Network flows format reference

Review the specifications for the network flow format, which is used internally and for exporting flow data to Kafka.

Network Flows format reference

This is the specification of the network flows format. That format is used when a Kafka exporter is configured, for Prometheus metrics labels as well as internally for the Loki store.

The "Filter ID" column shows which related name to use when defining Quick Filters (see spec.consolePlugin.quickFilters in the FlowCollector specification).

The "Loki label" column is useful when querying Loki directly: label fields need to be selected using stream selectors.

The "Cardinality" column gives information about the implied metric cardinality if this field was to be used as a Prometheus label with the FlowMetrics API. Refer to the FlowMetrics documentation for more information on using this API.

Name	Type	Description	Filter ID	Loki label	Cardinality	OpenTelemetry
Bytes	number	Number of bytes	n/a	no	avoid	bytes
DnsErrno	number	Error number returned from DNS tracker ebpf hook function	dns_errno	no	fine	dns.errno
DnsFlags	number	DNS flags for DNS record	n/a	no	fine	dns.flags
DnsFlagsResponseCode	string	Parsed DNS header RCODEs name	dns_flag_response_code	no	fine	dns.responsecode
DnsId	number	DNS record id	dns_id	no	avoid	dns.id
DnsLatencyMs	number	Time between a DNS request and response, in milliseconds	dns_latency	no	avoid	dns.latency
DnsName	string	DNS queried name	dns_name	no	careful	dns.name
Dscp	number	Differentiated Services Code Point (DSCP) value	dscp	no	fine	dscp
DstAddr	string	Destination IP address (ipv4 or ipv6)	dst_address	no	avoid	destination.address
DstK8S_HostIP	string	Destination node IP	dst_host_address	no	fine	destination.k8s.host.address
DstK8S_HostName	string	Destination node name	dst_host_name	no	fine	destination.k8s.host.name
DstK8S_Name	string	Name of the destination Kubernetes object, such as Pod name, Service name or Node name.	dst_name	no	careful	destination.k8s.name
DstK8S_Namespace	string	Destination namespace	dst_namespace	yes	fine	destination.k8s.namespace.name
DstK8S_NetworkName	string	Destination network name	dst_network	no	fine	destination.network.name
DstK8S_OwnerName	string	Name of the destination owner, such as Deployment name, StatefulSet name, etc.	dst_owner_name	yes	fine	destination.k8s.owner.name
DstK8S_OwnerType	string	Kind of the destination owner, such as Deployment, StatefulSet, etc.	dst_kind	no	fine	destination.k8s.owner.kind
DstK8S_Type	string	Kind of the destination Kubernetes object, such as Pod, Service or Node.	dst_kind	yes	fine	destination.k8s.kind
DstK8S_Zone	string	Destination availability zone	dst_zone	yes	fine	destination.zone
DstMac	string	Destination MAC address	dst_mac	no	avoid	destination.mac
DstPort	number	Destination port	dst_port	no	careful	destination.port
DstSubnetLabel	string	Destination subnet label	dst_subnet_label	no	fine	destination.subnet.label
Flags	string[]	List of TCP flags comprised in the flow, according to RFC-9293, with additional custom flags to represent the following per-packet combinations: - SYN_ACK - FIN_ACK - RST_ACK	tcp_flags	no	careful	tcp.flags
FlowDirection	number	Flow interpreted direction from the node observation point. Can be one of: - 0: Ingress (incoming traffic, from the node observation point) - 1: Egress (outgoing traffic, from the node observation point) - 2: Inner (with the same source and destination node)	node_direction	yes	fine	host.direction
IPSecStatus	string	Status of the IPsec encryption (on egress, given by the kernel xfrm_output function) or decryption (on ingress, via xfrm_input)	ipsec_status	no	fine	ipsec.status
IcmpCode	number	ICMP code	icmp_code	no	fine	icmp.code
IcmpType	number	ICMP type	icmp_type	no	fine	icmp.type
IfDirections	number[]	Flow directions from the network interface observation point. Can be one of: - 0: Ingress (interface incoming traffic) - 1: Egress (interface outgoing traffic)	ifdirections	no	fine	interface.directions
