
////
This file is generated! See _meta/fields.yml and scripts/generate_field_docs.py
////

[[exported-fields]]
= Exported Fields

[partintro]

--
This document describes the fields that are exported by Packetbeat. They are
grouped in the following categories:

* <<exported-fields-amqp>>
* <<exported-fields-beat>>
* <<exported-fields-cassandra>>
* <<exported-fields-cloud>>
* <<exported-fields-common>>
* <<exported-fields-dns>>
* <<exported-fields-flows_event>>
* <<exported-fields-http>>
* <<exported-fields-icmp>>
* <<exported-fields-memcache>>
* <<exported-fields-mongodb>>
* <<exported-fields-mysql>>
* <<exported-fields-nfs>>
* <<exported-fields-pgsql>>
* <<exported-fields-raw>>
* <<exported-fields-redis>>
* <<exported-fields-thrift>>
* <<exported-fields-trans_event>>
* <<exported-fields-trans_measurements>>

--
[[exported-fields-amqp]]
== AMQP Fields

AMQP specific event fields.



[float]
=== amqp.reply-code

type: long

example: 404

AMQP reply code to an error, similar to http reply-code


[float]
=== amqp.reply-text

type: keyword

Text explaining the error.


[float]
=== amqp.class-id

type: long

Failing method class.


[float]
=== amqp.method-id

type: long

Failing method ID.


[float]
=== amqp.exchange

type: keyword

Name of the exchange.


[float]
=== amqp.exchange-type

type: keyword

example: fanout

Exchange type.


[float]
=== amqp.passive

type: boolean

If set, do not create exchange/queue.


[float]
=== amqp.durable

type: boolean

If set, request a durable exchange/queue.


[float]
=== amqp.exclusive

type: boolean

If set, request an exclusive queue.


[float]
=== amqp.auto-delete

type: boolean

If set, auto-delete queue when unused.


[float]
=== amqp.no-wait

type: boolean

If set, the server will not respond to the method.


[float]
=== amqp.consumer-tag

Identifier for the consumer, valid within the current channel.


[float]
=== amqp.delivery-tag

type: long

The server-assigned and channel-specific delivery tag.


[float]
=== amqp.message-count

type: long

The number of messages in the queue, which will be zero for newly-declared queues.


[float]
=== amqp.consumer-count

type: long

The number of consumers of a queue.


[float]
=== amqp.routing-key

type: keyword

Message routing key.


[float]
=== amqp.no-ack

type: boolean

If set, the server does not expect acknowledgements for messages.


[float]
=== amqp.no-local

type: boolean

If set, the server will not send messages to the connection that published them.


[float]
=== amqp.if-unused

type: boolean

Delete only if unused.


[float]
=== amqp.if-empty

type: boolean

Delete only if empty.


[float]
=== amqp.queue

type: keyword

The queue name identifies the queue within the vhost.


[float]
=== amqp.redelivered

type: boolean

Indicates that the message has been previously delivered to this or another client.


[float]
=== amqp.multiple

type: boolean

Acknowledge multiple messages.


[float]
=== amqp.arguments

type: dict

Optional additional arguments passed to some methods. Can be of various types.


[float]
=== amqp.mandatory

type: boolean

Indicates mandatory routing.


[float]
=== amqp.immediate

type: boolean

Request immediate delivery.


[float]
=== amqp.content-type

type: keyword

example: text/plain

MIME content type.


[float]
=== amqp.content-encoding

type: keyword

MIME content encoding.


[float]
=== amqp.headers

type: dict

Message header field table.


[float]
=== amqp.delivery-mode

type: keyword

Non-persistent (1) or persistent (2).


[float]
=== amqp.priority

type: long

Message priority, 0 to 9.


[float]
=== amqp.correlation-id

type: keyword

Application correlation identifier.


[float]
=== amqp.reply-to

type: keyword

Address to reply to.


[float]
=== amqp.expiration

type: keyword

Message expiration specification.


[float]
=== amqp.message-id

type: keyword

Application message identifier.


[float]
=== amqp.timestamp

type: keyword

Message timestamp.


[float]
=== amqp.type

type: keyword

Message type name.


[float]
=== amqp.user-id

type: keyword

Creating user id.


[float]
=== amqp.app-id

type: keyword

Creating application id.


[[exported-fields-beat]]
== Beat Fields

Contains common beat fields available in all event types.



[float]
=== beat.name

The name of the Beat sending the log messages. If the Beat name is set in the configuration file, then that value is used. If it is not set, the hostname is used. To set the Beat name, use the `name` option in the configuration file.


