IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

› ›

NetFlow fields

edit

NetFlow fields

edit

Fields from NetFlow and IPFIX flows.

netflow

edit

Fields from NetFlow and IPFIX.

netflow.type

The type of NetFlow record described by this event.

type: keyword

exporter

edit

Metadata related to the exporter device that generated this record.

netflow.exporter.address

Exporter’s network address in IP:port format.

type: keyword

netflow.exporter.source_id

Observation domain ID to which this record belongs.

type: long

netflow.exporter.timestamp

Time and date of export.

type: date

netflow.exporter.uptime_millis

How long the exporter process has been running, in milliseconds.

type: long

netflow.exporter.version

NetFlow version used.

type: integer

netflow.octet_delta_count

type: long

netflow.packet_delta_count

type: long

netflow.delta_flow_count

type: long

netflow.protocol_identifier

type: short

netflow.ip_class_of_service

type: short

netflow.tcp_control_bits

type: integer

netflow.source_transport_port

type: integer

netflow.source_ipv4_address

type: ip

netflow.source_ipv4_prefix_length

type: short

netflow.ingress_interface

type: long

netflow.destination_transport_port

type: integer

netflow.destination_ipv4_address

type: ip

netflow.destination_ipv4_prefix_length

type: short

netflow.egress_interface

type: long

netflow.ip_next_hop_ipv4_address

type: ip

netflow.bgp_source_as_number

type: long

netflow.bgp_destination_as_number

type: long

netflow.bgp_next_hop_ipv4_address

type: ip

netflow.post_mcast_packet_delta_count

type: long

netflow.post_mcast_octet_delta_count

type: long

netflow.flow_end_sys_up_time

type: long

netflow.flow_start_sys_up_time

type: long

netflow.post_octet_delta_count

type: long

netflow.post_packet_delta_count

type: long

netflow.minimum_ip_total_length

type: long

netflow.maximum_ip_total_length

type: long

netflow.source_ipv6_address

type: ip

netflow.destination_ipv6_address

type: ip

netflow.source_ipv6_prefix_length

type: short

netflow.destination_ipv6_prefix_length

type: short

netflow.flow_label_ipv6

type: long

netflow.icmp_type_code_ipv4

type: integer

netflow.igmp_type

type: short

netflow.sampling_interval

type: long

netflow.sampling_algorithm

type: short

netflow.flow_active_timeout

type: integer

netflow.flow_idle_timeout

type: integer

netflow.engine_type

type: short

netflow.engine_id

type: short

netflow.exported_octet_total_count

type: long

netflow.exported_message_total_count

type: long

netflow.exported_flow_record_total_count

type: long

netflow.ipv4_router_sc

type: ip

netflow.source_ipv4_prefix

type: ip

netflow.destination_ipv4_prefix

type: ip

netflow.mpls_top_label_type

type: short

netflow.mpls_top_label_ipv4_address

type: ip

netflow.sampler_id

type: short

netflow.sampler_mode

type: short

netflow.sampler_random_interval

type: long

netflow.class_id

type: short

netflow.minimum_ttl

type: short

netflow.maximum_ttl

type: short

netflow.fragment_identification

type: long

netflow.post_ip_class_of_service

type: short

netflow.source_mac_address

type: keyword

netflow.post_destination_mac_address

type: keyword

netflow.vlan_id

type: integer

netflow.post_vlan_id

type: integer

netflow.ip_version

type: short

netflow.flow_direction

type: short

netflow.ip_next_hop_ipv6_address

type: ip

netflow.bgp_next_hop_ipv6_address

type: ip

netflow.ipv6_extension_headers

type: long

netflow.mpls_top_label_stack_section

type: short

netflow.mpls_label_stack_section2

type: short

netflow.mpls_label_stack_section3

type: short

netflow.mpls_label_stack_section4

type: short

netflow.mpls_label_stack_section5

type: short

netflow.mpls_label_stack_section6

type: short

netflow.mpls_label_stack_section7

type: short

netflow.mpls_label_stack_section8

type: short

netflow.mpls_label_stack_section9

type: short

netflow.mpls_label_stack_section10

type: short

netflow.destination_mac_address

type: keyword

netflow.post_source_mac_address

type: keyword

netflow.interface_name

type: keyword

netflow.interface_description

type: keyword

