These fields contain data about the flow itself.
Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only.
- Internal flow ID based on connection meta data and address.
VLAN identifier from the 802.1q frame. In case of a multi-tagged frame this field will be an array with the outer tag’s VLAN identifier listed first.
alias to: flow.id
alias to: flow.final
alias to: flow.vlan
alias to: source.bytes
alias to: source.packets
alias to: destination.bytes
alias to: destination.packets