Network flows format reference

Network flows format reference

Review the specifications for the network flow format, which is used internally and for exporting flow data to Kafka.

Network Flows format reference

This is the specification of the network flows format. That format is used when a Kafka exporter is configured, for Prometheus metrics labels as well as internally for the Loki store.

The "Filter ID" column shows which related name to use when defining Quick Filters (see spec.consolePlugin.quickFilters in the FlowCollector specification).

The "Loki label" column is useful when querying Loki directly: label fields need to be selected using stream selectors.

The "Cardinality" column gives information about the implied metric cardinality if this field was to be used as a Prometheus label with the FlowMetrics API. Refer to the FlowMetrics documentation for more information on using this API.

Name	Type	Description	Filter ID	Loki label	Cardinality	OpenTelemetry
`Bytes`	number	Number of bytes	n/a	no	avoid	bytes
`DnsErrno`	number	Error number returned from DNS tracker ebpf hook function	`dns_errno`	no	fine	dns.errno
`DnsFlags`	number	DNS flags for DNS record	n/a	no	fine	dns.flags
`DnsFlagsResponseCode`	string	Parsed DNS header RCODEs name	`dns_flag_response_code`	no	fine	dns.responsecode
`DnsId`	number	DNS record id	`dns_id`	no	avoid	dns.id
`DnsLatencyMs`	number	Time between a DNS request and response, in milliseconds	`dns_latency`	no	avoid	dns.latency
`DnsName`	string	DNS queried name	`dns_name`	no	careful	dns.name
`Dscp`	number	Differentiated Services Code Point (DSCP) value	`dscp`	no	fine	dscp
`DstAddr`	string	Destination IP address (ipv4 or ipv6)	`dst_address`	no	avoid	destination.address
`DstK8S_HostIP`	string	Destination node IP	`dst_host_address`	no	fine	destination.k8s.host.address
`DstK8S_HostName`	string	Destination node name	`dst_host_name`	no	fine	destination.k8s.host.name
`DstK8S_Name`	string	Name of the destination Kubernetes object, such as Pod name, Service name or Node name.	`dst_name`	no	careful	destination.k8s.name
`DstK8S_Namespace`	string	Destination namespace	`dst_namespace`	yes	fine	destination.k8s.namespace.name
`DstK8S_NetworkName`	string	Destination network name	`dst_network`	no	fine	destination.network.name
`DstK8S_OwnerName`	string	Name of the destination owner, such as Deployment name, StatefulSet name, etc.	`dst_owner_name`	yes	fine	destination.k8s.owner.name
`DstK8S_OwnerType`	string	Kind of the destination owner, such as Deployment, StatefulSet, etc.	`dst_kind`	no	fine	destination.k8s.owner.kind
`DstK8S_Type`	string	Kind of the destination Kubernetes object, such as Pod, Service or Node.	`dst_kind`	yes	fine	destination.k8s.kind
`DstK8S_Zone`	string	Destination availability zone	`dst_zone`	yes	fine	destination.zone
`DstMac`	string	Destination MAC address	`dst_mac`	no	avoid	destination.mac
`DstPort`	number	Destination port	`dst_port`	no	careful	destination.port
`DstSubnetLabel`	string	Destination subnet label	`dst_subnet_label`	no	fine	destination.subnet.label
`Flags`	string[]	List of TCP flags comprised in the flow, according to RFC-9293, with additional custom flags to represent the following per-packet combinations: - SYN_ACK - FIN_ACK - RST_ACK	`tcp_flags`	no	careful	tcp.flags
`FlowDirection`	number	Flow interpreted direction from the node observation point. Can be one of: - 0: Ingress (incoming traffic, from the node observation point) - 1: Egress (outgoing traffic, from the node observation point) - 2: Inner (with the same source and destination node)	`node_direction`	yes	fine	host.direction
`IPSecStatus`	string	Status of the IPsec encryption (on egress, given by the kernel xfrm_output function) or decryption (on ingress, via xfrm_input)	`ipsec_status`	no	fine	ipsec.status
`IcmpCode`	number	ICMP code	`icmp_code`	no	fine	icmp.code
`IcmpType`	number	ICMP type	`icmp_type`	no	fine	icmp.type
`IfDirections`	number[]	Flow directions from the network interface observation point. Can be one of: - 0: Ingress (interface incoming traffic) - 1: Egress (interface outgoing traffic)	`ifdirections`	no	fine	interface.directions
