IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« ECS fields Host fields »

› ›

Flow Event fields

edit

Flow Event fields

edit

These fields contain data about the flow itself.

flow.final

type: boolean

Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only.

flow.id

Internal flow ID based on connection meta data and address.

flow.vlan

type: long

VLAN identifier from the 802.1q frame. In case of a multi-tagged frame this field will be an array with the outer tag’s VLAN identifier listed first.

flow_id

type: alias

alias to: flow.id

final

type: alias

alias to: flow.final

vlan

type: alias

alias to: flow.vlan

source.stats.net_bytes_total

type: alias

alias to: source.bytes

source.stats.net_packets_total

type: alias

alias to: source.packets

dest.stats.net_bytes_total

type: alias

alias to: destination.bytes

dest.stats.net_packets_total

type: alias

alias to: destination.packets

« ECS fields Host fields »