IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Fields from NetFlow and IPFIX flows.
netflow
Fields from NetFlow and IPFIX.
netflow.type
The type of NetFlow record described by this event.
type: keyword
exporter
Metadata related to the exporter device that generated this record.
netflow.exporter.address
Exporter’s network address in IP:port format.
type: keyword
netflow.exporter.source_id
Observation domain ID to which this record belongs.
type: long
netflow.exporter.timestamp
Time and date of export.
type: date
netflow.exporter.uptime_millis
How long the exporter process has been running, in milliseconds.
type: long
netflow.exporter.version
NetFlow version used.
type: long
netflow.octet_delta_count
- type: long
netflow.packet_delta_count
- type: long
netflow.delta_flow_count
- type: long
netflow.protocol_identifier
- type: short
netflow.ip_class_of_service
- type: short
netflow.tcp_control_bits
- type: integer
netflow.source_transport_port
- type: integer
netflow.source_ipv4_address
- type: ip
netflow.source_ipv4_prefix_length
- type: short
netflow.ingress_interface
- type: long
netflow.destination_transport_port
- type: integer
netflow.destination_ipv4_address
- type: ip
netflow.destination_ipv4_prefix_length
- type: short
netflow.egress_interface
- type: long
netflow.ip_next_hop_ipv4_address
- type: ip
netflow.bgp_source_as_number
- type: long
netflow.bgp_destination_as_number
- type: long
netflow.bgp_next_hop_ipv4_address
- type: ip
netflow.post_mcast_packet_delta_count
- type: long
netflow.post_mcast_octet_delta_count
- type: long
netflow.flow_end_sys_up_time
- type: long
netflow.flow_start_sys_up_time
- type: long
netflow.post_octet_delta_count
- type: long
netflow.post_packet_delta_count
- type: long
netflow.minimum_ip_total_length
- type: long
netflow.maximum_ip_total_length
- type: long
netflow.source_ipv6_address
- type: ip
netflow.destination_ipv6_address
- type: ip
netflow.source_ipv6_prefix_length
- type: short
netflow.destination_ipv6_prefix_length
- type: short
netflow.flow_label_ipv6
- type: long
netflow.icmp_type_code_ipv4
- type: integer
netflow.igmp_type
- type: short
netflow.sampling_interval
- type: long
netflow.sampling_algorithm
- type: short
netflow.flow_active_timeout
- type: integer
netflow.flow_idle_timeout
- type: integer
netflow.engine_type
- type: short
netflow.engine_id
- type: short
netflow.exported_octet_total_count
- type: long
netflow.exported_message_total_count
- type: long
netflow.exported_flow_record_total_count
- type: long
netflow.ipv4_router_sc
- type: ip
netflow.source_ipv4_prefix
- type: ip
netflow.destination_ipv4_prefix
- type: ip
netflow.mpls_top_label_type
- type: short
netflow.mpls_top_label_ipv4_address
- type: ip
netflow.sampler_id
- type: short
netflow.sampler_mode
- type: short
netflow.sampler_random_interval
- type: long
netflow.class_id
- type: short
netflow.minimum_ttl
- type: short
netflow.maximum_ttl
- type: short
netflow.fragment_identification
- type: long
netflow.post_ip_class_of_service
- type: short
netflow.source_mac_address
- type: keyword
netflow.post_destination_mac_address
- type: keyword
netflow.vlan_id
- type: integer
netflow.post_vlan_id
- type: integer
netflow.ip_version
- type: short
netflow.flow_direction
- type: short
netflow.ip_next_hop_ipv6_address
- type: ip
netflow.bgp_next_hop_ipv6_address
- type: ip
netflow.ipv6_extension_headers
- type: long
netflow.mpls_top_label_stack_section
- type: short
netflow.mpls_label_stack_section2
- type: short
netflow.mpls_label_stack_section3
- type: short
netflow.mpls_label_stack_section4
- type: short
netflow.mpls_label_stack_section5
- type: short
netflow.mpls_label_stack_section6
- type: short
netflow.mpls_label_stack_section7
- type: short
netflow.mpls_label_stack_section8
- type: short
netflow.mpls_label_stack_section9
- type: short
netflow.mpls_label_stack_section10
- type: short
netflow.destination_mac_address
- type: keyword
netflow.post_source_mac_address
- type: keyword
netflow.interface_name
- type: keyword
netflow.interface_description
- type: keyword
netflow.sampler_name
- type: keyword
netflow.octet_total_count
