NOTE: You are looking at documentation for an older release. For the latest information, see the current release documentation.
Flow Event fields
editFlow Event fields
editThese fields contain data about the flow itself.
-
start_time
-
type: date
example: 2015-01-24 14:06:05.071000
format: YYYY-MM-DDTHH:MM:SS.milliZ
required: True
The time, the first packet for the flow has been seen.
-
last_time
-
type: date
example: 2015-01-24 14:06:05.071000
format: YYYY-MM-DDTHH:MM:SS.milliZ
required: True
The time, the most recent processed packet for the flow has been seen.
-
final
-
Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only.
-
flow_id
-
Internal flow id based on connection meta data and address.
-
vlan
-
Innermost VLAN address used in network packets.
-
outer_vlan
-
Second innermost VLAN address used in network packets.
source fields
editProperties of the source host
-
source.mac
-
Source MAC address as indicated by first packet seen for the current flow.
-
source.ip
-
Innermost IPv4 source address as indicated by first packet seen for the current flow.
-
source.ip_location
-
type: geo_point
example: 40.715, -74.011
The GeoIP location of the
ip_source
IP address. The field is a string containing the latitude and longitude separated by a comma. -
source.outer_ip
-
Second innermost IPv4 source address as indicated by first packet seen for the current flow.
-
source.outer_ip_location
-
type: geo_point
example: 40.715, -74.011
The GeoIP location of the
outer_ip_source
IP address. The field is a string containing the latitude and longitude separated by a comma. -
source.ipv6
-
Innermost IPv6 source address as indicated by first packet seen for the current flow.
-
source.ipv6_location
-
type: geo_point
example: 60.715, -76.011
The GeoIP location of the
ipv6_source
IP address. The field is a string containing the latitude and longitude separated by a comma. -
source.outer_ipv6
-
Second innermost IPv6 source address as indicated by first packet seen for the current flow.
-
source.outer_ipv6_location
-
type: geo_point
example: 60.715, -76.011
The GeoIP location of the
outer_ipv6_source
IP address. The field is a string containing the latitude and longitude separated by a comma. -
source.port
-
Source port number as indicated by first packet seen for the current flow.
stats fields
editObject with source to destination flow measurements.
-
source.stats.net_packets_total
-
type: long
Total number of packets
-
source.stats.net_bytes_total
-
type: long
Total number of bytes
dest fields
editProperties of the destination host
-
dest.mac
-
Destination MAC address as indicated by first packet seen for the current flow.
-
dest.ip
-
Innermost IPv4 destination address as indicated by first packet seen for the current flow.
-
dest.ip_location
-
type: geo_point
example: 40.715, -74.011
The GeoIP location of the
ip_dest
IP address. The field is a string containing the latitude and longitude separated by a comma. -
dest.outer_ip
-
Second innermost IPv4 destination address as indicated by first packet seen for the current flow.
-
dest.outer_ip_location
-
type: geo_point
example: 40.715, -74.011
The GeoIP location of the
outer_ip_dest
IP address. The field is a string containing the latitude and longitude separated by a comma. -
dest.ipv6
-
Innermost IPv6 destination address as indicated by first packet seen for the current flow.
-
dest.ipv6_location
-
type: geo_point
example: 60.715, -76.011
The GeoIP location of the
ipv6_dest
IP address. The field is a string containing the latitude and longitude separated by a comma. -
dest.outer_ipv6
-
Second innermost IPv6 destination address as indicated by first packet seen for the current flow.
-
dest.outer_ipv6_location
-
type: geo_point
example: 60.715, -76.011
The GeoIP location of the
outer_ipv6_dest
IP address. The field is a string containing the latitude and longitude separated by a comma. -
dest.port
-
Destination port number as indicated by first packet seen for the current flow.
stats fields
editObject with destination to source flow measurements.
-
dest.stats.net_packets_total
-
type: long
Total number of packets
-
dest.stats.net_bytes_total
-
type: long
Total number of bytes
-
icmp_id
-
ICMP id used in ICMP based flow.
-
connection_id
-
optional TCP connection id