logstash-codec-netflow 0.1.5 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0c0d1bab4ccf9556c23efa021fbe4793b0284510
-  data.tar.gz: e8479587a6bb5449a9d8441cc2de89ff3ddd670c
+  metadata.gz: e032fc3de23093eb169875c297a10d3cf47f1bb6
+  data.tar.gz: c168272c6b4b61c0795358f8fc4629aa788720a1
 SHA512:
-  metadata.gz: a04238f6f20d9b27d57c116ea0f0469dec8b92083c40b75302336cdbc7f9a24d8f9fb7ef507d30e1711e693274d1ab1d51022a21c0f53035085f0ab82c0bcd41
-  data.tar.gz: 7455790420b9afa7c6ad4b03d4eef7591ca9d859d4ae6f6dfd3a8c8a02b8af494e5b26bb04dd0675a72cc5517c3144f59c062d468142e7fe1eb6b5e758c3d733
+  metadata.gz: 05316c177d6c74883b70e8a1bff3a027f2a1205a958ab050fa529241472c321bc5bbe9087e629e33d1295cd276431f777b1d8ac3c9d3662ce0ea3a7b7373bce4
+  data.tar.gz: acaf980bd49a558f75c79f522aff5254c2c10714a19376b12274acc8abb12b0ab9398c1a86e2398cfdfa66783c3ead834285def904b4476ee66e33c1d6b254c5

data/lib/logstash/codecs/netflow.rb

@@ -33,13 +33,16 @@ class LogStash::Codecs::Netflow < LogStash::Codecs::Base
   # See <https://github.com/logstash-plugins/logstash-codec-netflow/blob/master/lib/logstash/codecs/netflow/netflow.yaml> for the base set.
   config :definitions, :validate => :path
 
-  public
-  def initialize(params={})
+  NETFLOW5_FIELDS = ['version', 'flow_seq_num', 'engine_type', 'engine_id', 'sampling_algorithm', 'sampling_interval', 'flow_records']
+  NETFLOW9_FIELDS = ['version', 'flow_seq_num']
+  SWITCHED = /_switched$/
+  FLOWSET_ID = "flowset_id"
+
+  def initialize(params = {})
     super(params)
     @threadsafe = false
   end
 
-  public
   def register
     require "logstash/codecs/netflow/util"
     @templates = Vash.new()
@@ -64,7 +67,6 @@ class LogStash::Codecs::Netflow < LogStash::Codecs::Base
     end
   end # def register
 
-  public
   def decode(payload, &block)
     header = Header.read(payload)
 
@@ -75,169 +77,166 @@ class LogStash::Codecs::Netflow < LogStash::Codecs::Base
 
     if header.version == 5
       flowset = Netflow5PDU.read(payload)
+      flowset.records.each do |record|
+        yield(decode_netflow5(flowset, record))
+      end
     elsif header.version == 9
       flowset = Netflow9PDU.read(payload)
+      flowset.records.each do |record|
+        decode_netflow9(flowset, record).each{|event| yield(event)}
+      end
     else
       @logger.warn("Unsupported Netflow version v#{header.version}")
-      return
     end
+  end
 
-    flowset.records.each do |record|
-      if flowset.version == 5
-        event = LogStash::Event.new
+  private
 
-        # FIXME Probably not doing this right WRT JRuby?
-        #
-        # The flowset header gives us the UTC epoch seconds along with
-        # residual nanoseconds so we can set @timestamp to that easily
-        event.timestamp = LogStash::Timestamp.at(flowset.unix_sec, flowset.unix_nsec / 1000)
-        event[@target] = {}
+  def decode_netflow5(flowset, record)
+    event = {
+      LogStash::Event::TIMESTAMP => LogStash::Timestamp.at(flowset.unix_sec.snapshot, flowset.unix_nsec.snapshot / 1000),
+      @target => {}
+    }
 
-        # Copy some of the pertinent fields in the header to the event
-        ['version', 'flow_seq_num', 'engine_type', 'engine_id', 'sampling_algorithm', 'sampling_interval', 'flow_records'].each do |f|
-          event[@target][f] = flowset[f]
-        end
+    # Copy some of the pertinent fields in the header to the event
+    NETFLOW5_FIELDS.each do |f|
+      event[@target][f] = flowset[f].snapshot
+    end
 
