# Flow.sampling\_interval **URL:** \ **Category:** ElastiFlow Community\ **Tags:** elasticsearch\ **Created:** [November 6, 2025, 10:56am UTC](https://forum.elastiflow.com/t/flow-sampling-interval/346 "2025-11-06T10:56:27Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Robriker](https://avatars.discourse-cdn.com/v4/letter/r/b9bd4f/32.png) [@Robriker](https://forum.elastiflow.com/u/Robriker)\ **Post date:** [November 6, 2025, 10:56am UTC](https://forum.elastiflow.com/t/flow-sampling-interval/346/1 "2025-11-06T10:56:28Z")
**Hello everyone,** I’m currently facing an issue while collecting NetFlow data from my backbone routers (Cisco ASR 9902 and ASR 9906). The flows are successfully received in **ElastiFlow** , and I can visualize them in **Kibana** — however, the traffic values are incorrect. I’m only seeing **KBytes or MBytes** , while the actual traffic should be in **GBytes**. I’ve been troubleshooting this for several days and noticed that it seems to be a **common issue** , but I haven’t found a proper fix yet. Here’s my configuration: sampler-map SAMPLER\_DDOS\_MONITOR random 1 out-of 1000 ! flow exporter-map EXP\_DDOS\_MONITOR version v9 template data timeout 60 ! transport udp 9995 source Loopback0 destination \ ! flow monitor-map DDOS\_MONITOR record ipv4 exporter EXP\_DDOS\_MONITOR cache timeout active 60 cache timeout update 60 ! And here’s a snippet of my **docker-compose.yml** used for ElastiFlow (Elasticsearch, Logstash, Kibana stack): cluster.name: elastiflow ```auto bootstrap.memory_lock: 'true' network.host: 0.0.0.0 http.port: 9200 discovery.type: 'single-node' indices.query.bool.max_clause_count: 8192 search.max_buckets: 250000 action.destructive_requires_name: 'true' ``` elastiflow-kibana: image: [docker.elastic.co/kibana/kibana:7.8.1](http://docker.elastic.co/kibana/kibana:7.8.1) container\_name: elastiflow-kibana restart: ‘no’ depends\_on: - elastiflow-elasticsearch network\_mode: host environment: SERVER\_HOST: 0.0.0.0 SERVER\_PORT: 5601 SERVER\_MAXPAYLOADBYTES: 8388608 ```auto ELASTICSEARCH_HOSTS: "http://127.0.0.1:9200" ELASTICSEARCH_REQUESTTIMEOUT: 132000 ELASTICSEARCH_SHARDTIMEOUT: 120000 KIBANA_DEFAULTAPPID: "dashboard/653cf1e0-2fd2-11e7-99ed-49759aed30f5" KIBANA_AUTOCOMPLETETIMEOUT: 3000 KIBANA_AUTOCOMPLETETERMINATEAFTER: 2500000 LOGGING_DEST: stdout LOGGING_QUIET: 'false' ``` elastiflow-logstash: image: robcowart/elastiflow-logstash:4.0.1 container\_name: elastiflow-logstash restart: ‘no’ depends\_on: - elastiflow-elasticsearch network\_mode: host environment: LS\_JAVA\_OPTS: ‘-Xms4g -Xmx4g’ ```auto # ElastiFlow global configuration ELASTIFLOW_AGENT_ID: elastiflow ELASTIFLOW_GEOIP_CACHE_SIZE: 16384 ELASTIFLOW_GEOIP_LOOKUP: 'true' ELASTIFLOW_ASN_LOOKUP: 'true' ELASTIFLOW_OUI_LOOKUP: 'false' ELASTIFLOW_POPULATE_LOGS: 'true' ELASTIFLOW_KEEP_ORIG_DATA: 'true' ELASTIFLOW_DEFAULT_APPID_SRCTYPE: '__UNKNOWN' # Name resolution option ELASTIFLOW_RESOLVE_IP2HOST: 'false' ELASTIFLOW_NAMESERVER: '127.0.0.1' ELASTIFLOW_DNS_HIT_CACHE_SIZE: 25000 ELASTIFLOW_DNS_HIT_CACHE_TTL: 900 ELASTIFLOW_DNS_FAILED_CACHE_SIZE: 75000 ELASTIFLOW_DNS_FAILED_CACHE_TTL: 3600 ELASTIFLOW_ES_HOST: '127.0.0.1:9200' #ELASTIFLOW_ES_USER: 'elastic' #ELASTIFLOW_ES_PASSWD: 'changeme' ELASTIFLOW_NETFLOW_IPV4_PORT: 9995 ELASTIFLOW_NETFLOW_UDP_WORKERS: 2 ELASTIFLOW_NETFLOW_UDP_QUEUE_SIZE: 4096 ELASTIFLOW_NETFLOW_UDP_RCV_BUFF: 33554432 ELASTIFLOW_SFLOW_IPV4_PORT: 6343 ELASTIFLOW_SFLOW_UDP_WORKERS: 2 ELASTIFLOW_SFLOW_UDP_QUEUE_SIZE: 4096 ELASTIFLOW_SFLOW_UDP_RCV_BUFF: 33554432 ELASTIFLOW_IPFIX_UDP_IPV4_PORT: 2055 ELASTIFLOW_IPFIX_UDP_WORKERS: 2 ELASTIFLOW_IPFIX_UDP_QUEUE_SIZE: 4096 ELASTIFLOW_IPFIX_UDP_RCV_BUFF: 33554432 ``` If