Chapter 10. Network flows format reference
These are the specifications for network flows format, used both internally and when exporting flows to Kafka.
10.1. Network Flows format reference
This is the specification of the network flows format, used both internally and when exporting flows to Kafka.
The document is organized in two main categories: Labels and regular Fields. This distinction only matters when querying Loki. This is because Labels, unlike Fields, must be used in stream selectors.
If you are reading this specification as a reference for the Kafka export feature, you must treat all Labels and Fields as regular fields and ignore any distinctions between them that are specific to Loki.
10.1.1. Labels
- SrcK8S_Namespace
-
OptionalSrcK8S_Namespace:string
-
Source namespace
- DstK8S_Namespace
-
OptionalDstK8S_Namespace:string
-
Destination namespace
- SrcK8S_OwnerName
-
OptionalSrcK8S_OwnerName:string
-
Source owner, such as Deployment, StatefulSet, etc.
- DstK8S_OwnerName
-
OptionalDstK8S_OwnerName:string
-
Destination owner, such as Deployment, StatefulSet, etc.
- FlowDirection
-
FlowDirection:
FlowDirection(see the following section, Enumeration: FlowDirection)
-
FlowDirection:
Flow direction from the node observation point
- _RecordType
-
Optional_RecordType:RecordType
-
Type of record: 'flowLog' for regular flow logs, or 'allConnections', 'newConnection', 'heartbeat', 'endConnection' for conversation tracking
10.1.2. Fields
- SrcAddr
-
SrcAddr:
string
-
SrcAddr:
Source IP address (ipv4 or ipv6)
- DstAddr
-
DstAddr:
string
-
DstAddr:
Destination IP address (ipv4 or ipv6)
- SrcMac
-
SrcMac:
string
-
SrcMac:
Source MAC address
- DstMac
-
DstMac:
string
-
DstMac:
Destination MAC address
- SrcK8S_Name
-
OptionalSrcK8S_Name:string
-
Name of the source matched Kubernetes object, such as Pod name, Service name, etc.
- DstK8S_Name
-
OptionalDstK8S_Name:string
-
Name of the destination matched Kubernetes object, such as Pod name, Service name, etc.
- SrcK8S_Type
-
OptionalSrcK8S_Type:string
-
Kind of the source matched Kubernetes object, such as Pod, Service, etc.
- DstK8S_Type
-
OptionalDstK8S_Type:string
-
Kind of the destination matched Kubernetes object, such as Pod name, Service name, etc.
- SrcPort
-
OptionalSrcPort:number
-
Source port
- DstPort
-
OptionalDstPort:number
-
Destination port
- SrcK8S_OwnerType
-
OptionalSrcK8S_OwnerType:string
-
Kind of the source Kubernetes owner, such as Deployment, StatefulSet, etc.
- DstK8S_OwnerType
-
OptionalDstK8S_OwnerType:string
-
Kind of the destination Kubernetes owner, such as Deployment, StatefulSet, etc.
- SrcK8S_HostIP
-
OptionalSrcK8S_HostIP:string
-
Source node IP
- DstK8S_HostIP
-
OptionalDstK8S_HostIP:string
-
Destination node IP
- SrcK8S_HostName
-
OptionalSrcK8S_HostName:string
-
Source node name
- DstK8S_HostName
-
OptionalDstK8S_HostName:string
-
Destination node name
- Proto
-
Proto:
number
-
Proto:
L4 protocol
- Interface
-
OptionalInterface:string
-
Network interface
- IfDirection
-
OptionalIfDirection:InterfaceDirection(see the following section, Enumeration: InterfaceDirection)
-
Flow direction from the network interface observation point
- Flags
-
OptionalFlags:number
-
TCP flags
- Packets
-
OptionalPackets:number
-
Number of packets
- Packets_AB
-
OptionalPackets_AB:number
-
In conversation tracking, A to B packets counter per conversation
- Packets_BA
-
OptionalPackets_BA:number
-
In conversation tracking, B to A packets counter per conversation
- Bytes
-
OptionalBytes:number
-
Number of bytes
- Bytes_AB
-
OptionalBytes_AB:number
-
In conversation tracking, A to B bytes counter per conversation
- Bytes_BA
-
OptionalBytes_BA:number
-
In conversation tracking, B to A bytes counter per conversation
- IcmpType
-
OptionalIcmpType:number
-
ICMP type
- IcmpCode
-
OptionalIcmpCode:number
-
ICMP code
- PktDropLatestState
-
OptionalPktDropLatestState:string
-
Pkt TCP state for drops
- PktDropLatestDropCause
-
OptionalPktDropLatestDropCause:string
-
Pkt cause for drops
- PktDropLatestFlags
-
OptionalPktDropLatestFlags:number
-
Pkt TCP flags for drops
- PktDropPackets
-
OptionalPktDropPackets:number
-
Number of packets dropped by the kernel
- PktDropPackets_AB
-
OptionalPktDropPackets_AB:number
-
In conversation tracking, A to B packets dropped counter per conversation
- PktDropPackets_BA
-
OptionalPktDropPackets_BA:number
-
In conversation tracking, B to A packets dropped counter per conversation
- PktDropBytes
-
OptionalPktDropBytes:number
-
Number of bytes dropped by the kernel
- PktDropBytes_AB
-
OptionalPktDropBytes_AB:number
-
In conversation tracking, A to B bytes dropped counter per conversation
- PktDropBytes_BA
-
OptionalPktDropBytes_BA:number
-
In conversation tracking, B to A bytes dropped counter per conversation
- DnsId
-
OptionalDnsId:number
-
DNS record id
- DnsFlags
-
OptionalDnsFlags:number
-
DNS flags for DNS record
- DnsFlagsResponseCode
-
OptionalDnsFlagsResponseCode:string
-
Parsed DNS header RCODEs name
- DnsLatencyMs
-
OptionalDnsLatencyMs:number
-
Calculated time between response and request, in milliseconds
- TimeFlowStartMs
-
TimeFlowStartMs:
number
-
TimeFlowStartMs:
Start timestamp of this flow, in milliseconds
- TimeFlowEndMs
-
TimeFlowEndMs:
number
-
TimeFlowEndMs:
End timestamp of this flow, in milliseconds
- TimeReceived
-
TimeReceived:
number
-
TimeReceived:
Timestamp when this flow was received and processed by the flow collector, in seconds
- TimeFlowRttNs
-
OptionalTimeFlowRttNs:number
-
Flow Round Trip Time (RTT) in nanoseconds
- _HashId
-
Optional_HashId:string
-
In conversation tracking, the conversation identifier
- _IsFirst
-
Optional_IsFirst:string
-
In conversation tracking, a flag identifying the first flow
- numFlowLogs
-
OptionalnumFlowLogs:number
-
In conversation tracking, a counter of flow logs per conversation
10.1.3. Enumeration: FlowDirection
- Ingress
-
Ingress =
"0"
-
Ingress =
Incoming traffic, from the node observation point
- Egress
-
Egress =
"1"
-
Egress =
Outgoing traffic, from the node observation point
- Inner
-
Inner =
"2"
-
Inner =
Inner traffic, with the same source and destination node