-        # Create fields in the event from each field in the flow record
-        record.each_pair do |k,v|
-          case k.to_s
-          when /_switched$/
-            # The flow record sets the first and last times to the device
-            # uptime in milliseconds. Given the actual uptime is provided
-            # in the flowset header along with the epoch seconds we can
-            # convert these into absolute times
-            millis = flowset.uptime - v
-            seconds = flowset.unix_sec - (millis / 1000)
-            micros = (flowset.unix_nsec / 1000) - (millis % 1000)
-            if micros < 0
-              seconds--
-              micros += 1000000
-            end
-            # FIXME Again, probably doing this wrong WRT JRuby?
-            event[@target][k.to_s] = Time.at(seconds, micros).utc.strftime("%Y-%m-%dT%H:%M:%S.%3NZ")
-          else
-            event[@target][k.to_s] = v
-          end
+    # Create fields in the event from each field in the flow record
+    record.each_pair do |k, v|
+      case k.to_s
+      when SWITCHED
+        # The flow record sets the first and last times to the device
+        # uptime in milliseconds. Given the actual uptime is provided
+        # in the flowset header along with the epoch seconds we can
+        # convert these into absolute times
+        millis = flowset.uptime - v
+        seconds = flowset.unix_sec - (millis / 1000)
+        micros = (flowset.unix_nsec / 1000) - (millis % 1000)
+        if micros < 0
+          seconds--
+          micros += 1000000
         end
+        event[@target][k.to_s] = LogStash::Timestamp.at(seconds, micros).to_iso8601
+      else
+        event[@target][k.to_s] = v.snapshot
+      end
+    end
 
-        yield event
-      elsif flowset.version == 9
-        case record.flowset_id
-        when 0
-          # Template flowset
-          record.flowset_data.templates.each do |template|
-            catch (:field) do
-              fields = []
-              template.fields.each do |field|
-                entry = netflow_field_for(field.field_type, field.field_length)
-                if ! entry
-                  throw :field
-                end
-                fields += entry
-              end
-              # We get this far, we have a list of fields
-              #key = "#{flowset.source_id}|#{event["source"]}|#{template.template_id}"
-              key = "#{flowset.source_id}|#{template.template_id}"
-              @templates[key, @cache_ttl] = BinData::Struct.new(:endian => :big, :fields => fields)
-              # Purge any expired templates
-              @templates.cleanup!
-            end
-          end
-        when 1
-          # Options template flowset
-          record.flowset_data.templates.each do |template|
-            catch (:field) do
-              fields = []
-              template.option_fields.each do |field|
-                entry = netflow_field_for(field.field_type, field.field_length)
-                if ! entry
-                  throw :field
-                end
-                fields += entry
-              end
-              # We get this far, we have a list of fields
-              #key = "#{flowset.source_id}|#{event["source"]}|#{template.template_id}"
-              key = "#{flowset.source_id}|#{template.template_id}"
-              @templates[key, @cache_ttl] = BinData::Struct.new(:endian => :big, :fields => fields)
-              # Purge any expired templates
-              @templates.cleanup!
-            end
+    LogStash::Event.new(event)
+  end
+
+  def decode_netflow9(flowset, record)
+    events = []
+
+    case record.flowset_id
+    when 0
+      # Template flowset
+      record.flowset_data.templates.each do |template|
+        catch (:field) do
+          fields = []
+          template.fields.each do |field|
+            entry = netflow_field_for(field.field_type, field.field_length)
+            throw :field unless entry
+            fields += entry
           end
-        when 256..65535
-          # Data flowset
-          #key = "#{flowset.source_id}|#{event["source"]}|#{record.flowset_id}"
-          key = "#{flowset.source_id}|#{record.flowset_id}"
-          template = @templates[key]
-
-          if ! template
-            #@logger.warn("No matching template for flow id #{record.flowset_id} from #{event["source"]}")
-            @logger.warn("No matching template for flow id #{record.flowset_id}")
-            next
+          # We get this far, we have a list of fields
+          #key = "#{flowset.source_id}|#{event["source"]}|#{template.template_id}"
+          key = "#{flowset.source_id}|#{template.template_id}"
+          @templates[key, @cache_ttl] = BinData::Struct.new(:endian => :big, :fields => fields)
+          # Purge any expired templates
+          @templates.cleanup!
+        end
+      end
+    when 1
+      # Options template flowset
+      record.flowset_data.templates.each do |template|
+        catch (:field) do
+          fields = []
+          template.option_fields.each do |field|
+            entry = netflow_field_for(field.field_type, field.field_length)
+            throw :field unless entry
+            fields += entry
           end
+          # We get this far, we have a list of fields
+          #key = "#{flowset.source_id}|#{event["source"]}|#{template.template_id}"
+          key = "#{flowset.source_id}|#{template.template_id}"
+          @templates[key, @cache_ttl] = BinData::Struct.new(:endian => :big, :fields => fields)
+          # Purge any expired templates
+          @templates.cleanup!
+        end
+      end
+    when 256..65535
+      # Data flowset
+      #key = "#{flowset.source_id}|#{event["source"]}|#{record.flowset_id}"
+      key = "#{flowset.source_id}|#{record.flowset_id}"
+      template = @templates[key]
+
+      unless template
+        #@logger.warn("No matching template for flow id #{record.flowset_id} from #{event["source"]}")
+        @logger.warn("No matching template for flow id #{record.flowset_id}")
+        next
+      end
 
