{"action":"created","issue":{"url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/10","labels_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/10/comments","events_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/10/events","html_url":"https://github.com/logstash-plugins/logstash-codec-netflow/pull/10","id":75901142,"number":10,"title":"IPFIX (Netflow v10) support","user":{"login":"bodgit","id":559268,"avatar_url":"https://avatars.githubusercontent.com/u/559268?v=3","gravatar_id":"","url":"https://api.github.com/users/bodgit","html_url":"https://github.com/bodgit","followers_url":"https://api.github.com/users/bodgit/followers","following_url":"https://api.github.com/users/bodgit/following{/other_user}","gists_url":"https://api.github.com/users/bodgit/gists{/gist_id}","starred_url":"https://api.github.com/users/bodgit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bodgit/subscriptions","organizations_url":"https://api.github.com/users/bodgit/orgs","repos_url":"https://api.github.com/users/bodgit/repos","events_url":"https://api.github.com/users/bodgit/events{/privacy}","received_events_url":"https://api.github.com/users/bodgit/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-05-13T08:33:05Z","updated_at":"2015-08-18T14:10:19Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/pulls/10","html_url":"https://github.com/logstash-plugins/logstash-codec-netflow/pull/10","diff_url":"https://github.com/logstash-plugins/logstash-codec-netflow/pull/10.diff","patch_url":"https://github.com/logstash-plugins/logstash-codec-netflow/pull/10.patch"},"body":"I've been meaning to do this for a while however every time I got waylaid the layout of the Logstash source changed and I had to try and rebase my changes. Now the codec is split into its own repository I should be able to get this done :-)\r\n\r\nIPFIX is very similar to Netflow v9 in design however there are some subtle differences:\r\n\r\n1. Netflow and IPFIX often differ in how they indicate structure size within the packets, where one uses field or record count the other tends to use actual bytes so it requires separate BinData records.\r\n2. Field types can optionally be defined under a standard IANA Private Enterprise Number (PEN) rather than every vendor fight over the same flat namespace. Currently I have implemented the implicit PEN 0 for the standard fields as defined by IANA along with the \"reverse\" PEN 29305 defined in RFC 5103.\r\n3. IPFIX defines three complex data types; BasicList, SubTemplateList & SubTemplateMultiList. What makes these more complicated as that they can theoretically be nested and contain one another.\r\n4. IPFIX defines variable-length fields in templates, usually used with the complex types above.\r\n\r\nThis PR is not yet complete so please don't merge yet but I thought I would open it here so people could see it's progress and/or comment."},"comment":{"url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/comments/132222206","html_url":"https://github.com/logstash-plugins/logstash-codec-netflow/pull/10#issuecomment-132222206","issue_url":"https://api.github.com/repos/logstash-plugins/logstash-codec-netflow/issues/10","id":132222206,"user":{"login":"bodgit","id":559268,"avatar_url":"https://avatars.githubusercontent.com/u/559268?v=3","gravatar_id":"","url":"https://api.github.com/users/bodgit","html_url":"https://github.com/bodgit","followers_url":"https://api.github.com/users/bodgit/followers","following_url":"https://api.github.com/users/bodgit/following{/other_user}","gists_url":"https://api.github.com/users/bodgit/gists{/gist_id}","starred_url":"https://api.github.com/users/bodgit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bodgit/subscriptions","organizations_url":"https://api.github.com/users/bodgit/orgs","repos_url":"https://api.github.com/users/bodgit/repos","events_url":"https://api.github.com/users/bodgit/events{/privacy}","received_events_url":"https://api.github.com/users/bodgit/received_events","type":"User","site_admin":false},"created_at":"2015-08-18T14:10:19Z","updated_at":"2015-08-18T14:10:19Z","body":"The tracing is from the BinData gem, just remove the `BinData::trace_reading do ... end` wrapper in `decode()`. There doesn't seem to be an obvious way to conditionally turn that on or off but it's probably useful whilst debugging & testing various new collectors."}}