91)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:90)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:223)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:230)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.base.RUBY$method$read$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/base.rb:145)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:117)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:156)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:253)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.base.RUBY$method$read$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/base.rb:21)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_codec_minus_netflow_minus_4_dot_2_dot_1.lib.logstash.codecs.netflow.RUBY$method$decode$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/logstash-codec-netflow-4.2.1/lib/logstash/codecs/netflow.rb:103)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_udp_minus_3_dot_3_dot_4.lib.logstash.inputs.udp.RUBY$method$inputworker$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/logstash-input-udp-3.3.4/lib/logstash/inputs/udp.rb:151)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_udp_minus_3_dot_3_dot_4.lib.logstash.inputs.udp.RUBY$method$inputworker$0$__VARARGS__(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/logstash-input-udp-3.3.4/lib/logstash/inputs/udp.rb)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:91)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:90)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:183)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_udp_minus_3_dot_3_dot_4.lib.logstash.inputs.udp.RUBY$block$run$2(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/logstash-input-udp-3.3.4/lib/logstash/inputs/udp.rb:63)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:136)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:77)", "org.jruby.runtime.Block.call(Block.java:129)", "org.jruby.RubyProc.call(RubyProc.java:295)", "org.jruby.RubyProc.call(RubyProc.java:274)", "org.jruby.RubyProc.call(RubyProc.java:270)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)", "java.lang.Thread.run(Thread.java:748)"]}
[2019-12-15T13:01:25,015][ERROR][logstash.inputs.udp      ][main] Exception in inputworker {"exception"=>java.lang.ClassCastException: org.jruby.gen.RubyObject4 cannot be cast to org.jruby.RubyFixnum, "backtrace"=>["org.jruby.runtime.invokedynamic.MathLinker.fixnum_op_equal(MathLinker.java:237)", "java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:627)", "org.jruby.runtime.invokedynamic.MathLinker.fixnumOperator(MathLinker.java:171)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_codec_minus_netflow_minus_4_dot_2_dot_1.lib.logstash.codecs.netflow.RUBY$block$decode_ipfix$2(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/logstash-codec-netflow-4.2.1/lib/logstash/codecs/netflow.rb:293)", "org.jruby.runtime.CompiledIRBlockBody.yieldDirect(CompiledIRBlockBody.java:146)", "org.jruby.runtime.BlockBody.yield(BlockBody.java:114)", "org.jruby.runtime.Block.yield(Block.java:170)", "org.jruby.exceptions.CatchThrow.enter(CatchThrow.java:32)", "org.jruby.RubyKernel.rbCatch19Common(RubyKernel.java:1197)", "org.jruby.RubyKernel.rbCatch19(RubyKernel.java:1193)", "org.jruby.RubyKernel$INVOKER$s$rbCatch19.call(RubyKernel$INVOKER$s$rbCatch19.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodZeroOrOneBlock.call(JavaMethod.java:577)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:177)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_codec_minus_netflow_minus_4_dot_2_dot_1.lib.logstash.codecs.netflow.RUBY$block$decode_ipfix$1(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/logstash-codec-netflow-4.2.1/lib/logstash/codecs/netflow.rb:290)", "org.jruby.runtime.CompiledIRBlockBody.yieldDirect(CompiledIRBlockBody.java:146)", "org.jruby.runtime.BlockBody.yield(BlockBody.java:114)", "org.jruby.runtime.Block.yield(Block.java:170)", "org.jruby.ir.runtime.IRRuntimeHelpers.yield(IRRuntimeHelpers.java:477)", "org.jruby.ir.targets.YieldSite.yield(YieldSite.java:105)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.array.RUBY$block$each$1(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/array.rb:208)", "org.jruby.runtime.CompiledIRBlockBody.yieldDirect(CompiledIRBlockBody.java:146)", "org.jruby.runtime.BlockBody.yield(BlockBody.java:114)", "org.jruby.runtime.Block.yield(Block.java:170)", "org.jruby.RubyArray.each(RubyArray.java:1800)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.array.RUBY$method$each$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/array.rb:208)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.array.RUBY$method$each$0$__VARARGS__(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/array.rb)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:91)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:90)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:177)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_codec_minus_netflow_minus_4_dot_2_dot_1.lib.logstash.codecs.netflow.RUBY$method$decode_ipfix$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/logstash-codec-netflow-4.2.1/lib/logstash/codecs/netflow.rb:289)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_codec_minus_netflow_minus_4_dot_2_dot_1.lib.logstash.codecs.netflow.RUBY$block$decode$5(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/logstash-codec-netflow-4.2.1/lib/logstash/codecs/netflow.rb:105)", "org.jruby.runtime.CompiledIRBlockBody.yieldDirect(CompiledIRBlockBody.java:146)", "org.jruby.runtime.BlockBody.yield(BlockBody.java:114)", "org.jruby.runtime.Block.yield(Block.java:170)", "org.jruby.ir.runtime.IRRuntimeHelpers.yield(IRRuntimeHelpers.java:477)", "org.jruby.ir.targets.YieldSite.yield(YieldSite.java:105)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.array.RUBY$block$each$1(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/array.rb:208)", "org.jruby.runtime.CompiledIRBlockBody.yieldDirect(CompiledIRBlockBody.java:146)", "org.jruby.runtime.BlockBody.yield(BlockBody.java:114)", "org.jruby.runtime.Block.yield(Block.java:170)", "org.jruby.RubyArray.each(RubyArray.java:1800)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.array.RUBY$method$each$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/array.rb:208)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.bindata_minus_2_dot_4_dot_4.lib.bindata.array.RUBY$method$each$0$__VARARGS__(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/bindata-2.4.4/lib/bindata/array.rb)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:91)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:90)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:223)", "org.jruby.ir.targets.InvokeSite.fail(InvokeSite.java:230)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_codec_minus_netflow_minus_4_dot_2_dot_1.lib.logstash.codecs.netflow.RUBY$method$decode$0(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/logstash-codec-netflow-4.2.1/lib/logstash/codecs/netflow.rb:104)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:91)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:114)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:156)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:182)", "org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:191)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:337)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.ir.interpreter.InterpreterEngine.interpret(InterpreterEngine.java:92)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:204)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:191)", "org.jruby.internal.runtime.methods.DynamicMethod.call(DynamicMethod.java:208)", "C_3a_.logstash_minus_7_dot_5_dot_0.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_udp_minus_3_dot_3_dot_4.lib.logstash.inputs.udp.RUBY$block$run$2(C:/logstash-7.5.0/vendor/bundle/jruby/2.5.0/gems/logstash-input-udp-3.3.4/lib/logstash/inputs/udp.rb:63)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:136)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:77)", "org.jruby.runtime.Block.call(Block.java:129)", "org.jruby.RubyProc.call(RubyProc.java:295)", "org.jruby.RubyProc.call(RubyProc.java:274)", "org.jruby.RubyProc.call(RubyProc.java:270)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)", "java.lang.Thread.run(Thread.java:748)"]}

Running config:

input {
  udp {
    id => "netflow_vmware_udp"
    port => 4739
    codec => netflow {
        versions => [10]
        ipfix_definitions => "C:/logstash-7.5.0/conf.d/ipfix.yaml"
    }
  }
}
output {
    stdout { codec => rubydebug }
}
wrightng commented 4 years ago

A number of types are down as unit32 rather than uint32