-          length = record.flowset_length - 4
+      length = record.flowset_length - 4
 
-          # Template shouldn't be longer than the record and there should
-          # be at most 3 padding bytes
-          if template.num_bytes > length or ! (length % template.num_bytes).between?(0, 3)
-            @logger.warn("Template length doesn't fit cleanly into flowset", :template_id => record.flowset_id, :template_length => template.num_bytes, :record_length => length)
-            next
-          end
+      # Template shouldn't be longer than the record and there should
+      # be at most 3 padding bytes
+      if template.num_bytes > length or ! (length % template.num_bytes).between?(0, 3)
+        @logger.warn("Template length doesn't fit cleanly into flowset", :template_id => record.flowset_id, :template_length => template.num_bytes, :record_length => length)
+        next
+      end
+
+      array = BinData::Array.new(:type => template, :initial_length => length / template.num_bytes)
+      records = array.read(record.flowset_data)
+
+      records.each do |r|
+        event = {
+          LogStash::Event::TIMESTAMP => LogStash::Timestamp.at(flowset.unix_sec),
+          @target => {}
+        }
 
-          array = BinData::Array.new(:type => template, :initial_length => length / template.num_bytes)
-
-          records = array.read(record.flowset_data)
-
-          records.each do |r|
-            event = LogStash::Event.new(
-              LogStash::Event::TIMESTAMP => LogStash::Timestamp.at(flowset.unix_sec),
-              @target => {}
-            )
-
-            # Fewer fields in the v9 header
-            ['version', 'flow_seq_num'].each do |f|
-              event[@target][f] = flowset[f]
-            end
-
-            event[@target]['flowset_id'] = record.flowset_id
-
-            r.each_pair do |k,v|
-              case k.to_s
-              when /_switched$/
-                millis = flowset.uptime - v
-                seconds = flowset.unix_sec - (millis / 1000)
-                # v9 did away with the nanosecs field
-                micros = 1000000 - (millis % 1000)
-                event[@target][k.to_s] = Time.at(seconds, micros).utc.strftime("%Y-%m-%dT%H:%M:%S.%3NZ")
-              else
-                event[@target][k.to_s] = v
-              end
-            end
-
-            yield event
+        # Fewer fields in the v9 header
+        NETFLOW9_FIELDS.each do |f|
+          event[@target][f] = flowset[f].snapshot
+        end
+
+        event[@target][FLOWSET_ID] = record.flowset_id.snapshot
+
+        r.each_pair do |k, v|
+          case k.to_s
+          when SWITCHED
+            millis = flowset.uptime - v
+            seconds = flowset.unix_sec - (millis / 1000)
+            # v9 did away with the nanosecs field
+            micros = 1000000 - (millis % 1000)
+            event[@target][k.to_s] = LogStash::Timestamp.at(seconds, micros).to_iso8601
+          else
+            event[@target][k.to_s] = v.snapshot
           end
-        else
-          @logger.warn("Unsupported flowset id #{record.flowset_id}")
         end
+
+        events << LogStash::Event.new(event)
       end
+    else
+      @logger.warn("Unsupported flowset id #{record.flowset_id}")
     end
-  end # def filter
 