[float]
=== beat.hostname

The hostname as returned by the operating system on which the Beat is running.


[float]
=== beat.version

The version of the beat that generated this event.


[float]
=== @timestamp

type: date

example: August 26th 2016, 12:35:53.332

format: date

required: True

The timestamp when the event log record was generated.


[float]
=== tags

Arbitrary tags that can be set per Beat and per transaction type.


[float]
=== fields

type: dict

Contains user configurable fields.


[[exported-fields-cassandra]]
== Cassandra Fields

Cassandra v4/3 specific event fields.


[float]
== cassandra Fields

Information about the Cassandra request and response.


[float]
== request Fields

Cassandra request.


[float]
== headers Fields

Cassandra request headers.


[float]
=== cassandra.request.headers.version

type: long

The version of the protocol.

[float]
=== cassandra.request.headers.flags

type: keyword

Flags applying to this frame.

[float]
=== cassandra.request.headers.stream

type: keyword

A frame has a stream id.  If a client sends a request message with the stream id X, it is guaranteed that the stream id of the response to that message will be X.

[float]
=== cassandra.request.headers.op

type: keyword

An operation type that distinguishes the actual message.

[float]
=== cassandra.request.headers.length

type: long

A integer representing the length of the body of the frame (a frame is limited to 256MB in length).

[float]
=== cassandra.request.query

type: keyword

The CQL query which client send to cassandra.

[float]
== response Fields

Cassandra response.


[float]
== headers Fields

Cassandra response headers, the structure is as same as request's header.


[float]
=== cassandra.response.headers.version

type: long

The version of the protocol.

[float]
=== cassandra.response.headers.flags

type: keyword

Flags applying to this frame.

[float]
=== cassandra.response.headers.stream

type: keyword

A frame has a stream id.  If a client sends a request message with the stream id X, it is guaranteed that the stream id of the response to that message will be X.

[float]
=== cassandra.response.headers.op

type: keyword

An operation type that distinguishes the actual message.

[float]
=== cassandra.response.headers.length

type: long

A integer representing the length of the body of the frame (a frame is limited to 256MB in length).

[float]
== result Fields

Details about the returned result.


[float]
=== cassandra.response.result.type

type: keyword

Cassandra result type.

[float]
== rows Fields

Details about the rows.


[float]
=== cassandra.response.result.rows.num_rows

type: long

Representing the number of rows present in this result.

[float]
== meta Fields

Composed of result metadata.


[float]
=== cassandra.response.result.rows.meta.keyspace

type: keyword

Only present after set Global_tables_spec, the keyspace name.

[float]
=== cassandra.response.result.rows.meta.table

type: keyword

Only present after set Global_tables_spec, the table name.

[float]
=== cassandra.response.result.rows.meta.flags

type: keyword

Provides information on the formatting of the remaining information.

[float]
=== cassandra.response.result.rows.meta.col_count

type: long

Representing the number of columns selected by the query that produced this result.

[float]
=== cassandra.response.result.rows.meta.pkey_columns

type: long

Representing the PK columns index and counts.

[float]
=== cassandra.response.result.rows.meta.paging_state

type: keyword

The paging_state is a bytes value that should be used in QUERY/EXECUTE to continue paging and retrieve the remainder of the result for this query.

[float]
=== cassandra.response.result.keyspace

type: keyword

Indicating the name of the keyspace that has been set.

[float]
== schema_change Fields

The result to a schema_change message.


[float]
=== cassandra.response.result.schema_change.change

type: keyword

Representing the type of changed involved.

[float]
=== cassandra.response.result.schema_change.keyspace

type: keyword

This describes which keyspace has changed.

[float]
=== cassandra.response.result.schema_change.table

type: keyword

This describes which table has changed.

[float]
=== cassandra.response.result.schema_change.object

type: keyword

This describes the name of said affected object (either the table, user type, function, or aggregate name).

[float]
=== cassandra.response.result.schema_change.target

type: keyword

Target could be "FUNCTION" or "AGGREGATE", multiple arguments.

[float]
=== cassandra.response.result.schema_change.name

type: keyword

The function/aggregate name.

[float]
=== cassandra.response.result.schema_change.args

type: keyword

One string for each argument type (as CQL type).

[float]
== prepared Fields

The result to a PREPARE message.


[float]
=== cassandra.response.result.prepared.prepared_id

type: keyword

Representing the prepared query ID.

[float]
== req_meta Fields

This describes the request metadata.


[float]
=== cassandra.response.result.prepared.req_meta.keyspace

type: keyword

Only present after set Global_tables_spec, the keyspace name.

