1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([["3790"],{39920:function(e,t,s){s.r(t),s.d(t,{default:()=>h,frontMatter:()=>r,metadata:()=>d,assets:()=>o,toc:()=>l,contentTitle:()=>c});var d=JSON.parse('{"id":"visibility/elastic/l7/datatypes","title":"L7 log data types","description":"L7 data that Calico Enterprise sends to Elasticsearch.","source":"@site/calico-enterprise_versioned_docs/version-3.17/visibility/elastic/l7/datatypes.mdx","sourceDirName":"visibility/elastic/l7","slug":"/visibility/elastic/l7/datatypes","permalink":"/calico-enterprise/3.17/visibility/elastic/l7/datatypes","draft":false,"unlisted":false,"editUrl":"https://github.com/tigera/docs/edit/main/calico-enterprise_versioned_docs/version-3.17/visibility/elastic/l7/datatypes.mdx","tags":[],"version":"3.17","frontMatter":{"description":"L7 data that Calico Enterprise sends to Elasticsearch."},"sidebar":"calicoEnterpriseSidebar","previous":{"title":"Configure L7 logs","permalink":"/calico-enterprise/3.17/visibility/elastic/l7/configure"},"next":{"title":"Troubleshoot logs","permalink":"/calico-enterprise/3.17/visibility/elastic/troubleshoot"}}'),n=s("85893"),i=s("50065");let r={description:"L7 data that Calico Enterprise sends to Elasticsearch."},c="L7 log data types",o={},l=[{value:"Big picture",id:"big-picture",level:2}];function a(e){let t={a:"a",code:"code",h1:"h1",h2:"h2",header:"header",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,i.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.header,{children:(0,n.jsx)(t.h1,{id:"l7-log-data-types",children:"L7 log data types"})}),"\n",(0,n.jsx)(t.h2,{id:"big-picture",children:"Big picture"}),"\n",(0,n.jsx)(t.p,{children:"Calico Enterprise sends the following data to Elasticsearch."}),"\n",(0,n.jsxs)(t.p,{children:["The following table details the key/value pairs in the JSON blob, including their ",(0,n.jsx)(t.a,{href:"https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html",children:"Elasticsearch datatype"}),"."]}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"Name"}),(0,n.jsx)(t.th,{children:"Datatype"}),(0,n.jsx)(t.th,{children:"Description"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"host"})}),(0,n.jsx)(t.td,{children:"keyword"}),(0,n.jsx)(t.td,{children:"Name of the node that collected the L7 log entry."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"start_time"})}),(0,n.jsx)(t.td,{children:"date"}),(0,n.jsx)(t.td,{children:"Start time of log collection in UNIX timestamp format."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"end_time"})}),(0,n.jsx)(t.td,{children:"date"}),(0,n.jsx)(t.td,{children:"End time of log collection in UNIX timestamp format."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"bytes_in"})}),(0,n.jsx)(t.td,{children:"long"}),(0,n.jsx)(t.td,{children:"Number of incoming bytes since the last export."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"bytes_out"})}),(0,n.jsx)(t.td,{children:"long"}),(0,n.jsx)(t.td,{children:"Number of outgoing bytes since the last export."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"duration_mean"})}),(0,n.jsx)(t.td,{children:"long"}),(0,n.jsx)(t.td,{children:"Mean duration time of all the requests that match this combination of L7 data in nanoseconds."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"duration_max"})}),(0,n.jsx)(t.td,{children:"long"}),(0,n.jsx)(t.td,{children:"Max duration time of all the requests that match this combination of L7 data in nanoseconds."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"count"})}),(0,n.jsx)(t.td,{children:"long"}),(0,n.jsx)(t.td,{children:"Number of requests that match this combination of L7 data."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"src_name_aggr"})}),(0,n.jsx)(t.td,{children:"keyword"}),(0,n.jsxs)(t.td,{children:["Contains one of the following values:",(0,n.jsx)("br",{}),"- Aggregated name of the source pod. ",(0,n.jsx)("br",{}),"- ",(0,n.jsx)(t.code,{children:"pvt"}),": endpoint is not a pod. Its IP address belongs to a private subnet. ",(0,n.jsx)("br",{}),"- ",(0,n.jsx)(t.code,{children:"pub"}),": endpoint is not a pod. Its IP address does not belong to a private subnet. It is probably an endpoint on the public internet."]