-  private
+    events
+  end
+
   def uint_field(length, default)
     # If length is 4, return :uint32, etc. and use default if length is 0
     ("uint" + (((length > 0) ? length : default) * 8).to_s).to_sym
   end # def uint_field
 
-  private
   def netflow_field_for(type, length)
     if @fields.include?(type)
       field = @fields[type]
       if field.is_a?(Array)
 
-        if field[0].is_a?(Integer)
-          field[0] = uint_field(length, field[0])
-        end
+        field[0] = uint_field(length, field[0]) if field[0].is_a?(Integer)
 
         # Small bit of fixup for skip or string field types where the length
         # is dynamic
@@ -248,7 +247,8 @@ class LogStash::Codecs::Netflow < LogStash::Codecs::Base
           field += [{:length => length, :trim_padding => true}]
         end
 
-        @logger.debug("Definition complete", :field => field)
+        @logger.debug? and @logger.debug("Definition complete", :field => field)
+
         [field]
       else
         @logger.warn("Definition should be an array", :field => field)

data/logstash-codec-netflow.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-codec-netflow'
-  s.version         = '0.1.5'
+  s.version         = '0.1.6'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "The netflow codec is for decoding Netflow v5/v9 flows."
   s.description     = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"

data/spec/codecs/netflow_spec.rb

@@ -1 +1,208 @@
 require "logstash/devutils/rspec/spec_helper"
+require "logstash/codecs/netflow"
+
+describe LogStash::Codecs::Netflow do
+  subject do
+    LogStash::Codecs::Netflow.new.tap do |codec|
+      expect{codec.register}.not_to raise_error
+    end
+  end
+
+  let(:decode) do
+    [].tap do |events|
+      subject.decode(data){|event| events << event}
+    end
+  end
+
+  context "Netflow 5" do
+    let(:data) do
+      # this netflow raw data was produced with softflowd and captured with netcat
+      # softflowd -D -i eth0 -v 5 -t maxlife=1 -n 127.0.01:8765
+      # nc -k -4 -u -l 127.0.0.1 8765 > netflow5.dat
+      IO.read(File.join(File.dirname(__FILE__), "netflow5.dat"), :mode => "rb")
+    end
+
+    let(:json_events) do
+      events = []
+      events << <<-END
+        {
+          "@timestamp": "2015-05-02T18:38:08.280Z",
+          "netflow": {
+            "version": 5,
+            "flow_seq_num": 0,
+            "engine_type": 0,
+            "engine_id": 0,
+            "sampling_algorithm": 0,
+            "sampling_interval": 0,
+            "flow_records": 2,
+            "ipv4_src_addr": "10.0.2.2",
+            "ipv4_dst_addr": "10.0.2.15",
+            "ipv4_next_hop": "0.0.0.0",
+            "input_snmp": 0,
+            "output_snmp": 0,
+            "in_pkts": 5,
+            "in_bytes": 230,
+            "first_switched": "2015-06-21T11:40:52.280Z",
+            "last_switched": "2015-05-02T18:38:08.279Z",
+            "l4_src_port": 54435,
+            "l4_dst_port": 22,
+            "tcp_flags": 16,
+            "protocol": 6,
+            "src_tos": 0,
+            "src_as": 0,
+            "dst_as": 0,
+            "src_mask": 0,
+            "dst_mask": 0
+          },
+          "@version": "1"
+        }
+      END
+
+      events << <<-END
+        {
+          "@timestamp": "2015-05-02T18:38:08.280Z",
+          "netflow": {
+            "version": 5,
+            "flow_seq_num": 0,
+            "engine_type": 0,
+            "engine_id": 0,
+            "sampling_algorithm": 0,
+            "sampling_interval": 0,
+            "flow_records": 2,
+            "ipv4_src_addr": "10.0.2.15",
+            "ipv4_dst_addr": "10.0.2.2",
+            "ipv4_next_hop": "0.0.0.0",
+            "input_snmp": 0,
+            "output_snmp": 0,
+            "in_pkts": 4,
+            "in_bytes": 304,
+            "first_switched": "2015-06-21T11:40:52.280Z",
+            "last_switched": "2015-05-02T18:38:08.279Z",
+            "l4_src_port": 22,
+            "l4_dst_port": 54435,
+            "tcp_flags": 24,
+            "protocol": 6,
+            "src_tos": 0,
+            "src_as": 0,
+            "dst_as": 0,
+            "src_mask": 0,