[float]
=== cassandra.response.result.prepared.req_meta.table

type: keyword

Only present after set Global_tables_spec, the table name.

[float]
=== cassandra.response.result.prepared.req_meta.flags

type: keyword

Provides information on the formatting of the remaining information.

[float]
=== cassandra.response.result.prepared.req_meta.col_count

type: long

Representing the number of columns selected by the query that produced this result.

[float]
=== cassandra.response.result.prepared.req_meta.pkey_columns

type: long

Representing the PK columns index and counts.

[float]
=== cassandra.response.result.prepared.req_meta.paging_state

type: keyword

The paging_state is a bytes value that should be used in QUERY/EXECUTE to continue paging and retrieve the remainder of the result for this query.

[float]
== resp_meta Fields

This describes the metadata for the result set.


[float]
=== cassandra.response.result.prepared.resp_meta.keyspace

type: keyword

Only present after set Global_tables_spec, the keyspace name.

[float]
=== cassandra.response.result.prepared.resp_meta.table

type: keyword

Only present after set Global_tables_spec, the table name.

[float]
=== cassandra.response.result.prepared.resp_meta.flags

type: keyword

Provides information on the formatting of the remaining information.

[float]
=== cassandra.response.result.prepared.resp_meta.col_count

type: long

Representing the number of columns selected by the query that produced this result.

[float]
=== cassandra.response.result.prepared.resp_meta.pkey_columns

type: long

Representing the PK columns index and counts.

[float]
=== cassandra.response.result.prepared.resp_meta.paging_state

type: keyword

The paging_state is a bytes value that should be used in QUERY/EXECUTE to continue paging and retrieve the remainder of the result for this query.

[float]
=== cassandra.response.supported

type: dict

Indicates which startup options are supported by the server. This message comes as a response to an OPTIONS message.

[float]
== authentication Fields

Indicates that the server requires authentication, and which authentication mechanism to use.


[float]
=== cassandra.response.authentication.class

type: keyword

Indicates the full class name of the IAuthenticator in use

[float]
=== cassandra.response.warnings

type: keyword

The text of the warnings, only occur when Warning flag was set.

[float]
== event Fields

Event pushed by the server. A client will only receive events for the types it has REGISTERed to.


[float]
=== cassandra.response.event.type

type: keyword

Representing the event type.

[float]
=== cassandra.response.event.change

type: keyword

The message corresponding respectively to the type of change followed by the address of the new/removed node.

[float]
=== cassandra.response.event.host

type: keyword

Representing the node ip.

[float]
=== cassandra.response.event.port

type: long

Representing the node port.

[float]
== schema_change Fields

The events details related to schema change.


[float]
=== cassandra.response.event.schema_change.change

type: keyword

Representing the type of changed involved.

[float]
=== cassandra.response.event.schema_change.keyspace

type: keyword

This describes which keyspace has changed.

[float]
=== cassandra.response.event.schema_change.table

type: keyword

This describes which table has changed.

[float]
=== cassandra.response.event.schema_change.object

type: keyword

This describes the name of said affected object (either the table, user type, function, or aggregate name).

[float]
=== cassandra.response.event.schema_change.target

type: keyword

Target could be "FUNCTION" or "AGGREGATE", multiple arguments.

[float]
=== cassandra.response.event.schema_change.name

type: keyword

The function/aggregate name.

[float]
=== cassandra.response.event.schema_change.args

type: keyword

One string for each argument type (as CQL type).

[float]
== error Fields

Indicates an error processing a request. The body of the message will be an  error code followed by a error message. Then, depending on the exception, more content may follow.


[float]
=== cassandra.response.error.code

type: long

The error code of the Cassandra response.

[float]
=== cassandra.response.error.msg

type: keyword

The error message of the Cassandra response.

[float]
=== cassandra.response.error.type

type: keyword

The error type of the Cassandra response.

[float]
== details Fields

The details of the error.


[float]
=== cassandra.response.error.details.read_consistency

type: keyword

Representing the consistency level of the query that triggered the exception.

[float]
=== cassandra.response.error.details.required

type: long

Representing the number of nodes that should be alive to respect consistency level.

[float]
=== cassandra.response.error.details.alive

type: long

Representing the number of replicas that were known to be alive when the request had been processed (since an unavailable exception has been triggered).

[float]
=== cassandra.response.error.details.received

type: long

Representing the number of nodes having acknowledged the request.

[float]
=== cassandra.response.error.details.blockfor

type: long

Representing the number of replicas whose acknowledgement is required to achieve consistency level.

[float]
=== cassandra.response.error.details.write_type

type: keyword

Describe the type of the write that timed out.