- type: long
netflow.packet_total_count
- type: long
netflow.flags_and_sampler_id
- type: long
netflow.fragment_offset
- type: integer
netflow.forwarding_status
- type: short
netflow.mpls_vpn_route_distinguisher
- type: short
netflow.mpls_top_label_prefix_length
- type: short
netflow.src_traffic_index
- type: long
netflow.dst_traffic_index
- type: long
netflow.application_description
- type: keyword
netflow.application_id
- type: short
netflow.application_name
- type: keyword
netflow.post_ip_diff_serv_code_point
- type: short
netflow.multicast_replication_factor
- type: long
netflow.class_name
- type: keyword
netflow.classification_engine_id
- type: short
netflow.layer2packet_section_offset
- type: integer
netflow.layer2packet_section_size
- type: integer
netflow.layer2packet_section_data
- type: short
netflow.bgp_next_adjacent_as_number
- type: long
netflow.bgp_prev_adjacent_as_number
- type: long
netflow.exporter_ipv4_address
- type: ip
netflow.exporter_ipv6_address
- type: ip
netflow.dropped_octet_delta_count
- type: long
netflow.dropped_packet_delta_count
- type: long
netflow.dropped_octet_total_count
- type: long
netflow.dropped_packet_total_count
- type: long
netflow.flow_end_reason
- type: short
netflow.common_properties_id
- type: long
netflow.observation_point_id
- type: long
netflow.icmp_type_code_ipv6
- type: integer
netflow.mpls_top_label_ipv6_address
- type: ip
netflow.line_card_id
- type: long
netflow.port_id
- type: long
netflow.metering_process_id
- type: long
netflow.exporting_process_id
- type: long
netflow.template_id
- type: integer
netflow.wlan_channel_id
- type: short
netflow.wlan_ssid
- type: keyword
netflow.flow_id
- type: long
netflow.observation_domain_id
- type: long
netflow.flow_start_seconds
- type: date
netflow.flow_end_seconds
- type: date
netflow.flow_start_milliseconds
- type: date
netflow.flow_end_milliseconds
- type: date
netflow.flow_start_microseconds
- type: date
netflow.flow_end_microseconds
- type: date
netflow.flow_start_nanoseconds
- type: date
netflow.flow_end_nanoseconds
- type: date
netflow.flow_start_delta_microseconds
- type: long
netflow.flow_end_delta_microseconds
- type: long
netflow.system_init_time_milliseconds
- type: date
netflow.flow_duration_milliseconds
- type: long
netflow.flow_duration_microseconds
- type: long
netflow.observed_flow_total_count
- type: long
netflow.ignored_packet_total_count
- type: long
netflow.ignored_octet_total_count
- type: long
netflow.not_sent_flow_total_count
- type: long
netflow.not_sent_packet_total_count
- type: long
netflow.not_sent_octet_total_count
- type: long
netflow.destination_ipv6_prefix
- type: ip
netflow.source_ipv6_prefix
- type: ip
netflow.post_octet_total_count
- type: long
netflow.post_packet_total_count
- type: long
netflow.flow_key_indicator
- type: long
netflow.post_mcast_packet_total_count
- type: long
netflow.post_mcast_octet_total_count
- type: long
netflow.icmp_type_ipv4
- type: short
netflow.icmp_code_ipv4
- type: short
netflow.icmp_type_ipv6
- type: short
netflow.icmp_code_ipv6
- type: short
netflow.udp_source_port
- type: integer
netflow.udp_destination_port
- type: integer
netflow.tcp_source_port
- type: integer
netflow.tcp_destination_port
- type: integer
netflow.tcp_sequence_number
- type: long
netflow.tcp_acknowledgement_number
- type: long
netflow.tcp_window_size
- type: integer
netflow.tcp_urgent_pointer
- type: integer
netflow.tcp_header_length
- type: short
netflow.ip_header_length
- type: short
netflow.total_length_ipv4
- type: integer
netflow.payload_length_ipv6
- type: integer
netflow.ip_ttl
- type: short
netflow.next_header_ipv6
- type: short
netflow.mpls_payload_length
- type: long
netflow.ip_diff_serv_code_point
- type: short
netflow.ip_precedence
- type: short
netflow.fragment_flags
- type: short
netflow.octet_delta_sum_of_squares
- type: long
netflow.octet_total_sum_of_squares
- type: long
netflow.mpls_top_label_ttl
- type: short
netflow.mpls_label_stack_length
- type: long
netflow.mpls_label_stack_depth
- type: long
netflow.mpls_top_label_exp
- type: short
netflow.ip_payload_length
- type: long
netflow.udp_message_length