netflow.sampler_name

type: keyword

netflow.octet_total_count

type: long

netflow.packet_total_count

type: long

netflow.flags_and_sampler_id

type: long

netflow.fragment_offset

type: integer

netflow.forwarding_status

type: short

netflow.mpls_vpn_route_distinguisher

type: short

netflow.mpls_top_label_prefix_length

type: short

netflow.src_traffic_index

type: long

netflow.dst_traffic_index

type: long

netflow.application_description

type: keyword

netflow.application_id

type: short

netflow.application_name

type: keyword

netflow.post_ip_diff_serv_code_point

type: short

netflow.multicast_replication_factor

type: long

netflow.class_name

type: keyword

netflow.classification_engine_id

type: short

netflow.layer2packet_section_offset

type: integer

netflow.layer2packet_section_size

type: integer

netflow.layer2packet_section_data

type: short

netflow.bgp_next_adjacent_as_number

type: long

netflow.bgp_prev_adjacent_as_number

type: long

netflow.exporter_ipv4_address

type: ip

netflow.exporter_ipv6_address

type: ip

netflow.dropped_octet_delta_count

type: long

netflow.dropped_packet_delta_count

type: long

netflow.dropped_octet_total_count

type: long

netflow.dropped_packet_total_count

type: long

netflow.flow_end_reason

type: short

netflow.common_properties_id

type: long

netflow.observation_point_id

type: long

netflow.icmp_type_code_ipv6

type: integer

netflow.mpls_top_label_ipv6_address

type: ip

netflow.line_card_id

type: long

netflow.port_id

type: long

netflow.metering_process_id

type: long

netflow.exporting_process_id

type: long

netflow.template_id

type: integer

netflow.wlan_channel_id

type: short

netflow.wlan_ssid

type: keyword

netflow.flow_id

type: long

netflow.observation_domain_id

type: long

netflow.flow_start_seconds

type: date

netflow.flow_end_seconds

type: date

netflow.flow_start_milliseconds

type: date

netflow.flow_end_milliseconds

type: date

netflow.flow_start_microseconds

type: date

netflow.flow_end_microseconds

type: date

netflow.flow_start_nanoseconds

type: date

netflow.flow_end_nanoseconds

type: date

netflow.flow_start_delta_microseconds

type: long

netflow.flow_end_delta_microseconds

type: long

netflow.system_init_time_milliseconds

type: date

netflow.flow_duration_milliseconds

type: long

netflow.flow_duration_microseconds

type: long

netflow.observed_flow_total_count

type: long

netflow.ignored_packet_total_count

type: long

netflow.ignored_octet_total_count

type: long

netflow.not_sent_flow_total_count

type: long

netflow.not_sent_packet_total_count

type: long

netflow.not_sent_octet_total_count

type: long

netflow.destination_ipv6_prefix

type: ip

netflow.source_ipv6_prefix

type: ip

netflow.post_octet_total_count

type: long

netflow.post_packet_total_count

type: long

netflow.flow_key_indicator

type: long

netflow.post_mcast_packet_total_count

type: long

netflow.post_mcast_octet_total_count

type: long

netflow.icmp_type_ipv4

type: short

netflow.icmp_code_ipv4

type: short

netflow.icmp_type_ipv6

type: short

netflow.icmp_code_ipv6

type: short

netflow.udp_source_port

type: integer

netflow.udp_destination_port

type: integer

netflow.tcp_source_port

type: integer

netflow.tcp_destination_port

type: integer

netflow.tcp_sequence_number

type: long

netflow.tcp_acknowledgement_number

type: long

netflow.tcp_window_size

type: integer

netflow.tcp_urgent_pointer

type: integer

netflow.tcp_header_length

type: short

netflow.ip_header_length

type: short

netflow.total_length_ipv4

type: integer

netflow.payload_length_ipv6

type: integer

netflow.ip_ttl

type: short

netflow.next_header_ipv6

type: short

netflow.mpls_payload_length

type: long

netflow.ip_diff_serv_code_point

type: short

netflow.ip_precedence

type: short

netflow.fragment_flags

type: short

netflow.octet_delta_sum_of_squares

type: long

netflow.octet_total_sum_of_squares

type: long

netflow.mpls_top_label_ttl

type: short

netflow.mpls_label_stack_length

type: long

netflow.mpls_label_stack_depth

type: long

netflow.mpls_top_label_exp

type: short

netflow.ip_payload_length

