A method for monitoring application level flow by an intermediary device between a client and a server (1702, 1704) hosting a database, comprising: receiving, by an intermediary device from a client device, a first database request designated for a server (1702, 1704) hosting a database having a first type, the first database request comprising a request type and a request string the intermediary device identifying from parameters of the first database request each of the first type of database, the request type and the request string, wherein the request type comprises one of a read type of request or a write type of request; identifying, by the intermediary device, that a parameter of the first database request matches a parameter of a first policy of a set of one or more policies; generating, by the intermediary device responsive to the identification, a first Internet Protocol Flow Information Export, IPFIX, message comprising an identification of the first type of database, an identification of the request type of the first database request, and the request string of the first database request; selecting, by the intermediary device, the server (1702, 1704) from a plurality of servers (1702, 1704) based on the request type, the intermediary device configured to select a master server for write type of requests and a slave server having a copy of the database for read type of requests; transmitting, by the intermediary device to the server (1702, 1704), the first database request; receiving, by the intermediary device from the server (1702, 1704), a first response to the first database request, the first response comprising a response status and a response string; determining, by the intermediary device, that the first response corresponds to the first database request; generating, by the intermediary device responsive to the determination, a second IPFIX message comprising an identification of the response status and the response string of the first response; and aggregating, by the intermediary device, the first IPFIX message and the second IPFIX message into an application flow record. receiving, by an intermediary device from a client device, a first database request designated for a server (1702, 1704) hosting a database having a first type, the first database request comprising a request type and a request string the intermediary device identifying from parameters of the first database request each of the first type of database, the request type and the request string, wherein the request type comprises one of a read type of request or a write type of request; identifying, by the intermediary device, that a parameter of the first database request matches a parameter of a first policy of a set of one or more policies; generating, by the intermediary device responsive to the identification, a first Internet Protocol Flow Information Export, IPFIX, message comprising an identification of the first type of database, an identification of the request type of the first database request, and the request string of the first database request; selecting, by the intermediary device, the server (1702, 1704) from a plurality of servers (1702, 1704) based on the request type, the intermediary device configured to select a master server for write type of requests and a slave server having a copy of the database for read type of requests; transmitting, by the intermediary device to the server (1702, 1704), the first database request; receiving, by the intermediary device from the server (1702, 1704), a first response to the first database request, the first response comprising a response status and a response string; determining, by the intermediary device, that the first response corresponds to the first database request; generating, by the intermediary device responsive to the determination, a second IPFIX message comprising an identification of the response status and the response string of the first response; and aggregating, by the intermediary device, the first IPFIX message and the second IPFIX message into an application flow record.