Chapter 10. Network flows format reference These are the specifications for network flows format, used both internally and when exporting flows to Kafka. 10.1. Network Flows format reference This is the specification of the network flows format, used both internally and when exporting flows to Kafka. The document is organized in two main categories: Labels and regular Fields . This distinction only matters when querying Loki. This is because Labels , unlike Fields , must be used in stream selectors . If you are reading this specification as a reference for the Kafka export feature, you must treat all Labels and Fields as regular fields and ignore any distinctions between them that are specific to Loki. 10.1.1. Labels SrcK8S_Namespace Optional SrcK8S_Namespace : string Source namespace DstK8S_Namespace Optional DstK8S_Namespace : string Destination namespace SrcK8S_OwnerName Optional SrcK8S_OwnerName : string Source owner, such as Deployment, StatefulSet, etc. DstK8S_OwnerName Optional DstK8S_OwnerName : string Destination owner, such as Deployment, StatefulSet, etc. FlowDirection FlowDirection : FlowDirection (see the following section, Enumeration: FlowDirection) Flow direction from the node observation point _RecordType Optional _RecordType : RecordType Type of record: 'flowLog' for regular flow logs, or 'allConnections', 'newConnection', 'heartbeat', 'endConnection' for conversation tracking 10.1.2. Fields SrcAddr SrcAddr : string Source IP address (ipv4 or ipv6) DstAddr DstAddr : string Destination IP address (ipv4 or ipv6) SrcMac SrcMac : string Source MAC address DstMac DstMac : string Destination MAC address SrcK8S_Name Optional SrcK8S_Name : string Name of the source matched Kubernetes object, such as Pod name, Service name, etc. DstK8S_Name Optional DstK8S_Name : string Name of the destination matched Kubernetes object, such as Pod name, Service name, etc. SrcK8S_Type Optional SrcK8S_Type : string Kind of the source matched Kubernetes object, such as Pod, Service, etc. DstK8S_Type Optional DstK8S_Type : string Kind of the destination matched Kubernetes object, such as Pod name, Service name, etc. SrcPort Optional SrcPort : number Source port DstPort Optional DstPort : number Destination port SrcK8S_OwnerType Optional SrcK8S_OwnerType : string Kind of the source Kubernetes owner, such as Deployment, StatefulSet, etc. DstK8S_OwnerType Optional DstK8S_OwnerType : string Kind of the destination Kubernetes owner, such as Deployment, StatefulSet, etc. SrcK8S_HostIP Optional SrcK8S_HostIP : string Source node IP DstK8S_HostIP Optional DstK8S_HostIP : string Destination node IP SrcK8S_HostName Optional SrcK8S_HostName : string Source node name DstK8S_HostName Optional DstK8S_HostName : string Destination node name Proto Proto : number L4 protocol Interface Optional Interface : string Network interface IfDirection Optional IfDirection : InterfaceDirection (see the following section, Enumeration: InterfaceDirection) Flow direction from the network interface observation point Flags Optional Flags : number TCP flags Packets Optional Packets : number Number of packets Packets_AB Optional Packets_AB : number In conversation tracking, A to B packets counter per conversation Packets_BA Optional Packets_BA : number In conversation tracking, B to A packets counter per conversation Bytes Optional Bytes : number Number of bytes Bytes_AB Optional Bytes_AB : number In conversation tracking, A to B bytes counter per conversation Bytes_BA Optional Bytes_BA : number In conversation tracking, B to A bytes counter per conversation IcmpType Optional IcmpType : number ICMP type IcmpCode Optional IcmpCode : number ICMP code PktDropLatestState Optional PktDropLatestState : string Pkt TCP state for drops PktDropLatestDropCause Optional PktDropLatestDropCause : string Pkt cause for drops PktDropLatestFlags Optional PktDropLatestFlags : number Pkt TCP flags for drops PktDropPackets Optional PktDropPackets : number Number of packets dropped by the kernel PktDropPackets_AB Optional PktDropPackets_AB : number In conversation tracking, A to B packets dropped counter per conversation PktDropPackets_BA Optional PktDropPackets_BA : number In conversation tracking, B to A packets dropped counter per conversation PktDropBytes Optional PktDropBytes : number Number of bytes dropped by the kernel PktDropBytes_AB Optional PktDropBytes_AB : number In conversation tracking, A to B bytes dropped counter per conversation PktDropBytes_BA Optional PktDropBytes_BA : number In conversation tracking, B to A bytes dropped counter per conversation DnsId Optional DnsId : number DNS record id DnsFlags Optional DnsFlags : number DNS flags for DNS record DnsFlagsResponseCode Optional DnsFlagsResponseCode : string Parsed DNS header RCODEs name DnsLatencyMs Optional DnsLatencyMs : number Calculated time between response and request, in milliseconds TimeFlowStartMs TimeFlowStartMs : number Start timestamp of this flow, in milliseconds TimeFlowEndMs TimeFlowEndMs : number End timestamp of this flow, in milliseconds TimeReceived TimeReceived : number Timestamp when this flow was received and processed by the flow collector, in seconds TimeFlowRttNs Optional TimeFlowRttNs : number Flow Round Trip Time (RTT) in nanoseconds _HashId Optional _HashId : string In conversation tracking, the conversation identifier _IsFirst Optional _IsFirst : string In conversation tracking, a flag identifying the first flow numFlowLogs Optional numFlowLogs : number In conversation tracking, a counter of flow logs per conversation 10.1.3. Enumeration: FlowDirection Ingress Ingress = "0" Incoming traffic, from the node observation point Egress Egress = "1" Outgoing traffic, from the node observation point Inner Inner = "2" Inner traffic, with the same source and destination node

Commands: