Logstsah reporting "IPv6 address must be 16 bytes" about elastiflow HOT 6 CLOSED

sorry for reopening the issue - just for clarification. I've managed to find out that the crash is related to a malfunctioning dnssec server. As soon as I changed the external DNS the crashes never happened again.

Just wanted to let you know the problem was NOT related to elastiflow in any kind.

issue can be closed again :)

from elastiflow.

It looks like the DNS filter is complaining about the address being passed to it. Can you look at a packet capture of the flows in question to make sure the address is correctly decoded. You need to find out if the flow is being sent correctly and the codec is at fault, or whether the flow itself is malformed.

from elastiflow.

I could if I would have any clue about what exact flow logstash is complaining about ...
Can I narrow down this somehow?

from elastiflow.

I've managed to find out that it must have somthing to do with the IPFIX field "IPv6 flow label" beeing sent by my miktotik router. As soon as I disable this filed logstash isnt crashing anymore.

What exactly is that filed for? Do I need it and more importantly how can I see the content of the field during the crash?

from elastiflow.

IPv6 Flow Labels are related to a feature of IPv6 which enables a flow to request specific handling by the network devices carrying the traffic. There is no where in ElastiFlow where I do any specific handling of flow labels, so I am wondering if disabling this field is also causing other fields to not be included in the flow.

from elastiflow.

Thanks for the follow up. Much appreciated!

from elastiflow.