{"action":"created","issue":{"url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/28","labels_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/28/labels{/name}","comments_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/28/comments","events_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/28/events","html_url":"https://github.com/logstash-plugins/logstash-codec-netflow/issues/28","id":113841743,"number":28,"title":"Support for ESXi VDS - ESXi 5.1+","user":{"login":"benlavender","id":11093811,"avatar_url":"https://avatars.githubusercontent.com/u/11093811?v=3","gravatar_id":"","url":"https://api.github.com/users/benlavender","html_url":"https://github.com/benlavender","followers_url":"https://api.github.com/users/benlavender/followers","following_url":"https://api.github.com/users/benlavender/following{/other_user}","gists_url":"https://api.github.com/users/benlavender/gists{/gist_id}","starred_url":"https://api.github.com/users/benlavender/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benlavender/subscriptions","organizations_url":"https://api.github.com/users/benlavender/orgs","repos_url":"https://api.github.com/users/benlavender/repos","events_url":"https://api.github.com/users/benlavender/events{/privacy}","received_events_url":"https://api.github.com/users/benlavender/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-10-28T15:02:54Z","updated_at":"2015-11-08T09:04:21Z","closed_at":null,"body":"Ticket request to support IPFIX for ESXi 5.1 and above. Any NetFlow exports sent from ESXi devices on ESXi 5.1+ now only support IPFIX.\r\n\r\nI have this implemented myself using this plugin including the @bodgit IPFIX support and receive the below in the logstash.log file: \r\n\r\n:message=>\"Unsupported enterprise\", :enterprise=>6876, :level=>:warn}\r\n"},"comment":{"url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/comments/154790281","html_url":"https://github.com/logstash-plugins/logstash-codec-netflow/issues/28#issuecomment-154790281","issue_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/28","id":154790281,"user":{"login":"jorritfolmer","id":11555154,"avatar_url":"https://avatars.githubusercontent.com/u/11555154?v=3","gravatar_id":"","url":"https://api.github.com/users/jorritfolmer","html_url":"https://github.com/jorritfolmer","followers_url":"https://api.github.com/users/jorritfolmer/followers","following_url":"https://api.github.com/users/jorritfolmer/following{/other_user}","gists_url":"https://api.github.com/users/jorritfolmer/gists{/gist_id}","starred_url":"https://api.github.com/users/jorritfolmer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jorritfolmer/subscriptions","organizations_url":"https://api.github.com/users/jorritfolmer/orgs","repos_url":"https://api.github.com/users/jorritfolmer/repos","events_url":"https://api.github.com/users/jorritfolmer/events{/privacy}","received_events_url":"https://api.github.com/users/jorritfolmer/received_events","type":"User","site_admin":false},"created_at":"2015-11-08T09:04:21Z","updated_at":"2015-11-08T09:04:21Z","body":"I created this patch to the `ipfix.yaml` in the @bodgit ipfix branch to support the IPFIX fields exported by a vSphere 5.5 virtual distributed switch I had access to. Since these fields are undocumented, I've simply named them after their enterprise and element id's. Any word from VMware yet on this, @benlavender ?\r\n\r\n```diff\r\ndiff --git a/lib/logstash/codecs/netflow/ipfix.yaml b/lib/logstash/codecs/netflow/ipfix.yaml\r\nindex 70f2829..51ab7c4 100644\r\n--- a/lib/logstash/codecs/netflow/ipfix.yaml\r\n+++ b/lib/logstash/codecs/netflow/ipfix.yaml\r\n@@ -1202,6 +1202,37 @@\r\n   433:\r\n   - :uint64\r\n   - :ignoredLayer2FrameTotalCount\r\n+6876:\r\n+  880:\r\n+  - :uint8\r\n+  - :6876_880\r\n+  881:\r\n+  - :uint32\r\n+  - :6876_881\r\n+  882:\r\n+  - :uint32\r\n+  - :6876_882\r\n+  883:\r\n+  - :string\r\n+  - :6876_883\r\n+  884:\r\n+  - :string\r\n+  - :6876_884\r\n+  886:\r\n+  - :uint16\r\n+  - :6876_886\r\n+  887:\r\n+  - :uint16\r\n+  - :6876_887\r\n+  888:\r\n+  - :uint16\r\n+  - :6876_888\r\n+  889:\r\n+  - :uint8\r\n+  - :6876_889\r\n+  890:\r\n+  - :uint16\r\n+  - :6876_890\r\n 29305:\r\n   1:\r\n   - :uint64\r\n```\r\n\r\nA sample rubydebug output from Logstash looks like this:\r\n\r\n```ruby\r\n{\r\n    \"@timestamp\" => \"2015-11-07T21:47:04.000Z\",\r\n       \"netflow\" => {\r\n                         \"version\" => 10,\r\n               \"sourceIPv4Address\" => \"172.30.11.202\",\r\n          \"destinationIPv4Address\" => \"172.30.11.110\",\r\n                 \"octetDeltaCount\" => 41,\r\n                \"packetDeltaCount\" => 1,\r\n           \"flowStartMilliseconds\" => \"2015-11-07T21:46:50.000Z\",\r\n             \"flowEndMilliseconds\" => \"2015-11-07T21:46:50.000Z\",\r\n             \"sourceTransportPort\" => 1433,\r\n        \"destinationTransportPort\" => 38691,\r\n                \"ingressInterface\" => 202,\r\n                 \"egressInterface\" => 151,\r\n                 \"layer2SegmentId\" => 0,\r\n              \"protocolIdentifier\" => 6,\r\n                   \"flowEndReason\" => 1,\r\n                  \"tcpControlBits\" => 16,\r\n                \"ipClassOfService\" => 0,\r\n                      \"maximumTTL\" => 128,\r\n                   \"flowDirection\" => 1,\r\n                        \"6876_890\" => 1,\r\n                        \"6876_888\" => 2,\r\n                        \"6876_889\" => 0\r\n    },\r\n      \"@version\" => \"1\",\r\n          \"host\" => \"172.16.32.201\"\r\n}\r\n```\r\n"}}