Hey @marpino
So what I got out of the logs were.
Unable to decode raw message RawMessage, Missing information element definitions for private enterprise number 5951
So the logs show up on the input but they cannot be ingest because its missing information in the logs needed. Ran into something before while back but it was not resolved.
This is what I found during my googling.
- Errors while ingesting IPFIX · Issue #395 · Graylog2/graylog-plugin-integrations · GitHub
- IPFIX from Sophos UTM - #9 by SteveU
- Daily Challenge: IPFIX Input issue
Have you tried or tested other INPUT’s like Raw Plaintext/Syslog to see if the message will appear?
Unfortunately I’m not to familiar with IPFIX. Perhaps someone else here has a better idea, if not you can post on GitHub for this issue.