`Interfaces`	string[]	Network interfaces	`interfaces`	no	careful	interface.names
`K8S_ClusterName`	string	Cluster name or identifier	`cluster_name`	yes	fine	k8s.cluster.name
`K8S_FlowLayer`	string	Flow layer: 'app' or 'infra'	`flow_layer`	yes	fine	k8s.layer
`NetworkEvents`	object[]	Network events, such as network policy actions, composed of nested fields: - Feature (such as "acl" for network policies) - Type (such as an "AdminNetworkPolicy") - Namespace (namespace where the event applies, if any) - Name (name of the resource that triggered the event) - Action (such as "allow" or "drop") - Direction (Ingress or Egress)	`network_events`	no	avoid	n/a
`Packets`	number	Number of packets	n/a	no	avoid	packets
`PktDropBytes`	number	Number of bytes dropped by the kernel	n/a	no	avoid	drops.bytes
`PktDropLatestDropCause`	string	Latest drop cause	`pkt_drop_cause`	no	fine	drops.latestcause
`PktDropLatestFlags`	number	TCP flags on last dropped packet	n/a	no	fine	drops.latestflags
`PktDropLatestState`	string	TCP state on last dropped packet	`pkt_drop_state`	no	fine	drops.lateststate
`PktDropPackets`	number	Number of packets dropped by the kernel	n/a	no	avoid	drops.packets
`Proto`	number	L4 protocol	`protocol`	no	fine	protocol
`Sampling`	number	Sampling interval used for this flow	n/a	no	fine	n/a
`SrcAddr`	string	Source IP address (ipv4 or ipv6)	`src_address`	no	avoid	source.address
`SrcK8S_HostIP`	string	Source node IP	`src_host_address`	no	fine	source.k8s.host.address
`SrcK8S_HostName`	string	Source node name	`src_host_name`	no	fine	source.k8s.host.name
`SrcK8S_Name`	string	Name of the source Kubernetes object, such as Pod name, Service name or Node name.	`src_name`	no	careful	source.k8s.name
`SrcK8S_Namespace`	string	Source namespace	`src_namespace`	yes	fine	source.k8s.namespace.name
`SrcK8S_NetworkName`	string	Source network name	`src_network`	no	fine	source.network.name
`SrcK8S_OwnerName`	string	Name of the source owner, such as Deployment name, StatefulSet name, etc.	`src_owner_name`	yes	fine	source.k8s.owner.name
`SrcK8S_OwnerType`	string	Kind of the source owner, such as Deployment, StatefulSet, etc.	`src_kind`	no	fine	source.k8s.owner.kind
`SrcK8S_Type`	string	Kind of the source Kubernetes object, such as Pod, Service or Node.	`src_kind`	yes	fine	source.k8s.kind
`SrcK8S_Zone`	string	Source availability zone	`src_zone`	yes	fine	source.zone
`SrcMac`	string	Source MAC address	`src_mac`	no	avoid	source.mac
`SrcPort`	number	Source port	`src_port`	no	careful	source.port
`SrcSubnetLabel`	string	Source subnet label	`src_subnet_label`	no	fine	source.subnet.label
`TLSCipherSuite`	string	TLS cipher suite	`tls_cipher_suite`	no	fine	tls.ciphersuite
`TLSGroup`	string	TLS group name	`tls_group`	no	fine	tls.group
`TLSTypes`	string[]	TLS message types (bitfield)	`tls_types`	no	careful	tls.types
`TLSVersion`	string	TLS version	`tls_version`	no	fine	tls.version
`TimeFlowEndMs`	number	End timestamp of this flow, in milliseconds	n/a	no	avoid	timeflowend
`TimeFlowRttNs`	number	TCP Smoothed Round Trip Time (SRTT), in nanoseconds	`time_flow_rtt`	no	avoid	tcp.rtt
`TimeFlowStartMs`	number	Start timestamp of this flow, in milliseconds	n/a	no	avoid	timeflowstart
`TimeReceived`	number	Timestamp when this flow was received and processed by the flow collector, in seconds	n/a	no	avoid	timereceived
`Udns`	string[]	List of User Defined Networks	`udns`	no	careful	n/a
`XlatDstAddr`	string	packet translation destination address	`xlat_dst_address`	no	avoid	n/a
`XlatDstPort`	number	packet translation destination port	`xlat_dst_port`	no	careful	n/a
`XlatSrcAddr`	string	packet translation source address	`xlat_src_address`	no	avoid	n/a
`XlatSrcPort`	number	packet translation source port	`xlat_src_port`	no	careful	n/a
`ZoneId`	number	packet translation zone id	`xlat_zone_id`	no	avoid	n/a
`_HashId`	string	In conversation tracking, the conversation identifier	`id`	no	avoid	n/a
`_RecordType`	string	Type of record: `flowLog` for regular flow logs, or `newConnection`, `heartbeat`, `endConnection` for conversation tracking	`type`	yes	fine	n/a