[float]
=== cassandra.response.error.details.data_present

type: boolean

It means the replica that was asked for data had responded.

[float]
=== cassandra.response.error.details.keyspace

type: keyword

The keyspace of the failed function.

[float]
=== cassandra.response.error.details.table

type: keyword

The keyspace of the failed function.

[float]
=== cassandra.response.error.details.stmt_id

type: keyword

Representing the unknown ID.

[float]
=== cassandra.response.error.details.num_failures

type: keyword

Representing the number of nodes that experience a failure while executing the request.

[float]
=== cassandra.response.error.details.function

type: keyword

The name of the failed function.

[float]
=== cassandra.response.error.details.arg_types

type: keyword

One string for each argument type (as CQL type) of the failed function.

[[exported-fields-cloud]]
== Cloud Provider Metadata Fields

Metadata from cloud providers added by the add_cloud_metadata processor.



[float]
=== meta.cloud.provider

example: ec2

Name of the cloud provider. Possible values are ec2, gce, or digitalocean.


[float]
=== meta.cloud.instance_id

Instance ID of the host machine.


[float]
=== meta.cloud.machine_type

example: t2.medium

Machine type of the host machine.


[float]
=== meta.cloud.availability_zone

example: us-east-1c

Availability zone in which this host is running.


[float]
=== meta.cloud.project_id

example: project-x

Name of the project in Google Cloud.


[float]
=== meta.cloud.region

Region in which this host is running.


[[exported-fields-common]]
== Common Fields

These fields contain data about the environment in which the transaction or flow was captured.



[float]
=== server

The name of the server that served the transaction.


[float]
=== client_server

The name of the server that initiated the transaction.


[float]
=== service

The name of the logical service that served the transaction.


[float]
=== client_service

The name of the logical service that initiated the transaction.


[float]
=== ip

format: dotted notation.

The IP address of the server that served the transaction.


[float]
=== client_ip

format: dotted notation.

The IP address of the server that initiated the transaction.


[float]
=== real_ip

format: Dotted notation.

If the server initiating the transaction is a proxy, this field contains the original client IP address. For HTTP, for example, the IP address extracted from a configurable HTTP header, by default `X-Forwarded-For`.
Unless this field is disabled, it always has a value, and it matches the `client_ip` for non proxy clients.


[float]
=== client_location

type: geo_point

example: 40.715, -74.011

DEPRECATED. Please use `client_geoip` instead. The GeoIP location of the `real_ip` IP address or of the `client_ip` address if the `real_ip` is disabled. The field is a string containing the latitude and longitude separated by a comma.


[float]
== client_geoip Fields

The GeoIP information of the client.


[float]
=== client_geoip.location

type: geo_point

example: {'lat': 51, 'lon': 9}

The GeoIP location of the `client_ip` address. This field is available only if you define a https://www.elastic.co/guide/en/elasticsearch/plugins/master/using-ingest-geoip.html[GeoIP Processor] as a pipeline in the https://www.elastic.co/guide/en/elasticsearch/plugins/master/ingest-geoip.html[Ingest GeoIP processor plugin] or using Logstash.


[float]
=== client_port

format: dotted notation.

The layer 4 port of the process that initiated the transaction.


[float]
=== transport

example: udp

The transport protocol used for the transaction. If not specified, then tcp is assumed.


[float]
=== type

required: True

The type of the transaction (for example, HTTP, MySQL, Redis, or RUM) or "flow" in case of flows.


[float]
=== port

format: dotted notation.

The layer 4 port of the process that served the transaction.


[float]
=== proc

The name of the process that served the transaction.


[float]
=== client_proc

The name of the process that initiated the transaction.


[float]
=== release

The software release of the service serving the transaction. This can be the commit id or a semantic version.


[[exported-fields-dns]]
== DNS Fields

DNS-specific event fields.



[float]
=== dns.id

type: long

The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.


[float]
=== dns.op_code

example: QUERY

The DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response.


[float]
=== dns.flags.authoritative

type: boolean

A DNS flag specifying that the responding server is an authority for the domain name used in the question.


[float]
=== dns.flags.recursion_available

type: boolean

A DNS flag specifying whether recursive query support is available in the name server.


[float]
=== dns.flags.recursion_desired

type: boolean

A DNS flag specifying that the client directs the server to pursue a query recursively. Recursive query support is optional.


[float]
=== dns.flags.authentic_data

type: boolean

A DNS flag specifying that the recursive server considers the response authentic.


[float]
=== dns.flags.checking_disabled

type: boolean

A DNS flag specifying that the client disables the server signature validation of the query.


[float]
=== dns.flags.truncated_response

type: boolean

A DNS flag specifying that only the first 512 bytes of the reply were returned.


[float]
=== dns.response_code

example: NOERROR

The DNS status code.

[float]
=== dns.question.name

example: www.google.com.

The domain name being queried. If the name field contains non-printable characters (below 32 or above 126), then those characters are represented as escaped base 10 integers (\DDD). Back slashes and quotes are escaped. Tabs, carriage returns, and line feeds are converted to \t, \r, and \n respectively.


[float]
=== dns.question.type

example: AAAA

The type of records being queried.

[float]
=== dns.question.class

example: IN

The class of of records being queried.

[float]
=== dns.question.etld_plus_one

example: amazon.co.uk.

The effective top-level domain (eTLD) plus one more label. For example, the eTLD+1 for "foo.bar.golang.org." is "golang.org.". The data for determining the eTLD comes from an embedded copy of the data from http://publicsuffix.org.

[float]
=== dns.answers

type: dict

An array containing a dictionary about each answer section returned by the server.


[float]
=== dns.answers_count

type: long

The number of resource records contained in the `dns.answers` field.


[float]
=== dns.answers.name

example: example.com.

The domain name to which this resource record pertains.

[float]
=== dns.answers.type

example: MX

The type of data contained in this resource record.

[float]
=== dns.answers.class

example: IN

The class of DNS data contained in this resource record.

[float]
=== dns.answers.ttl

type: long

The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached.


[float]
=== dns.answers.data

The data describing the resource. The meaning of this data depends on the type and class of the resource record.


[float]
=== dns.authorities

type: dict

An array containing a dictionary for each authority section from the answer.


[float]
=== dns.authorities_count

type: long

The number of resource records contained in the `dns.authorities` field. The `dns.authorities` field may or may not be included depending on the configuration of Packetbeat.


[float]
=== dns.authorities.name

example: example.com.

The domain name to which this resource record pertains.

[float]
=== dns.authorities.type

example: NS

The type of data contained in this resource record.

[float]
=== dns.authorities.class

example: IN

The class of DNS data contained in this resource record.

[float]
=== dns.additionals

type: dict

An array containing a dictionary for each additional section from the answer.


[float]
=== dns.additionals_count

type: long

The number of resource records contained in the `dns.additionals` field. The `dns.additionals` field may or may not be included depending on the configuration of Packetbeat.


[float]
=== dns.additionals.name

example: example.com.

The domain name to which this resource record pertains.

[float]
=== dns.additionals.type

example: NS

The type of data contained in this resource record.

[float]
=== dns.additionals.class

example: IN

The class of DNS data contained in this resource record.

[float]
=== dns.additionals.ttl

type: long

The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached.


[float]
=== dns.additionals.data

The data describing the resource. The meaning of this data depends on the type and class of the resource record.


[float]
=== dns.opt.version

example: 0

The EDNS version.

[float]
=== dns.opt.do

type: boolean

If set, the transaction uses DNSSEC.

[float]
=== dns.opt.ext_rcode

example: BADVERS

Extended response code field.

[float]
=== dns.opt.udp_size

type: long

Requestor's UDP payload size (in bytes).

[[exported-fields-flows_event]]
== Flow Event Fields

These fields contain data about the flow itself.



[float]
=== start_time

type: date

example: 2015-01-24 14:06:05.071000

format: YYYY-MM-DDTHH:MM:SS.milliZ

required: True

The time, the first packet for the flow has been seen.


[float]
=== last_time

type: date

example: 2015-01-24 14:06:05.071000

format: YYYY-MM-DDTHH:MM:SS.milliZ

required: True

The time, the most recent processed packet for the flow has been seen.


[float]
=== final

Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only.


[float]
=== flow_id

Internal flow id based on connection meta data and address.


[float]
=== vlan

Innermost VLAN address used in network packets.


[float]
=== outer_vlan

Second innermost VLAN address used in network packets.


[float]
== source Fields

Properties of the source host



[float]
=== source.mac

Source MAC address as indicated by first packet seen for the current flow.


[float]
=== source.ip

Innermost IPv4 source address as indicated by first packet seen for the current flow.


[float]
=== source.ip_location

type: geo_point

example: 40.715, -74.011

The GeoIP location of the `ip_source` IP address. The field is a string containing the latitude and longitude separated by a comma.


[float]
=== source.outer_ip

Second innermost IPv4 source address as indicated by first packet seen for the current flow.


[float]
=== source.outer_ip_location

type: geo_point

example: 40.715, -74.011

The GeoIP location of the `outer_ip_source` IP address. The field is a string containing the latitude and longitude separated by a comma.


