elastic / elastic/integrations
[NetFlow]: Wrong timestamp
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
### Integration Name
NetFlow Records [netflow]
### Dataset Name
netflow.log
### Integration Version
2.23.0
### Agent Version
8.18.1
### Agent Output Type
elasticsearch
### Elasticsearch Version
8.18.1
### OS Version and Architecture
Debian GNU/Linux 12 (bookworm)
### Software/API Version
_No response_
### Error Message
I'm using `nfreplay -r file.nfcapd.202505261425 -p 2055` to send the data to elastic-agent on port 2055.
The data are ingested but the timestamp field is getting the 'net flow.exporter.timestamp' as @timestamp.
The elastic field @timestamp is:
@timestamp May 25, 2025 @ 14:25:00.000
But the event is generated 1 day after the netflow.exporter.timestamp (I don't know where is field is added.
How to fix the Netflow integration to use the netflow.flow_start_milliseconds field like the @timestamp.
### Event Original
event.created May 26, 2025 @ 14:30:41.468
event.ingested May 26, 2025 @ 14:30:51.000
netflow.exporter.timestamp May 25, 2025 @ 14:25:00.000
netflow.flow_end_milliseconds May 26, 2025 @ 14:29:59.992
netflow.flow_start_milliseconds May 26, 2025 @ 14:29:59.992
### What did you do?
The netflow integration is only the UDP host to listen on 0.0.0.0 and the UDP port to listen on 2055.
### What did you see?
@timestamp May 25, 2025 @ 14:25:00.000
### What did you expect to see?
@timestamp May 26, 2025 @ 14:29:59.992
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.