anyone has already encountered this issue — incorrect traffic volume display (KBytes/MBytes instead of GBytes) — I’d really appreciate your help or any guidance on how to fix it. | flow.sampling\_interval | 0 — in flow record ! | | --- | --- | Thank you in advance for your time and support! ---
**Author:** ![daniel.harada](https://avatars.discourse-cdn.com/v4/letter/d/d6d6ee/32.png) [@daniel.harada](https://forum.elastiflow.com/u/daniel.harada)\ **Post date:** [November 6, 2025, 12:17pm UTC](https://forum.elastiflow.com/t/flow-sampling-interval/346/2 "2025-11-06T12:17:07Z")
Have you seen this information from our documents site? > **[ElastiFlow Documentation](https://docs.elastiflow.com/?q=data+discrepancies)** Let us know if this helps. ---
**Author:** ![Robriker](https://avatars.discourse-cdn.com/v4/letter/r/b9bd4f/32.png) [@Robriker](https://forum.elastiflow.com/u/Robriker)\ **Post date:** [November 6, 2025, 12:41pm UTC](https://forum.elastiflow.com/t/flow-sampling-interval/346/3 "2025-11-06T12:41:47Z")
**Hello** @daniel.harada I’ve already tried this solution, but unfortunately it didn’t change anything — I’m still facing the same issue. Thank you for your help, I’ll be waiting for your feedback. Best regards, ---
**Author:** ![Robriker](https://avatars.discourse-cdn.com/v4/letter/r/b9bd4f/32.png) [@Robriker](https://forum.elastiflow.com/u/Robriker)\ **Post date:** [November 6, 2025, 12:55pm UTC](https://forum.elastiflow.com/t/flow-sampling-interval/346/4 "2025-11-06T12:55:17Z")
![image](https://canada1.discourse-cdn.com/flex035/uploads/elastiflow/original/1X/d6c37dfb643c9092a6ba2044a3813fb1889fbaff.png) ---
**Author:** ![daniel.harada](https://avatars.discourse-cdn.com/v4/letter/d/d6d6ee/32.png) [@daniel.harada](https://forum.elastiflow.com/u/daniel.harada)\ **Post date:** [November 6, 2025, 1:02pm UTC](https://forum.elastiflow.com/t/flow-sampling-interval/346/5 "2025-11-06T13:02:43Z")
I’ll be honest. I’ve never seen or used: > elastiflow-logstash: > image: robcowart/elastiflow-logstash:4.0.1 > container\_name: elastiflow-logstash I would recommend installing [ElastiFlow NetObserv Flow with a Basic license](https://www.elastiflow.com/subscriptions). ![Screenshot 2025-11-06 at 07.00.19](https://canada1.discourse-cdn.com/flex035/uploads/elastiflow/original/1X/90156c59855272222f423296eecbdca5e587f53b.png) ---
**Author:** ![Robriker](https://avatars.discourse-cdn.com/v4/letter/r/b9bd4f/32.png) [@Robriker](https://forum.elastiflow.com/u/Robriker)\ **Post date:** [November 6, 2025, 1:05pm UTC](https://forum.elastiflow.com/t/flow-sampling-interval/346/6 "2025-11-06T13:05:00Z")
@daniel.harada Thank you for your response. However, the server is already in production, so I can’t make such a change right away. I’d prefer to identify the root cause of the issue before considering a full image replacement. Thank you for your understanding. ---
**Author:** ![Robriker](https://avatars.discourse-cdn.com/v4/letter/r/b9bd4f/32.png) [@Robriker](https://forum.elastiflow.com/u/Robriker)\ **Post date:** [November 6, 2025, 1:46pm UTC](https://forum.elastiflow.com/t/flow-sampling-interval/346/7 "2025-11-06T13:46:00Z")
Even with the image u send me, it doesnt work same issue ---
**Author:** ![Robriker](https://avatars.discourse-cdn.com/v4/letter/r/b9bd4f/32.png) [@Robriker](https://forum.elastiflow.com/u/Robriker)\ **Post date:** [November 6, 2025, 2:40pm UTC](https://forum.elastiflow.com/t/flow-sampling-interval/346/8 "2025-11-06T14:40:38Z")
I tried almost everything, not better ---
**Author:** ![daniel.harada](https://avatars.discourse-cdn.com/v4/letter/d/d6d6ee/32.png) [@daniel.harada](https://forum.elastiflow.com/u/daniel.harada)\ **Post date:** [November 6, 2025, 8:11pm UTC](https://forum.elastiflow.com/t/flow-sampling-interval/346/9 "2025-11-06T20:11:21Z")
I think the fundamental issue is that the device is not sending the sampling rate, or is sending an invalid sample rate. The current NetObserv Flow collector defaults to 1 if sample rate is not sent. Perhaps this is a better question for the device vendor. As noted in the linked article … ![Screenshot 2025-11-06 at 14.08.02](https://canada1.discourse-cdn.com/flex035/uploads/elastiflow/original/1X/d58cd93e18d83d1b4de1b8df07dfc56e34537b77.png) But again, I don’t know anything about the older logstash based collector. We would need to know the device flow configuration and get a packet capture of the flow data coming in to the collector to analyze further. ---
**Author:** ![Robriker](https://avatars.discourse-cdn.com/v4/letter/r/b9bd4f/32.png) [@Robriker](https://forum.elastiflow.com/u/Robriker)\ **Post date:** [November 18, 2025, 11:22am UTC](https://forum.elastiflow.com/t/flow-sampling-interval/346/10 "2025-11-18T11:22:57Z")
> [@daniel.harada](#): > > I think the fundamental issue is that the device is not sending the sampling rate, or is sending an invalid sample rate. The current NetObserv Flow collector defaults to 1 if sample rate is not sent. Perhaps this is a better question for the device vendor. As noted in the linked article … I tried to uograde to a new version but it looks like if i have the same problem.. i would like to tshoot with a support if that’s possible ? idk if it’s possible m just asking in case ---
**Author:** ![daniel.harada](https://avatars.discourse-cdn.com/v4/letter/d/d6d6ee/32.png) [@daniel.harada](https://forum.elastiflow.com/u/daniel.harada)\ **Post date:** [November 18, 2025, 1:44pm UTC](https://forum.elastiflow.com/t/flow-sampling-interval/346/11 "2025-11-18T13:44:35Z")
Please review your device configuration. My understanding is that in NetFlow v9 the sample rate is set per interface, and the sampling rate is sent in an ‘Option data’ record. NetObserv supports using option data for the sampling rate (sampler-table???), but the device must be configured to send it. Unfortunately I do not have specific device commands/configs to review and would refer you to Cisco, or perhaps someone else here has some knowledge. If you want to collect a packet capture on the flow collector server you can look in the capture to see if option data and templates are being sent to the collector. Regards, Dexter ---
**Author:** ![daniel.harada](https://avatars.discourse-cdn.com/v4/letter/d/d6d6ee/32.png) [@daniel.harada](https://forum.elastiflow.com/u/daniel.harada)\ **Post date:** [November 18, 2025, 1:47pm UTC](https://forum.elastiflow.com/t/flow-sampling-interval/346/12 "2025-11-18T13:47:23Z")
I should also point out that you can statically set user defined sampling rates based on an IP, CIDR, or IP range. See this documentation: > **[ElastiFlow Documentation](https://docs.elastiflow.com/?q=sampling)** ---
**Author:** ![Robriker](https://avatars.discourse-cdn.com/v4/letter/r/b9bd4f/32.png) [@Robriker](https://forum.elastiflow.com/u/Robriker)\ **Post date:** [November 20, 2025, 11:13am UTC](https://forum.elastiflow.com/t/flow-sampling-interval/346/13 "2025-11-20T11:13:06Z")
it”s all good now, thanks for your help @daniel.harada ! ---
**Author:** ![system](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.elastiflow.com/system/32/59_2.png) [@system](https://forum.elastiflow.com/u/system)\ **Post date:** [December 20, 2025, 11:13am UTC](https://forum.elastiflow.com/t/flow-sampling-interval/346/14 "2025-12-20T11:13:28Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.