[float]
=== source.ipv6

Innermost IPv6 source address as indicated by first packet seen for the current flow.


[float]
=== source.ipv6_location

type: geo_point

example: 60.715, -76.011

The GeoIP location of the `ipv6_source` IP address. The field is a string containing the latitude and longitude separated by a comma.


[float]
=== source.outer_ipv6

Second innermost IPv6 source address as indicated by first packet seen for the current flow.


[float]
=== source.outer_ipv6_location

type: geo_point

example: 60.715, -76.011

The GeoIP location of the `outer_ipv6_source` IP address. The field is a string containing the latitude and longitude separated by a comma.


[float]
=== source.port

Source port number as indicated by first packet seen for the current flow.


[float]
== stats Fields

Object with source to destination flow measurements.



[float]
=== source.stats.net_packets_total

type: long

Total number of packets


[float]
=== source.stats.net_bytes_total

type: long

Total number of bytes


[float]
== dest Fields

Properties of the destination host



[float]
=== dest.mac

Destination MAC address as indicated by first packet seen for the current flow.


[float]
=== dest.ip

Innermost IPv4 destination address as indicated by first packet seen for the current flow.


[float]
=== dest.ip_location

type: geo_point

example: 40.715, -74.011

The GeoIP location of the `ip_dest` IP address. The field is a string containing the latitude and longitude separated by a comma.


[float]
=== dest.outer_ip

Second innermost IPv4 destination address as indicated by first packet seen for the current flow.


[float]
=== dest.outer_ip_location

type: geo_point

example: 40.715, -74.011

The GeoIP location of the `outer_ip_dest` IP address. The field is a string containing the latitude and longitude separated by a comma.


[float]
=== dest.ipv6

Innermost IPv6 destination address as indicated by first packet seen for the current flow.


[float]
=== dest.ipv6_location

type: geo_point

example: 60.715, -76.011

The GeoIP location of the `ipv6_dest` IP address. The field is a string containing the latitude and longitude separated by a comma.


[float]
=== dest.outer_ipv6

Second innermost IPv6 destination address as indicated by first packet seen for the current flow.


[float]
=== dest.outer_ipv6_location

type: geo_point

example: 60.715, -76.011

The GeoIP location of the `outer_ipv6_dest` IP address. The field is a string containing the latitude and longitude separated by a comma.


[float]
=== dest.port

Destination port number as indicated by first packet seen for the current flow.


[float]
== stats Fields

Object with destination to source flow measurements.



[float]
=== dest.stats.net_packets_total

type: long

Total number of packets


[float]
=== dest.stats.net_bytes_total

type: long

Total number of bytes


[float]
=== icmp_id

ICMP id used in ICMP based flow.


[float]
=== connection_id

optional TCP connection id


[[exported-fields-http]]
== HTTP Fields

HTTP-specific event fields.


[float]
== http Fields

Information about the HTTP request and response.


[float]
== request Fields

HTTP request


[float]
=== http.request.params

The query parameters or form values. The query parameters are available in the Request-URI and the form values are set in the HTTP body when the content-type is set to `x-www-form-urlencoded`.


[float]
=== http.request.headers

type: dict

A map containing the captured header fields from the request. Which headers to capture is configurable. If headers with the same header name are present in the message, they will be separated by commas.


[float]
=== http.request.body

type: text

The body of the HTTP request.

[float]
== response Fields

HTTP response


[float]
=== http.response.code

example: 404

The HTTP status code.

[float]
=== http.response.phrase

example: Not found.

The HTTP status phrase.

[float]
=== http.response.headers

type: dict

A map containing the captured header fields from the response. Which headers to capture is configurable. If headers with the same header name are present in the message, they will be separated by commas.


[float]
=== http.response.body

The body of the HTTP response.

[[exported-fields-icmp]]
== ICMP Fields

ICMP specific event fields.




[float]
=== icmp.version

The version of the ICMP protocol.

[float]
=== icmp.request.message

type: keyword

A human readable form of the request.

[float]
=== icmp.request.type

type: long

The request type.

[float]
=== icmp.request.code

type: long

The request code.

[float]
=== icmp.response.message

type: keyword

A human readable form of the response.

[float]
=== icmp.response.type

type: long

The response type.

[float]
=== icmp.response.code

type: long

The response code.

[[exported-fields-memcache]]
== Memcache Fields

Memcached-specific event fields



[float]
=== memcache.protocol_type

type: keyword

The memcache protocol implementation. The value can be "binary" for binary-based, "text" for text-based, or "unknown" for an unknown memcache protocol type.