type: long

netflow.udp_message_length

type: integer

netflow.is_multicast

type: short

netflow.ipv4_ihl

type: short

netflow.ipv4_options

type: long

netflow.tcp_options

type: long

netflow.padding_octets

type: short

netflow.collector_ipv4_address

type: ip

netflow.collector_ipv6_address

type: ip

netflow.export_interface

type: long

netflow.export_protocol_version

type: short

netflow.export_transport_protocol

type: short

netflow.collector_transport_port

type: integer

netflow.exporter_transport_port

type: integer

netflow.tcp_syn_total_count

type: long

netflow.tcp_fin_total_count

type: long

netflow.tcp_rst_total_count

type: long

netflow.tcp_psh_total_count

type: long

netflow.tcp_ack_total_count

type: long

netflow.tcp_urg_total_count

type: long

netflow.ip_total_length

type: long

netflow.post_nat_source_ipv4_address

type: ip

netflow.post_nat_destination_ipv4_address

type: ip

netflow.post_napt_source_transport_port

type: integer

netflow.post_napt_destination_transport_port

type: integer

netflow.nat_originating_address_realm

type: short

netflow.nat_event

type: short

netflow.initiator_octets

type: long

netflow.responder_octets

type: long

netflow.firewall_event

type: short

netflow.ingress_vrfid

type: long

netflow.egress_vrfid

type: long

netflow.vr_fname

type: keyword

netflow.post_mpls_top_label_exp

type: short

netflow.tcp_window_scale

type: integer

netflow.biflow_direction

type: short

netflow.ethernet_header_length

type: short

netflow.ethernet_payload_length

type: integer

netflow.ethernet_total_length

type: integer

netflow.dot1q_vlan_id

type: integer

netflow.dot1q_priority

type: short

netflow.dot1q_customer_vlan_id

type: integer

netflow.dot1q_customer_priority

type: short

netflow.metro_evc_id

type: keyword

netflow.metro_evc_type

type: short

netflow.pseudo_wire_id

type: long

netflow.pseudo_wire_type

type: integer

netflow.pseudo_wire_control_word

type: long

netflow.ingress_physical_interface

type: long

netflow.egress_physical_interface

type: long

netflow.post_dot1q_vlan_id

type: integer

netflow.post_dot1q_customer_vlan_id

type: integer

netflow.ethernet_type

type: integer

netflow.post_ip_precedence

type: short

netflow.collection_time_milliseconds

type: date

netflow.export_sctp_stream_id

type: integer

netflow.max_export_seconds

type: date

netflow.max_flow_end_seconds

type: date

netflow.message_md5_checksum

type: short

netflow.message_scope

type: short

netflow.min_export_seconds

type: date

netflow.min_flow_start_seconds

type: date

netflow.opaque_octets

type: short

netflow.session_scope

type: short

netflow.max_flow_end_microseconds

type: date

netflow.max_flow_end_milliseconds

type: date

netflow.max_flow_end_nanoseconds

type: date

netflow.min_flow_start_microseconds

type: date

netflow.min_flow_start_milliseconds

type: date

netflow.min_flow_start_nanoseconds

type: date

netflow.collector_certificate

type: short

netflow.exporter_certificate

type: short

netflow.data_records_reliability

type: boolean

netflow.observation_point_type

type: short

netflow.new_connection_delta_count

type: long

netflow.connection_sum_duration_seconds

type: long

netflow.connection_transaction_id

type: long

netflow.post_nat_source_ipv6_address

type: ip

netflow.post_nat_destination_ipv6_address

type: ip

netflow.nat_pool_id

type: long

netflow.nat_pool_name

type: keyword

netflow.anonymization_flags

type: integer

netflow.anonymization_technique

type: integer

netflow.information_element_index

type: integer

netflow.p2p_technology

type: keyword

netflow.tunnel_technology

type: keyword

netflow.encrypted_technology

type: keyword

netflow.bgp_validity_state

type: short

netflow.ip_sec_spi

type: long

netflow.gre_key

type: long

netflow.nat_type

type: short

netflow.initiator_packets

type: long

netflow.responder_packets

type: long

netflow.observation_domain_name

type: keyword

netflow.selection_sequence_id

type: long

netflow.selector_id

type: long

netflow.information_element_id

type: integer

netflow.selector_algorithm

type: integer

