-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Netflow from untangle has epoc issue with timestamp (1970 date in timestamp) #25011
Comments
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
This issue doesn't have a |
Hello! Do you have some example of the raw logs that are not parsed correctly? |
Hi! We're labeling this issue as |
Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices) |
Looks like similar problem that Fortinet filebeat module had (Timezone parsing error in pipeline of Fortinet module #19010)
Using standard netflow filebeat module and untagle firewall with Netflow V9 format the timestamp in the index looks like:
"timestamp":"1970-01-01T02:50:49.000Z"
Several fields convert correctly several do not:
Working
event.created | Apr 10, 2021 @ 11:30:01.120
event.ingested | Apr 10, 2021 @ 11:30:02.533
Not working
netflow.exporter.timestamp | Dec 31, 1969 @ 20:26:19.000
event.start | Dec 31, 1969 @ 20:20:51.697
event.end | Dec 31, 1969 @ 20:21:16.792
ELK stack Version: 7.12.0
Ubuntu 20.04.2 LTS
Untangle 16
The text was updated successfully, but these errors were encountered: