Panic: interface conversion: interface {} is []interface {}, not uint64

ElastiFlow Community
1

Hello everyone!

My elasticflow collector keeps crashing at random times and cannot find the reason…

Neflow v9 send by Huawei NE8000.

Any idea how to attack the problem?

Thanks in advance!
Vangelis

{"level":"info","ts":"2025-02-05T22:25:54.089Z","logger":"flowcoll","caller":"liveness/liveness.go:26","msg":"liveness: running"}
{"level":"info","ts":"2025-02-05T22:25:54.089Z","logger":"flowcoll.writer_pool","caller":"writer/writer.go:35","msg":"running"}
{"level":"info","ts":"2025-02-05T22:25:54.089Z","logger":"flowcoll.elasticsearch_output[default].http_connection_manager","caller":"httpoutput/conn_manager.go:130","msg":"spawning workers","count":1}
{"level":"info","ts":"2025-02-05T22:25:54.091Z","logger":"flowcoll.elasticsearch_output[default]","caller":"httpoutput/healthcheck_runner.go:70","msg":"healthcheck success; connection is available","address":"172.23.5.20:9200"}
panic: interface conversion: interface {} is []interface {}, not uint64

goroutine 161 [running]:
github.com/elastiflow/flowcoll/pkg/processors/flowprocessor/enrich.enrichIPaddr({0x1e10b00?, 0xc001918540?}, {0xc066fdd280, 0x10}, 0x3, {0x1277762, 0xd}, 0xc0bde7d950, 0xc001990de0)
	/app/pkg/processors/flowprocessor/enrich/utils.go:500 +0x2005
github.com/elastiflow/flowcoll/pkg/processors/flowprocessor/enrich.ipAddr(0xc0bde7da40, 0xc0bde7d950, 0xc0b3749dc0, 0xc00196f380)
	/app/pkg/processors/flowprocessor/enrich/ip.go:33 +0x89a
github.com/elastiflow/flowcoll/pkg/processors/flowprocessor/enrich.EnrichRawIE(...)
	/app/pkg/processors/flowprocessor/enrich/enrich.go:60
github.com/elastiflow/flowcoll/pkg/processors/flowprocessor/enrich.EnrichRecord(0xc001289a40, 0xc0b3749dc0, 0xc00196f380)
	/app/pkg/processors/flowprocessor/enrich/enrich.go:73 +0x16b
github.com/elastiflow/flowcoll/pkg/processors/flowprocessor/enrich.EnrichRecords(...)
	/app/pkg/processors/flowprocessor/enrich/enrich.go:79
github.com/elastiflow/flowcoll/pkg/processors/flowprocessor/process.processDecodedRecords({0xc0be47c3f0, 0x5, 0x6}, 0xc00196f380, 0xc0b3749dc0, 0x0, 0x0)
	/app/pkg/processors/flowprocessor/process/process.go:49 +0x4d2
github.com/elastiflow/flowcoll/pkg/processors/flowprocessor/process.ProcessPacket({0xc066ff6510?, 0x10?, 0x0?}, 0xc000e00000?, {0xc0be544000?, 0x4596b8?, 0x0?}, 0x10?, 0xc0b3749dc0, 0xc00196f380, ...)
	/app/pkg/processors/flowprocessor/process/process.go:29 +0x5f
github.com/elastiflow/flowcoll/pkg/processors/flowprocessor.(*FlowProcessor).decodePacket(0xc087e5cbd0, {{0x1e11f38, 0xc0bd74dbc0}, 0xc0bde7c900, 0x25c, 0x194d838bca2})
	/app/pkg/processors/flowprocessor/flow.go:76 +0x2e5
github.com/elastiflow/flowcoll/pkg/processors/flowprocessor.(*FlowProcessor).Run(0xc087e5cbd0, {0x1e15f50, 0xc0016220f0})
	/app/pkg/processors/flowprocessor/flow.go:49 +0x405
created by github.com/elastiflow/flowcoll/pkg/processors/flowprocessor.(*Pool).Run in goroutine 207
	/app/pkg/processors/flowprocessor/pool.go:62 +0x23b
2

This looks like an issue with IP enrichment. I would disable all enrichment in config and the restart. Then turn them back on one at a time while testing. If I had to guess I’d say there is a syntax issue in ipaddrs.yml. would need full logs and configs to do more than guess.

Regards,
Dexter

3

Hello,

I have disabled everything and left only the default values but the problem seems to be there.

Currently there are no ipaddrs.yml, no geoip. If I stop netflow streams collector doesn’t crash until I reopen them.

Please, find the logs at {"level":"info","ts":"2025-02-06T10:13:11.565Z","logger":"flowcoll","caller":"fl - Pastebin.com.

Thanks in advance!!
Vangelis

4

I would upgrade to the latest version. There was a fix for this possible panic in 7.3.1. Apologies for not remembering that yesterday!

5

Thank you very much!!
It works now!
It was making me crazy :smiley:

1 Like
6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.