+            "dst_mask": 0
+          },
+          "@version": "1"
+        }
+      END
+
+      events.map{|event| event.gsub(/\s+/, "")}
+    end
+
+    it "should decode raw data" do
+      expect(decode.size).to eq(2)
+
+      expect(decode[0]["[netflow][version]"]).to eq(5)
+      expect(decode[0]["[netflow][ipv4_src_addr]"]).to eq("10.0.2.2")
+      expect(decode[0]["[netflow][ipv4_dst_addr]"]).to eq("10.0.2.15")
+      expect(decode[0]["[netflow][l4_src_port]"]).to eq(54435)
+      expect(decode[0]["[netflow][l4_dst_port]"]).to eq(22)
+      expect(decode[0]["[netflow][tcp_flags]"]).to eq(16)
+
+      expect(decode[1]["[netflow][version]"]).to eq(5)
+      expect(decode[1]["[netflow][ipv4_src_addr]"]).to eq("10.0.2.15")
+      expect(decode[1]["[netflow][ipv4_dst_addr]"]).to eq("10.0.2.2")
+      expect(decode[1]["[netflow][l4_src_port]"]).to eq(22)
+      expect(decode[1]["[netflow][l4_dst_port]"]).to eq(54435)
+      expect(decode[1]["[netflow][tcp_flags]"]).to eq(24)
+    end
+
+    it "should serialize to json" do
+      expect(decode[0].to_json).to eq(json_events[0])
+      expect(decode[1].to_json).to eq(json_events[1])
+    end
+  end
+
+  context "Netflow 9" do
+    let(:data) do
+      # this netflow raw data was produced with softflowd and captured with netcat
+      # softflowd -D -i eth0 -v 9 -t maxlife=1 -n 127.0.01:8765
+      # nc -k -4 -u -l 127.0.0.1 8765 > netflow9.dat
+      IO.read(File.join(File.dirname(__FILE__), "netflow9.dat"), :mode => "rb")
+    end
+
+    let(:json_events) do
+      events = []
+      events << <<-END
+        {
+          "@timestamp": "2015-05-02T22:10:07.000Z",
+          "netflow": {
+            "version": 9,
+            "flow_seq_num": 0,
+            "flowset_id": 1024,
+            "ipv4_src_addr": "10.0.2.2",
+            "ipv4_dst_addr": "10.0.2.15",
+            "last_switched": "2015-05-02T22:10:07.999Z",
+            "first_switched": "2015-06-21T15:12:49.999Z",
+            "in_bytes": 230,
+            "in_pkts": 5,
+            "input_snmp": 0,
+            "output_snmp": 0,
+            "l4_src_port": 57369,
+            "l4_dst_port": 22,
+            "protocol": 6,
+            "tcp_flags": 16,
+            "ip_protocol_version": 4
+          },
+          "@version": "1"
+        }
+      END
+
+      events << <<-END
+        {
+          "@timestamp": "2015-05-02T22:10:07.000Z",
+          "netflow": {
+            "version": 9,
+            "flow_seq_num": 0,
+            "flowset_id": 1024,
+            "ipv4_src_addr": "10.0.2.15",
+            "ipv4_dst_addr": "10.0.2.2",
+            "last_switched": "2015-05-02T22:10:07.999Z",
+            "first_switched": "2015-06-21T15:12:49.999Z",
+            "in_bytes": 352,
+            "in_pkts": 4,
+            "input_snmp": 0,
+            "output_snmp": 0,
+            "l4_src_port": 22,
+            "l4_dst_port": 57369,
+            "protocol": 6,
+            "tcp_flags": 24,
+            "ip_protocol_version": 4
+          },
+          "@version": "1"
+        }
+      END
+
+      events.map{|event| event.gsub(/\s+/, "")}
+    end
+
+    it "should decode raw data" do
+      expect(decode.size).to eq(2)
+
+      expect(decode[0]["[netflow][version]"]).to eq(9)
+      expect(decode[0]["[netflow][ipv4_src_addr]"]).to eq("10.0.2.2")
+      expect(decode[0]["[netflow][ipv4_dst_addr]"]).to eq("10.0.2.15")
+      expect(decode[0]["[netflow][l4_src_port]"]).to eq(57369)
+      expect(decode[0]["[netflow][l4_dst_port]"]).to eq(22)
+      expect(decode[0]["[netflow][tcp_flags]"]).to eq(16)
+
+      expect(decode[1]["[netflow][version]"]).to eq(9)
+      expect(decode[1]["[netflow][ipv4_src_addr]"]).to eq("10.0.2.15")
+      expect(decode[1]["[netflow][ipv4_dst_addr]"]).to eq("10.0.2.2")
+      expect(decode[1]["[netflow][l4_src_port]"]).to eq(22)
+      expect(decode[1]["[netflow][l4_dst_port]"]).to eq(57369)
+      expect(decode[1]["[netflow][tcp_flags]"]).to eq(24)
+    end
+
+    it "should serialize to json" do
+      expect(decode[0].to_json).to eq(json_events[0])
+      expect(decode[1].to_json).to eq(json_events[1])
+    end
+  end
+end