- type: integer
netflow.is_multicast
- type: short
netflow.ipv4_ihl
- type: short
netflow.ipv4_options
- type: long
netflow.tcp_options
- type: long
netflow.padding_octets
- type: short
netflow.collector_ipv4_address
- type: ip
netflow.collector_ipv6_address
- type: ip
netflow.export_interface
- type: long
netflow.export_protocol_version
- type: short
netflow.export_transport_protocol
- type: short
netflow.collector_transport_port
- type: integer
netflow.exporter_transport_port
- type: integer
netflow.tcp_syn_total_count
- type: long
netflow.tcp_fin_total_count
- type: long
netflow.tcp_rst_total_count
- type: long
netflow.tcp_psh_total_count
- type: long
netflow.tcp_ack_total_count
- type: long
netflow.tcp_urg_total_count
- type: long
netflow.ip_total_length
- type: long
netflow.post_nast_ource_ipv4_address
- type: ip
netflow.post_nadt_estination_ipv4_address
- type: ip
netflow.post_napst_ource_transport_port
- type: integer
netflow.post_napdt_estination_transport_port
- type: integer
netflow.nat_originating_address_realm
- type: short
netflow.nat_event
- type: short
netflow.initiator_octets
- type: long
netflow.responder_octets
- type: long
netflow.firewall_event
- type: short
netflow.ingress_vrfid
- type: long
netflow.egress_vrfid
- type: long
netflow.vr_fname
- type: keyword
netflow.post_mpls_top_label_exp
- type: short
netflow.tcp_window_scale
- type: integer
netflow.biflow_direction
- type: short
netflow.ethernet_header_length
- type: short
netflow.ethernet_payload_length
- type: integer
netflow.ethernet_total_length
- type: integer
netflow.dot1q_vlan_id
- type: integer
netflow.dot1q_priority
- type: short
netflow.dot1q_customer_vlan_id
- type: integer
netflow.dot1q_customer_priority
- type: short
netflow.metro_evc_id
- type: keyword
netflow.metro_evc_type
- type: short
netflow.pseudo_wire_id
- type: long
netflow.pseudo_wire_type
- type: integer
netflow.pseudo_wire_control_word
- type: long
netflow.ingress_physical_interface
- type: long
netflow.egress_physical_interface
- type: long
netflow.post_dot1q_vlan_id
- type: integer
netflow.post_dot1q_customer_vlan_id
- type: integer
netflow.ethernet_type
- type: integer
netflow.post_ip_precedence
- type: short
netflow.collection_time_milliseconds
- type: date
netflow.export_sctp_stream_id
- type: integer
netflow.max_export_seconds
- type: date
netflow.max_flow_end_seconds
- type: date
netflow.message_md5_checksum
- type: short
netflow.message_scope
- type: short
netflow.min_export_seconds
- type: date
netflow.min_flow_start_seconds
- type: date
netflow.opaque_octets
- type: short
netflow.session_scope
- type: short
netflow.max_flow_end_microseconds
- type: date
netflow.max_flow_end_milliseconds
- type: date
netflow.max_flow_end_nanoseconds
- type: date
netflow.min_flow_start_microseconds
- type: date
netflow.min_flow_start_milliseconds
- type: date
netflow.min_flow_start_nanoseconds
- type: date
netflow.collector_certificate
- type: short
netflow.exporter_certificate
- type: short
netflow.data_records_reliability
- type: boolean
netflow.observation_point_type
- type: short
netflow.new_connection_delta_count
- type: long
netflow.connection_sum_duration_seconds
- type: long
netflow.connection_transaction_id
- type: long
netflow.post_nast_ource_ipv6_address
- type: ip
netflow.post_nadt_estination_ipv6_address
- type: ip
netflow.nat_pool_id
- type: long
netflow.nat_pool_name
- type: keyword
netflow.anonymization_flags
- type: integer
netflow.anonymization_technique
- type: integer
netflow.information_element_index
- type: integer
netflow.p2p_technology
- type: keyword
netflow.tunnel_technology
- type: keyword
netflow.encrypted_technology
- type: keyword
netflow.bgp_validity_state
- type: short
netflow.ip_sec_spi
- type: long
netflow.gre_key
- type: long
netflow.nat_type
- type: short
netflow.initiator_packets
- type: long
netflow.responder_packets
- type: long
netflow.observation_domain_name
- type: keyword
netflow.selection_sequence_id
- type: long
netflow.selector_id
- type: long
netflow.information_element_id
- type: integer
netflow.selector_algorithm
- type: integer
netflow.sampling_packet_interval
