Support up to 7 bytepad for Netflow IPFIX template (elastic#19131) (e…

…lastic#19189) Generate golden file for 7.7 Fixes elastic#18098 (cherry picked from commit 6b28f97)
leweafan · Jun 15, 2020 · a00fe6d · a00fe6d
1 parent 4497a94
commit a00fe6d
Show file tree

Hide file tree

Showing 4 changed files with 391 additions and 1 deletion.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -98,6 +98,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fixing `ingress_controller.` fields to be of type keyword instead of text. {issue}17834[17834]
 - Fixed typo in log message. {pull}17897[17897]
 - Fix `o365` module ignoring `var.api` settings. {pull}18948[18948]
+- Fix `netflow` module to support 7 bytepad for IPFIX template. {issue}18098[18098]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/input/netflow/decoder/v9/decoder.go b/x-pack/filebeat/input/netflow/decoder/v9/decoder.go
@@ -137,7 +137,7 @@ func ReadFields(d Decoder, buf *bytes.Buffer, count int) (record template.Templa
 func ReadTemplateFlowSet(d Decoder, buf *bytes.Buffer) (templates []*template.Template, err error) {
 	var row [4]byte
 	for {
-		if buf.Len() < 4 {
+		if buf.Len() < 8 {
 			return templates, nil
 		}
 		if n, err := buf.Read(row[:]); err != nil || n != len(row) {