Support up to 7 bytepad for Netflow IPFIX template (elastic#19131)

Fixes elastic#18098
leweafan · Jun 15, 2020 · 6b28f97 · 6b28f97
1 parent 94f6061
commit 6b28f97
Show file tree

Hide file tree

Showing 4 changed files with 463 additions and 1 deletion.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -187,6 +187,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Okta module now sets the Elasticsearch `_id` field to the Okta UUID value contained in each system log to minimize the possibility of duplicating events. {pull}18953[18953]
 - Fix improper nesting of session_issuer object in aws cloudtrail fileset. {issue}18894[18894] {pull}18915[18915]
 - Fix `o365` module ignoring `var.api` settings. {pull}18948[18948]
+- Fix `netflow` module to support 7 bytepad for IPFIX template. {issue}18098[18098]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/input/netflow/decoder/v9/decoder.go b/x-pack/filebeat/input/netflow/decoder/v9/decoder.go
@@ -137,7 +137,7 @@ func ReadFields(d Decoder, buf *bytes.Buffer, count int) (record template.Templa
 func ReadTemplateFlowSet(d Decoder, buf *bytes.Buffer) (templates []*template.Template, err error) {
 	var row [4]byte
 	for {
-		if buf.Len() < 4 {
+		if buf.Len() < 8 {
 			return templates, nil
 		}
 		if n, err := buf.Read(row[:]); err != nil || n != len(row) {