docs(inputs.netflow): Clarify and document 'template not found' warnings (#15214)

plugins/inputs/netflow/README.md

@@ -100,6 +100,22 @@ Currently the following `data-type`s are supported:
 - `ip`     IPv4 or IPv6 address
 - `proto`  mapping of layer-4 protocol numbers to names
 
+## Troubleshooting
+
+### `Error template not found` warnings
+
+Those warnings usually occur in cases where Telegraf is restarted or reloaded
+while the flow-device is already streaming data.
+As background, the Netflow and IPFIX protocols rely on templates sent by the
+flow-device to decode fields. Without those templates, it is not clear what the
+data-type and size of the payload is and this makes it impossible to correctly
+interpret the data. However, templates are sent by the flow-device, usually at
+the start of streaming and in regular intervals (configurable in the device) and
+Telegraf has no means to trigger sending of the templates. Therefore, we need to
+skip the packets until the templates are resent by the device.
+
+### Template
+
 ## Metrics
 
 Metrics depend on the format used as well as on the information provided

plugins/inputs/netflow/netflow_decoder.go

@@ -562,7 +562,8 @@ func (d *netflowDecoder) Decode(srcIP net.IP, payload []byte) ([]telegraf.Metric
 	buf := bytes.NewBuffer(payload)
 	if err := netflow.DecodeMessageVersion(buf, templates, &msg9, &msg10); err != nil {
 		if errors.Is(err, netflow.ErrorTemplateNotFound) {
-			d.Log.Warnf("%v; skipping packet", err)
+			msg := "Skipping packet until the device resends the required template..."
+			d.Log.Warnf("%v. %s", err, msg)
 			return nil, nil
 		}
 		return nil, fmt.Errorf("decoding message failed: %w", err)

plugins/inputs/netflow/netflow_test.go

@@ -154,7 +154,7 @@ func TestMissingTemplate(t *testing.T) {
 
 	var found bool
 	for _, w := range logger.Warnings() {
-		found = found || strings.Contains(w, netflow.ErrorTemplateNotFound.Error()+"; skipping packet")
+		found = found || strings.Contains(w, netflow.ErrorTemplateNotFound.Error())
 	}
 	require.True(t, found, "warning not found")
 }