netflow.sampling_packet_interval

type: long

netflow.sampling_packet_space

type: long

netflow.sampling_time_interval

type: long

netflow.sampling_time_space

type: long

netflow.sampling_size

type: long

netflow.sampling_population

type: long

netflow.sampling_probability

type: double

netflow.data_link_frame_size

type: integer

netflow.ip_header_packet_section

type: short

netflow.ip_payload_packet_section

type: short

netflow.data_link_frame_section

type: short

netflow.mpls_label_stack_section

type: short

netflow.mpls_payload_packet_section

type: short

netflow.selector_id_total_pkts_observed

type: long

netflow.selector_id_total_pkts_selected

type: long

netflow.absolute_error

type: double

netflow.relative_error

type: double

netflow.observation_time_seconds

type: date

netflow.observation_time_milliseconds

type: date

netflow.observation_time_microseconds

type: date

netflow.observation_time_nanoseconds

type: date

netflow.digest_hash_value

type: long

netflow.hash_ip_payload_offset

type: long

netflow.hash_ip_payload_size

type: long

netflow.hash_output_range_min

type: long

netflow.hash_output_range_max

type: long

netflow.hash_selected_range_min

type: long

netflow.hash_selected_range_max

type: long

netflow.hash_digest_output

type: boolean

netflow.hash_initialiser_value

type: long

netflow.selector_name

type: keyword

netflow.upper_ci_limit

type: double

netflow.lower_ci_limit

type: double

netflow.confidence_level

type: double

netflow.information_element_data_type

type: short

netflow.information_element_description

type: keyword

netflow.information_element_name

type: keyword

netflow.information_element_range_begin

type: long

netflow.information_element_range_end

type: long

netflow.information_element_semantics

type: short

netflow.information_element_units

type: integer

netflow.private_enterprise_number

type: long

netflow.virtual_station_interface_id

type: short

netflow.virtual_station_interface_name

type: keyword

netflow.virtual_station_uuid

type: short

netflow.virtual_station_name

type: keyword

netflow.layer2_segment_id

type: long

netflow.layer2_octet_delta_count

type: long

netflow.layer2_octet_total_count

type: long

netflow.ingress_unicast_packet_total_count

type: long

netflow.ingress_multicast_packet_total_count

type: long

netflow.ingress_broadcast_packet_total_count

type: long

netflow.egress_unicast_packet_total_count

type: long

netflow.egress_broadcast_packet_total_count

type: long

netflow.monitoring_interval_start_milli_seconds

type: date

netflow.monitoring_interval_end_milli_seconds

type: date

netflow.port_range_start

type: integer

netflow.port_range_end

type: integer

netflow.port_range_step_size

type: integer

netflow.port_range_num_ports

type: integer

netflow.sta_mac_address

type: keyword

netflow.sta_ipv4_address

type: ip

netflow.wtp_mac_address

type: keyword

netflow.ingress_interface_type

type: long

netflow.egress_interface_type

type: long

netflow.rtp_sequence_number

type: integer

netflow.user_name

type: keyword

netflow.application_category_name

type: keyword

netflow.application_sub_category_name

type: keyword

netflow.application_group_name

type: keyword

netflow.original_flows_present

type: long

netflow.original_flows_initiated

type: long

netflow.original_flows_completed

type: long

netflow.distinct_count_of_source_ip_address

type: long

netflow.distinct_count_of_destination_ip_address

type: long

netflow.distinct_count_of_source_ipv4_address

type: long

netflow.distinct_count_of_destination_ipv4_address

type: long

netflow.distinct_count_of_source_ipv6_address

type: long

netflow.distinct_count_of_destination_ipv6_address

type: long

netflow.value_distribution_method

type: short

netflow.rfc3550_jitter_milliseconds

type: long

netflow.rfc3550_jitter_microseconds

type: long

netflow.rfc3550_jitter_nanoseconds

type: long

netflow.dot1q_dei

type: boolean

netflow.dot1q_customer_dei

type: boolean

netflow.flow_selector_algorithm

type: integer

netflow.flow_selected_octet_delta_count

type: long

netflow.flow_selected_packet_delta_count

