[NetFlow]: Wrong timestamp

[ipsec]

Integration Name

NetFlow Records [netflow]

Dataset Name

netflow.log

Integration Version

2.23.0

Agent Version

8.18.1

Agent Output Type

elasticsearch

Elasticsearch Version

8.18.1

OS Version and Architecture

Debian GNU/Linux 12 (bookworm)

Software/API Version

No response

Error Message

I'm using nfreplay -r file.nfcapd.202505261425 -p 2055 to send the data to elastic-agent on port 2055.

The data are ingested but the timestamp field is getting the 'net flow.exporter.timestamp' as @timestamp.
The elastic field @timestamp is:

@timestamp May 25, 2025 @ 14:25:00.000

But the event is generated 1 day after the netflow.exporter.timestamp (I don't know where is field is added.

How to fix the Netflow integration to use the netflow.flow_start_milliseconds field like the @timestamp.

Event Original

event.created May 26, 2025 @ 14:30:41.468
event.ingested May 26, 2025 @ 14:30:51.000
netflow.exporter.timestamp May 25, 2025 @ 14:25:00.000
netflow.flow_end_milliseconds May 26, 2025 @ 14:29:59.992
netflow.flow_start_milliseconds May 26, 2025 @ 14:29:59.992

What did you do?

The netflow integration is only the UDP host to listen on 0.0.0.0 and the UDP port to listen on 2055.

What did you see?

@timestamp May 25, 2025 @ 14:25:00.000

What did you expect to see?

@timestamp May 26, 2025 @ 14:29:59.992

Anything else?

No response

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[jrmolin]

Why do you expect the @timestamp field to be the same as the netflow.flow_end_milliseconds?

The @timestamp is defined in ECS as "Date/time when the event originated"[1]. It is not when it was captured or ingested.

1. https://www.elastic.co/docs/reference/ecs/ecs-base#_base_field_details

[ipsec]

The file file.nfcapd.202505261425 was generated, and its filename correctly indicates the date and time as May 26, 2025, at 14:25.

The flow data within the file also aligns with this time.

However, the timestamp recorded in ECS is exactly one day earlier.

Could you please help me understand how this discrepancy is possible?

[botelastic]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!