Trying out the new IPFIX input in 3.2 by sending data from a Sophos UTM. Seeing this in server.log:
2020-02-05T21:06:05.013-05:00 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=3b402050-4885-11ea-808a-000c29404c16, journalOffset=393119342, codec=ipfix, payloadSize=745, timestamp=2020-02-06T02:06:05.013Z, remoteAddress=/192.168.0.1:44408} on input <5e38c5e829ccde06888b7552>.
2020-02-05T21:06:05.014-05:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=3b402050-4885-11ea-808a-000c29404c16, journalOffset=393119342, codec=ipfix, payloadSize=745, timestamp=2020-02-06T02:06:05.013Z, remoteAddress=/192.168.0.1:44408}
org.graylog.integrations.ipfix.IpfixException: Missing information element definitions for private enterprise number 21373
at org.graylog.integrations.ipfix.InformationElementDefinitions.getDefinition(InformationElementDefinitions.java:86) ~[?:?]
at org.graylog.integrations.ipfix.IpfixParser.parseDataSet(IpfixParser.java:337) ~[?:?]
at org.graylog.integrations.ipfix.codecs.IpfixCodec.lambda$decodeMessages$3(IpfixCodec.java:206) ~[?:?]
at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193) ~[?:1.8.0_242]
at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1382) ~[?:1.8.0_242]
at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:482) ~[?:1.8.0_242]
at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:472) ~[?:1.8.0_242]
at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708) ~[?:1.8.0_242]
at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:1.8.0_242]
at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:566) ~[?:1.8.0_242]
at org.graylog.integrations.ipfix.codecs.IpfixCodec.decodeMessages(IpfixCodec.java:212) ~[?:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:148) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:90) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:47) [graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_242]