type: long

netflow.flow_selected_flow_delta_count

type: long

netflow.selector_id_total_flows_observed

type: long

netflow.selector_id_total_flows_selected

type: long

netflow.sampling_flow_interval

type: long

netflow.sampling_flow_spacing

type: long

netflow.flow_sampling_time_interval

type: long

netflow.flow_sampling_time_spacing

type: long

netflow.hash_flow_domain

type: integer

netflow.transport_octet_delta_count

type: long

netflow.transport_packet_delta_count

type: long

netflow.original_exporter_ipv4_address

type: ip

netflow.original_exporter_ipv6_address

type: ip

netflow.original_observation_domain_id

type: long

netflow.intermediate_process_id

type: long

netflow.ignored_data_record_total_count

type: long

netflow.data_link_frame_type

type: integer

netflow.section_offset

type: integer

netflow.section_exported_octets

type: integer

netflow.dot1q_service_instance_tag

type: short

netflow.dot1q_service_instance_id

type: long

netflow.dot1q_service_instance_priority

type: short

netflow.dot1q_customer_source_mac_address

type: keyword

netflow.dot1q_customer_destination_mac_address

type: keyword

netflow.post_layer2_octet_delta_count

type: long

netflow.post_mcast_layer2_octet_delta_count

type: long

netflow.post_layer2_octet_total_count

type: long

netflow.post_mcast_layer2_octet_total_count

type: long

netflow.minimum_layer2_total_length

type: long

netflow.maximum_layer2_total_length

type: long

netflow.dropped_layer2_octet_delta_count

type: long

netflow.dropped_layer2_octet_total_count

type: long

netflow.ignored_layer2_octet_total_count

type: long

netflow.not_sent_layer2_octet_total_count

type: long

netflow.layer2_octet_delta_sum_of_squares

type: long

netflow.layer2_octet_total_sum_of_squares

type: long

netflow.layer2_frame_delta_count

type: long

netflow.layer2_frame_total_count

type: long

netflow.pseudo_wire_destination_ipv4_address

type: ip

netflow.ignored_layer2_frame_total_count

type: long

netflow.mib_object_value_integer

type: integer

netflow.mib_object_value_octet_string

type: short

netflow.mib_object_value_oid

type: short

netflow.mib_object_value_bits

type: short

netflow.mib_object_value_ip_address

type: ip

netflow.mib_object_value_counter

type: long

netflow.mib_object_value_gauge

type: long

netflow.mib_object_value_time_ticks

type: long

netflow.mib_object_value_unsigned

type: long

netflow.mib_object_identifier

type: short

netflow.mib_sub_identifier

type: long

netflow.mib_index_indicator

type: long

netflow.mib_capture_time_semantics

type: short

netflow.mib_context_engine_id

type: short

netflow.mib_context_name

type: keyword

netflow.mib_object_name

type: keyword

netflow.mib_object_description

type: keyword

netflow.mib_object_syntax

type: keyword

netflow.mib_module_name

type: keyword

netflow.mobile_imsi

type: keyword

netflow.mobile_msisdn

type: keyword

netflow.http_status_code

type: integer

netflow.source_transport_ports_limit

type: integer

netflow.http_request_method

type: keyword

netflow.http_request_host

type: keyword

netflow.http_request_target

type: keyword

netflow.http_message_version

type: keyword

netflow.nat_instance_id

type: long

netflow.internal_address_realm

type: short

netflow.external_address_realm

type: short

netflow.nat_quota_exceeded_event

type: long

netflow.nat_threshold_event

type: long

netflow.http_user_agent

type: keyword

netflow.http_content_type

type: keyword

netflow.http_reason_phrase

type: keyword

netflow.max_session_entries

type: long

netflow.max_bib_entries

type: long

netflow.max_entries_per_user

type: long

netflow.max_subscribers

type: long

netflow.max_fragments_pending_reassembly

type: long

netflow.address_pool_high_threshold

type: long

netflow.address_pool_low_threshold

type: long

netflow.address_port_mapping_high_threshold

type: long

netflow.address_port_mapping_low_threshold

type: long

netflow.address_port_mapping_per_user_high_threshold

type: long

netflow.global_address_mapping_high_threshold

type: long

netflow.vpn_identifier

type: short

« nats fields NetFlow fields »