- type: long
netflow.sampling_packet_space
- type: long
netflow.sampling_time_interval
- type: long
netflow.sampling_time_space
- type: long
netflow.sampling_size
- type: long
netflow.sampling_population
- type: long
netflow.sampling_probability
- type: double
netflow.data_link_frame_size
- type: integer
netflow.ip_header_packet_section
- type: short
netflow.ip_payload_packet_section
- type: short
netflow.data_link_frame_section
- type: short
netflow.mpls_label_stack_section
- type: short
netflow.mpls_payload_packet_section
- type: short
netflow.selector_id_total_pkts_observed
- type: long
netflow.selector_id_total_pkts_selected
- type: long
netflow.absolute_error
- type: double
netflow.relative_error
- type: double
netflow.observation_time_seconds
- type: date
netflow.observation_time_milliseconds
- type: date
netflow.observation_time_microseconds
- type: date
netflow.observation_time_nanoseconds
- type: date
netflow.digest_hash_value
- type: long
netflow.hash_ipp_ayload_offset
- type: long
netflow.hash_ipp_ayload_size
- type: long
netflow.hash_output_range_min
- type: long
netflow.hash_output_range_max
- type: long
netflow.hash_selected_range_min
- type: long
netflow.hash_selected_range_max
- type: long
netflow.hash_digest_output
- type: boolean
netflow.hash_initialiser_value
- type: long
netflow.selector_name
- type: keyword
netflow.upper_cli_imit
- type: double
netflow.lower_cli_imit
- type: double
netflow.confidence_level
- type: double
netflow.information_element_data_type
- type: short
netflow.information_element_description
- type: keyword
netflow.information_element_name
- type: keyword
netflow.information_element_range_begin
- type: long
netflow.information_element_range_end
- type: long
netflow.information_element_semantics
- type: short
netflow.information_element_units
- type: integer
netflow.private_enterprise_number
- type: long
netflow.virtual_station_interface_id
- type: short
netflow.virtual_station_interface_name
- type: keyword
netflow.virtual_station_uuid
- type: short
netflow.virtual_station_name
- type: keyword
netflow.layer2_segment_id
- type: long
netflow.layer2_octet_delta_count
- type: long
netflow.layer2_octet_total_count
- type: long
netflow.ingress_unicast_packet_total_count
- type: long
netflow.ingress_multicast_packet_total_count
- type: long
netflow.ingress_broadcast_packet_total_count
- type: long
netflow.egress_unicast_packet_total_count
- type: long
netflow.egress_broadcast_packet_total_count
- type: long
netflow.monitoring_interval_start_milli_seconds
- type: date
netflow.monitoring_interval_end_milli_seconds
- type: date
netflow.port_range_start
- type: integer
netflow.port_range_end
- type: integer
netflow.port_range_step_size
- type: integer
netflow.port_range_num_ports
- type: integer
netflow.sta_mac_address
- type: keyword
netflow.sta_ipv4_address
- type: ip
netflow.wtp_mac_address
- type: keyword
netflow.ingress_interface_type
- type: long
netflow.egress_interface_type
- type: long
netflow.rtp_sequence_number
- type: integer
netflow.user_name
- type: keyword
netflow.application_category_name
- type: keyword
netflow.application_sub_category_name
- type: keyword
netflow.application_group_name
- type: keyword
netflow.original_flows_present
- type: long
netflow.original_flows_initiated
- type: long
netflow.original_flows_completed
- type: long
netflow.distinct_count_of_sourc_eipa_ddress
- type: long
netflow.distinct_count_of_destinatio_nipa_ddress
- type: long
netflow.distinct_count_of_source_ipv4_address
- type: long
netflow.distinct_count_of_destination_ipv4_address
- type: long
netflow.distinct_count_of_source_ipv6_address
- type: long
netflow.distinct_count_of_destination_ipv6_address
- type: long
netflow.value_distribution_method
- type: short
netflow.rfc3550_jitter_milliseconds
- type: long
netflow.rfc3550_jitter_microseconds
- type: long
netflow.rfc3550_jitter_nanoseconds
- type: long
netflow.dot1q_dei
- type: boolean
netflow.dot1q_customer_dei
- type: boolean
netflow.flow_selector_algorithm
- type: integer
netflow.flow_selected_octet_delta_count
- type: long
netflow.flow_selected_packet_delta_count
