From 563eae9627781f56c58b41231a01c1eee6b369ba Mon Sep 17 00:00:00 2001
From: Sven Rebhan <36194019+srebhan@users.noreply.github.com>
Date: Mon, 4 Mar 2024 17:41:01 +0100
Subject: [PATCH] fix(inputs.netflow): Fallback to IPFIX mappings for Netflow
 v9 (#14910)

---
 plugins/inputs/netflow/netflow_decoder.go | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/plugins/inputs/netflow/netflow_decoder.go b/plugins/inputs/netflow/netflow_decoder.go
index 391b46524..82e6e1777 100644
--- a/plugins/inputs/netflow/netflow_decoder.go
+++ b/plugins/inputs/netflow/netflow_decoder.go
@@ -706,6 +706,21 @@ func (d *netflowDecoder) decodeValueV9(field netflow.DataField) ([]telegraf.Fiel
 		return fields, nil
 	}
 
+	// Fallback to IPFIX mappings as some devices seem to send IPFIX elements in
+	// Netflow v9 packets. See https://github.com/influxdata/telegraf/issues/14902
+	// and https://github.com/influxdata/telegraf/issues/14903.
+	if mappings, found := fieldMappingsIPFIX[elementID]; found {
+		var fields []telegraf.Field
+		for _, m := range mappings {
+			v, err := m.decoder(raw)
+			if err != nil {
+				return nil, err
+			}
+			fields = append(fields, telegraf.Field{Key: m.name, Value: v})
+		}
+		return fields, nil
+	}
+
 	// Return the raw data if no mapping was found
 	key := fmt.Sprintf("type_%d", elementID)
 	if !d.logged[key] {