})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"src_namespace"})}),(0,n.jsx)(t.td,{children:"keyword"}),(0,n.jsx)(t.td,{children:"Namespace of the source endpoint."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"src_type"})}),(0,n.jsx)(t.td,{children:"keyword"}),(0,n.jsxs)(t.td,{children:["Source endpoint type. Possible values:",(0,n.jsx)("br",{}),"- ",(0,n.jsx)(t.code,{children:"wep"}),": A workload endpoint, a pod in Kubernetes.",(0,n.jsx)("br",{}),"- ",(0,n.jsx)(t.code,{children:"ns"}),": A Networkset. If multiple Networksets match, then the one with the longest prefix match is chosen.",(0,n.jsx)("br",{}),"- ",(0,n.jsx)(t.code,{children:"net"}),": A Network. The IP address did not fall into a known endpoint type."]})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"dest_name_aggr"})}),(0,n.jsx)(t.td,{children:"keyword"}),(0,n.jsxs)(t.td,{children:["Contains one of the following values:",(0,n.jsx)("br",{}),"- Aggregated name of the destination pod. ",(0,n.jsx)("br",{}),"- ",(0,n.jsx)(t.code,{children:"pvt"}),": endpoint is not a pod. Its IP address belongs to a private subnet. ",(0,n.jsx)("br",{}),"- ",(0,n.jsx)(t.code,{children:"pub"}),": endpoint is not a pod. Its IP address does not belong to a private subnet. It is probably an endpoint on the public internet."]})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"dest_namespace"})}),(0,n.jsx)(t.td,{children:"keyword"}),(0,n.jsx)(t.td,{children:"Namespace of the destination endpoint."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"dest_type"})}),(0,n.jsx)(t.td,{children:"keyword"}),(0,n.jsxs)(t.td,{children:["Destination endpoint type. Possible values:",(0,n.jsx)("br",{}),"- ",(0,n.jsx)(t.code,{children:"wep"}),": A workload endpoint, a pod in Kubernetes.",(0,n.jsx)("br",{}),"- ",(0,n.jsx)(t.code,{children:"ns"}),": A Networkset. If multiple Networksets match, then the one with the longest prefix match is chosen.",(0,n.jsx)("br",{}),"- ",(0,n.jsx)(t.code,{children:"net"}),": A Network. The IP address did not fall into a known endpoint type."]})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"dest_service_name"})}),(0,n.jsx)(t.td,{children:"keyword"}),(0,n.jsx)(t.td,{children:"Name of the destination service. This may be empty if the request was not made against a service."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"dest_service_namespace"})}),(0,n.jsx)(t.td,{children:"keyword"}),(0,n.jsx)(t.td,{children:"Namespace of the destination service. This may be empty if the request was not made against a service."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"dest_service_port"})}),(0,n.jsx)(t.td,{children:"long"}),(0,n.jsx)(t.td,{children:"Destination service port."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"url"})}),(0,n.jsx)(t.td,{children:"keyword"}),(0,n.jsx)(t.td,{children:"URL that the request was made against."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"response_code"})}),(0,n.jsx)(t.td,{children:"keyword"}),(0,n.jsx)(t.td,{children:"Response code returned by the request."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"method"})}),(0,n.jsx)(t.td,{children:"keyword"}),(0,n.jsx)(t.td,{children:"HTTP method for the request."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"user_agent"})}),(0,n.jsx)(t.td,{children:"keyword"}),(0,n.jsx)(t.td,{children:"User agent of the request."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"type"})}),(0,n.jsx)(t.td,{children:"keyword"}),(0,n.jsxs)(t.td,{children:["Type of request made. Possible values include ",(0,n.jsx)(t.code,{children:"tcp"}),", ",(0,n.jsx)(t.code,{children:"tls"}),", and ",(0,n.jsx)(t.code,{children:"html/<version>"}),"."]})]})]})]})]})}function h(e={}){let{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(a,{...e})}):a(e)}},50065:function(e,t,s){s.d(t,{Z:function(){return c},a:function(){return r}});var d=s(67294);let n={},i=d.createContext(n);function r(e){let t=d.useContext(i);return d.useMemo(function(){return"function"==typeof e?e(t):{...t,...e}},[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:r(e.components),d.createElement(i.Provider,{value:t},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.