Support up to 7 bytepad for Netflow IPFIX template (#19131) (#19189)

Generate golden file for 7.7 Fixes #18098 (cherry picked from commit fb94175)
elastic · Jun 15, 2020 · 3c5b8cb · 3c5b8cb
1 parent bb1e840
commit 3c5b8cb
Show file tree

Hide file tree

Showing 4 changed files with 391 additions and 1 deletion.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -98,6 +98,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fixing `ingress_controller.` fields to be of type keyword instead of text. {issue}17834[17834]
 - Fixed typo in log message. {pull}17897[17897]
 - Fix `o365` module ignoring `var.api` settings. {pull}18948[18948]
+- Fix `netflow` module to support 7 bytepad for IPFIX template. {issue}18098[18098]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/input/netflow/decoder/v9/decoder.go b/x-pack/filebeat/input/netflow/decoder/v9/decoder.go
@@ -137,7 +137,7 @@ func ReadFields(d Decoder, buf *bytes.Buffer, count int) (record template.Templa
 func ReadTemplateFlowSet(d Decoder, buf *bytes.Buffer) (templates []*template.Template, err error) {
 	var row [4]byte
 	for {
-		if buf.Len() < 4 {
+		if buf.Len() < 8 {
 			return templates, nil
 		}
 		if n, err := buf.Read(row[:]); err != nil || n != len(row) {