- type: long
netflow.flow_selected_flow_delta_count
- type: long
netflow.selector_itd_otal_flows_observed
- type: long
netflow.selector_itd_otal_flows_selected
- type: long
netflow.sampling_flow_interval
- type: long
netflow.sampling_flow_spacing
- type: long
netflow.flow_sampling_time_interval
- type: long
netflow.flow_sampling_time_spacing
- type: long
netflow.hash_flow_domain
- type: integer
netflow.transport_octet_delta_count
- type: long
netflow.transport_packet_delta_count
- type: long
netflow.original_exporter_ipv4_address
- type: ip
netflow.original_exporter_ipv6_address
- type: ip
netflow.original_observation_domain_id
- type: long
netflow.intermediate_process_id
- type: long
netflow.ignored_data_record_total_count
- type: long
netflow.data_link_frame_type
- type: integer
netflow.section_offset
- type: integer
netflow.section_exported_octets
- type: integer
netflow.dot1q_service_instance_tag
- type: short
netflow.dot1q_service_instance_id
- type: long
netflow.dot1q_service_instance_priority
- type: short
netflow.dot1q_customer_source_mac_address
- type: keyword
netflow.dot1q_customer_destination_mac_address
- type: keyword
netflow.post_layer2_octet_delta_count
- type: long
netflow.post_mcast_layer2_octet_delta_count
- type: long
netflow.post_layer2_octet_total_count
- type: long
netflow.post_mcast_layer2_octet_total_count
- type: long
netflow.minimum_layer2_total_length
- type: long
netflow.maximum_layer2_total_length
- type: long
netflow.dropped_layer2_octet_delta_count
- type: long
netflow.dropped_layer2_octet_total_count
- type: long
netflow.ignored_layer2_octet_total_count
- type: long
netflow.not_sent_layer2_octet_total_count
- type: long
netflow.layer2_octet_delta_sum_of_squares
- type: long
netflow.layer2_octet_total_sum_of_squares
- type: long
netflow.layer2_frame_delta_count
- type: long
netflow.layer2_frame_total_count
- type: long
netflow.pseudo_wire_destination_ipv4_address
- type: ip
netflow.ignored_layer2_frame_total_count
- type: long
netflow.mib_object_value_integer
- type: integer
netflow.mib_object_value_octet_string
- type: short
netflow.mib_object_value_oid
- type: short
netflow.mib_object_value_bits
- type: short
netflow.mib_object_valuei_pa_ddress
- type: ip
netflow.mib_object_value_counter
- type: long
netflow.mib_object_value_gauge
- type: long
netflow.mib_object_value_time_ticks
- type: long
netflow.mib_object_value_unsigned
- type: long
netflow.mib_object_identifier
- type: short
netflow.mib_sub_identifier
- type: long
netflow.mib_index_indicator
- type: long
netflow.mib_capture_time_semantics
- type: short
netflow.mib_context_engine_id
- type: short
netflow.mib_context_name
- type: keyword
netflow.mib_object_name
- type: keyword
netflow.mib_object_description
- type: keyword
netflow.mib_object_syntax
- type: keyword
netflow.mib_module_name
- type: keyword
netflow.mobile_imsi
- type: keyword
netflow.mobile_msisdn
- type: keyword
netflow.http_status_code
- type: integer
netflow.source_transport_ports_limit
- type: integer
netflow.http_request_method
- type: keyword
netflow.http_request_host
- type: keyword
netflow.http_request_target
- type: keyword
netflow.http_message_version
- type: keyword
netflow.nat_instance_id
- type: long
netflow.internal_address_realm
- type: short
netflow.external_address_realm
- type: short
netflow.nat_quota_exceeded_event
- type: long
netflow.nat_threshold_event
- type: long
netflow.http_user_agent
- type: keyword
netflow.http_content_type
- type: keyword
netflow.http_reason_phrase
- type: keyword
netflow.max_session_entries
- type: long
netflow.max_bieb_ntries
- type: long
netflow.max_entries_per_user
- type: long
netflow.max_subscribers
- type: long
netflow.max_fragments_pending_reassembly
- type: long
netflow.address_pool_high_threshold
- type: long
netflow.address_pool_low_threshold
- type: long
netflow.address_port_mapping_high_threshold
- type: long
netflow.address_port_mapping_low_threshold
- type: long
netflow.address_port_mapping_per_user_high_threshold
- type: long
netflow.global_address_mapping_high_threshold
- type: long
netflow.vpn_identifier
- type: short