×

These are the specifications for network flows format, used both internally and when exporting flows to Kafka.

Network Flows format reference

The document is organized in two main categories: Labels and regular Fields. This distinction only matters when querying Loki. This is because Labels, unlike Fields, must be used in stream selectors.

If you are reading this specification as a reference for the Kafka export feature, you must treat all Labels and Fields as regualr fields and ignore any distinctions between them that are specific to Loki.

Labels


SrcK8S_Namespace
  • Optional SrcK8S_Namespace: string

Source namespace


DstK8S_Namespace
  • Optional DstK8S_Namespace: string

Destination namespace


SrcK8S_OwnerName
  • Optional SrcK8S_OwnerName: string

Source owner, such as Deployment, StatefulSet, etc.


DstK8S_OwnerName
  • Optional DstK8S_OwnerName: string

Destination owner, such as Deployment, StatefulSet, etc.


FlowDirection
  • FlowDirection: see the following section, Enumeration: FlowDirection for more details.

Flow direction from the node observation point


_RecordType
  • Optional _RecordType: RecordType

Type of record: 'flowLog' for regular flow logs, or 'allConnections', 'newConnection', 'heartbeat', 'endConnection' for conversation tracking

Fields


SrcAddr
  • SrcAddr: string

Source IP address (ipv4 or ipv6)


DstAddr
  • DstAddr: string

Destination IP address (ipv4 or ipv6)


SrcMac
  • SrcMac: string

Source MAC address


DstMac
  • DstMac: string

Destination MAC address


SrcK8S_Name
  • Optional SrcK8S_Name: string

Name of the source matched Kubernetes object, such as Pod name, Service name, etc.


DstK8S_Name
  • Optional DstK8S_Name: string

Name of the destination matched Kubernetes object, such as Pod name, Service name, etc.


SrcK8S_Type
  • Optional SrcK8S_Type: string

Kind of the source matched Kubernetes object, such as Pod, Service, etc.


DstK8S_Type
  • Optional DstK8S_Type: string

Kind of the destination matched Kubernetes object, such as Pod name, Service name, etc.


SrcPort
  • SrcPort: number

Source port


DstPort
  • DstPort: number

Destination port


SrcK8S_OwnerType
  • Optional SrcK8S_OwnerType: string

Kind of the source Kubernetes owner, such as Deployment, StatefulSet, etc.


DstK8S_OwnerType
  • Optional DstK8S_OwnerType: string

Kind of the destination Kubernetes owner, such as Deployment, StatefulSet, etc.


SrcK8S_HostIP
  • Optional SrcK8S_HostIP: string

Source node IP


DstK8S_HostIP
  • Optional DstK8S_HostIP: string

Destination node IP


SrcK8S_HostName
  • Optional SrcK8S_HostName: string

Source node name


DstK8S_HostName
  • Optional DstK8S_HostName: string

Destination node name


Proto
  • Proto: number

L4 protocol


Interface
  • Optional Interface: string

Network interface


Packets
  • Packets: number

Number of packets in this flow


Packets_AB
  • Optional Packets_AB: number

In conversation tracking, A to B packets counter per conversation


Packets_BA
  • Optional Packets_BA: number

In conversation tracking, B to A packets counter per conversation


Bytes
  • Bytes: number

Number of bytes in this flow


Bytes_AB
  • Optional Bytes_AB: number

In conversation tracking, A to B bytes counter per conversation


Bytes_BA
  • Optional Bytes_BA: number

In conversation tracking, B to A bytes counter per conversation


TimeFlowStartMs
  • TimeFlowStartMs: number

Start timestamp of this flow, in milliseconds


TimeFlowEndMs
  • TimeFlowEndMs: number

End timestamp of this flow, in milliseconds


TimeReceived
  • TimeReceived: number

Timestamp when this flow was received and processed by the flow collector, in seconds


_HashId
  • Optional _HashId: string

In conversation tracking, the conversation identifier


_IsFirst
  • Optional _IsFirst: string

In conversation tracking, a flag identifying the first flow


numFlowLogs
  • Optional numFlowLogs: number

In conversation tracking, a counter of flow logs per conversation

Enumeration: FlowDirection


Ingress
  • Ingress = "0"

Incoming traffic, from node observation point


Egress
  • Egress = "1"

Outgoing traffic, from node observation point