[float]
=== memcache.request.line

type: keyword

The raw command line for unknown commands ONLY.


[float]
=== memcache.request.command

type: keyword

The memcache command being requested in the memcache text protocol. For example "set" or "get". The binary protocol opcodes are translated into memcache text protocol commands.


[float]
=== memcache.response.command

type: keyword

Either the text based protocol response message type or the name of the originating request if binary protocol is used.


[float]
=== memcache.request.type

type: keyword

The memcache command classification. This value can be "UNKNOWN", "Load", "Store", "Delete", "Counter", "Info", "SlabCtrl", "LRUCrawler", "Stats", "Success", "Fail", or "Auth".


[float]
=== memcache.response.type

type: keyword

The memcache command classification. This value can be "UNKNOWN", "Load", "Store", "Delete", "Counter", "Info", "SlabCtrl", "LRUCrawler", "Stats", "Success", "Fail", or "Auth". The text based protocol will employ any of these, whereas the binary based protocol will mirror the request commands only (see `memcache.response.status` for binary protocol).


[float]
=== memcache.response.error_msg

type: keyword

The optional error message in the memcache response (text based protocol only).


[float]
=== memcache.request.opcode

type: keyword

The binary protocol message opcode name.


[float]
=== memcache.response.opcode

type: keyword

The binary protocol message opcode name.


[float]
=== memcache.request.opcode_value

type: long

The binary protocol message opcode value.


[float]
=== memcache.response.opcode_value

type: long

The binary protocol message opcode value.


[float]
=== memcache.request.opaque

type: long

The binary protocol opaque header value used for correlating request with response messages.


[float]
=== memcache.response.opaque

type: long

The binary protocol opaque header value used for correlating request with response messages.


[float]
=== memcache.request.vbucket

type: long

The vbucket index sent in the binary message.


[float]
=== memcache.response.status

type: keyword

The textual representation of the response error code (binary protocol only).


[float]
=== memcache.response.status_code

type: long

The status code value returned in the response (binary protocol only).


[float]
=== memcache.request.keys

type: list

The list of keys sent in the store or load commands.


[float]
=== memcache.response.keys

type: list

The list of keys returned for the load command (if present).


[float]
=== memcache.request.count_values

type: long

The number of values found in the memcache request message. If the command does not send any data, this field is missing.


[float]
=== memcache.response.count_values

type: long

The number of values found in the memcache response message. If the command does not send any data, this field is missing.


[float]
=== memcache.request.values

type: list

The list of base64 encoded values sent with the request (if present).


[float]
=== memcache.response.values

type: list

The list of base64 encoded values sent with the response (if present).


[float]
=== memcache.request.bytes

type: long

format: bytes

The byte count of the values being transferred.


[float]
=== memcache.response.bytes

type: long

format: bytes

The byte count of the values being transferred.


[float]
=== memcache.request.delta

type: long

The counter increment/decrement delta value.


[float]
=== memcache.request.initial

type: long

The counter increment/decrement initial value parameter (binary protocol only).


[float]
=== memcache.request.verbosity

type: long

The value of the memcache "verbosity" command.


[float]
=== memcache.request.raw_args

type: keyword

The text protocol raw arguments for the "stats ..." and "lru crawl ..." commands.


[float]
=== memcache.request.source_class

type: long

The source class id in 'slab reassign' command.


[float]
=== memcache.request.dest_class

type: long

The destination class id in 'slab reassign' command.


[float]
=== memcache.request.automove

type: keyword

The automove mode in the 'slab automove' command expressed as a string. This value can be "standby"(=0), "slow"(=1), "aggressive"(=2), or the raw value if the value is unknown.


[float]
=== memcache.request.flags

type: long

The memcache command flags sent in the request (if present).


[float]
=== memcache.response.flags

type: long

The memcache message flags sent in the response (if present).


[float]
=== memcache.request.exptime

type: long

The data expiry time in seconds sent with the memcache command (if present). If the value is <30 days, the expiry time is relative to "now", or else it is an absolute Unix time in seconds (32-bit).


[float]
=== memcache.request.sleep_us

type: long

The sleep setting in microseconds for the 'lru_crawler sleep' command.


[float]
=== memcache.response.value

type: long

The counter value returned by a counter operation.


[float]
=== memcache.request.noreply

type: boolean

Set to true if noreply was set in the request. The `memcache.response` field will be missing.


[float]
=== memcache.request.quiet

type: boolean

Set to true if the binary protocol message is to be treated as a quiet message.


[float]
=== memcache.request.cas_unique

type: long

The CAS (compare-and-swap) identifier if present.