Interfaces	string[]	Network interfaces	interfaces	no	careful	interface.names
K8S_ClusterName	string	Cluster name or identifier	cluster_name	yes	fine	k8s.cluster.name
K8S_FlowLayer	string	Flow layer: 'app' or 'infra'	flow_layer	yes	fine	k8s.layer
NetworkEvents	object[]	Network events, such as network policy actions, composed of nested fields: - Feature (such as "acl" for network policies) - Type (such as an "AdminNetworkPolicy") - Namespace (namespace where the event applies, if any) - Name (name of the resource that triggered the event) - Action (such as "allow" or "drop") - Direction (Ingress or Egress)	network_events	no	avoid	n/a
Packets	number	Number of packets	n/a	no	avoid	packets
PktDropBytes	number	Number of bytes dropped by the kernel	n/a	no	avoid	drops.bytes
PktDropLatestDropCause	string	Latest drop cause	pkt_drop_cause	no	fine	drops.latestcause
PktDropLatestFlags	number	TCP flags on last dropped packet	n/a	no	fine	drops.latestflags
PktDropLatestState	string	TCP state on last dropped packet	pkt_drop_state	no	fine	drops.lateststate
PktDropPackets	number	Number of packets dropped by the kernel	n/a	no	avoid	drops.packets
Proto	number	L4 protocol	protocol	no	fine	protocol
Sampling	number	Sampling interval used for this flow	n/a	no	fine	n/a
SrcAddr	string	Source IP address (ipv4 or ipv6)	src_address	no	avoid	source.address
SrcK8S_HostIP	string	Source node IP	src_host_address	no	fine	source.k8s.host.address
SrcK8S_HostName	string	Source node name	src_host_name	no	fine	source.k8s.host.name
SrcK8S_Name	string	Name of the source Kubernetes object, such as Pod name, Service name or Node name.	src_name	no	careful	source.k8s.name
SrcK8S_Namespace	string	Source namespace	src_namespace	yes	fine	source.k8s.namespace.name
SrcK8S_NetworkName	string	Source network name	src_network	no	fine	source.network.name
SrcK8S_OwnerName	string	Name of the source owner, such as Deployment name, StatefulSet name, etc.	src_owner_name	yes	fine	source.k8s.owner.name
SrcK8S_OwnerType	string	Kind of the source owner, such as Deployment, StatefulSet, etc.	src_kind	no	fine	source.k8s.owner.kind
SrcK8S_Type	string	Kind of the source Kubernetes object, such as Pod, Service or Node.	src_kind	yes	fine	source.k8s.kind
SrcK8S_Zone	string	Source availability zone	src_zone	yes	fine	source.zone
SrcMac	string	Source MAC address	src_mac	no	avoid	source.mac
SrcPort	number	Source port	src_port	no	careful	source.port
SrcSubnetLabel	string	Source subnet label	src_subnet_label	no	fine	source.subnet.label
TLSCipherSuite	string	TLS cipher suite	tls_cipher_suite	no	fine	tls.ciphersuite
TLSGroup	string	TLS group name	tls_group	no	fine	tls.group
TLSTypes	string[]	TLS message types (bitfield)	tls_types	no	careful	tls.types
TLSVersion	string	TLS version	tls_version	no	fine	tls.version
TimeFlowEndMs	number	End timestamp of this flow, in milliseconds	n/a	no	avoid	timeflowend
TimeFlowRttNs	number	TCP Smoothed Round Trip Time (SRTT), in nanoseconds	time_flow_rtt	no	avoid	tcp.rtt
TimeFlowStartMs	number	Start timestamp of this flow, in milliseconds	n/a	no	avoid	timeflowstart
TimeReceived	number	Timestamp when this flow was received and processed by the flow collector, in seconds	n/a	no	avoid	timereceived
Udns	string[]	List of User Defined Networks	udns	no	careful	n/a
XlatDstAddr	string	packet translation destination address	xlat_dst_address	no	avoid	n/a
XlatDstPort	number	packet translation destination port	xlat_dst_port	no	careful	n/a
XlatSrcAddr	string	packet translation source address	xlat_src_address	no	avoid	n/a
XlatSrcPort	number	packet translation source port	xlat_src_port	no	careful	n/a
ZoneId	number	packet translation zone id	xlat_zone_id	no	avoid	n/a
_HashId	string	In conversation tracking, the conversation identifier	id	no	avoid	n/a
_RecordType	string	Type of record: flowLog for regular flow logs, or newConnection, heartbeat, endConnection for conversation tracking	type	yes	fine	n/a