metadata

@@ -1,17 +1,18 @@
 --- !ruby/object:Gem::Specification
 name: logstash-codec-netflow
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.6
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2015-04-20 00:00:00.000000000 Z
+date: 2015-05-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  requirement: !ruby/object:Gem::Requirement
+  name: logstash-core
+  version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
@@ -19,10 +20,7 @@ dependencies:
     - - <
       - !ruby/object:Gem::Version
         version: 2.0.0
-  name: logstash-core
-  prerelease: false
-  type: :runtime
-  version_requirements: !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
@@ -30,34 +28,36 @@ dependencies:
     - - <
       - !ruby/object:Gem::Version
         version: 2.0.0
+  prerelease: false
+  type: :runtime
 - !ruby/object:Gem::Dependency
+  name: bindata
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: 1.5.0
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
         version: 1.5.0
-  name: bindata
   prerelease: false
   type: :runtime
+- !ruby/object:Gem::Dependency
+  name: logstash-devutils
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
-        version: 1.5.0
-- !ruby/object:Gem::Dependency
+        version: '0'
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
         version: '0'
-  name: logstash-devutils
   prerelease: false
   type: :development
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '>='
-      - !ruby/object:Gem::Version
-        version: '0'
 description: This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program
 email: info@elastic.co
 executables: []
@@ -74,6 +74,8 @@ files:
 - lib/logstash/codecs/netflow/netflow.yaml
 - lib/logstash/codecs/netflow/util.rb
 - logstash-codec-netflow.gemspec
+- spec/codecs/netflow5.dat
+- spec/codecs/netflow9.dat
 - spec/codecs/netflow_spec.rb
 homepage: http://www.elastic.co/guide/en/logstash/current/index.html
 licenses:
@@ -102,4 +104,6 @@ signing_key:
 specification_version: 4
 summary: The netflow codec is for decoding Netflow v5/v9 flows.
 test_files:
+- spec/codecs/netflow5.dat
+- spec/codecs/netflow9.dat
 - spec/codecs/netflow_spec.rb