[float]
=== memcache.response.cas_unique

type: long

The CAS (compare-and-swap) identifier to be used with CAS-based updates (if present).


[float]
=== memcache.response.stats

type: list

The list of statistic values returned. Each entry is a dictionary with the fields "name" and "value".


[float]
=== memcache.response.version

type: keyword

The returned memcache version string.


[[exported-fields-mongodb]]
== MongoDb Fields

MongoDB-specific event fields. These fields mirror closely the fields for the MongoDB wire protocol. The higher level fields (for example, `query` and `resource`) apply to MongoDB events as well.




[float]
=== mongodb.error

If the MongoDB request has resulted in an error, this field contains the error message returned by the server.


[float]
=== mongodb.fullCollectionName

The full collection name. The full collection name is the concatenation of the database name with the collection name, using a dot (.) for the concatenation. For example, for the database foo and the collection bar, the full collection name is foo.bar.


[float]
=== mongodb.numberToSkip

type: long

Sets the number of documents to omit - starting from the first document in the resulting dataset - when returning the result of the query.


[float]
=== mongodb.numberToReturn

type: long

The requested maximum number of documents to be returned.


[float]
=== mongodb.numberReturned

type: long

The number of documents in the reply.


[float]
=== mongodb.startingFrom

Where in the cursor this reply is starting.


[float]
=== mongodb.query

A JSON document that represents the query. The query will contain one or more elements, all of which must match for a document to be included in the result set. Possible elements include $query, $orderby, $hint, $explain, and $snapshot.


[float]
=== mongodb.returnFieldsSelector

A JSON document that limits the fields in the returned documents. The returnFieldsSelector contains one or more elements, each of which is the name of a field that should be returned, and the integer value 1.


[float]
=== mongodb.selector

A BSON document that specifies the query for selecting the document to update or delete.


[float]
=== mongodb.update

A BSON document that specifies the update to be performed. For information on specifying updates, see the Update Operations documentation from the MongoDB Manual.


[float]
=== mongodb.cursorId

The cursor identifier returned in the OP_REPLY. This must be the value that was returned from the database.


[float]
== rpc Fields

OncRPC specific event fields.


[float]
=== rpc.xid

RPC message transaction identifier.

[float]
=== rpc.call_size

type: long

RPC call size with argument.

[float]
=== rpc.reply_size

type: long

RPC reply size with argument.

[float]
=== rpc.status

RPC message reply status.

[float]
=== rpc.time

type: long

RPC message processing time.

[float]
=== rpc.time_str

RPC message processing time in human readable form.

[float]
=== rpc.auth_flavor

RPC authentication flavor.

[float]
=== rpc.cred.uid

type: long

RPC caller's user id, in case of auth-unix.

[float]
=== rpc.cred.gid

type: long

RPC caller's group id, in case of auth-unix.

[float]
=== rpc.cred.gids

RPC caller's secondary group ids, in case of auth-unix.

[float]
=== rpc.cred.stamp

type: long

Arbitrary ID which the caller machine may generate.

[float]
=== rpc.cred.machinename

The name of the caller's machine.

[[exported-fields-mysql]]
== MySQL Fields

MySQL-specific event fields.




[float]
=== mysql.iserror

type: boolean

If the MySQL query returns an error, this field is set to true.


[float]
=== mysql.affected_rows

type: long

If the MySQL command is successful, this field contains the affected number of rows of the last statement.


[float]
=== mysql.insert_id

If the INSERT query is successful, this field contains the id of the newly inserted row.


[float]
=== mysql.num_fields

If the SELECT query is successful, this field is set to the number of fields returned.


[float]
=== mysql.num_rows

If the SELECT query is successful, this field is set to the number of rows returned.


[float]
=== mysql.query

The row mysql query as read from the transaction's request.


[float]
=== mysql.error_code

type: long

The error code returned by MySQL.


[float]
=== mysql.error_message

The error info message returned by MySQL.


[[exported-fields-nfs]]
== NFS Fields

NFS v4/3 specific event fields.



[float]
=== nfs.version

type: long

NFS protocol version number.

[float]
=== nfs.minor_version

type: long

NFS protocol minor version number.

[float]
=== nfs.tag

NFS v4 COMPOUND operation tag.

[float]
=== nfs.opcode

NFS operation name, or main operation name, in case of COMPOUND calls.


[float]
=== nfs.status

NFS operation reply status.

[[exported-fields-pgsql]]
== PostgreSQL Fields

PostgreSQL-specific event fields.




[float]
=== pgsql.query

The row pgsql query as read from the transaction's request.


[float]
=== pgsql.iserror

type: boolean

If the PgSQL query returns an error, this field is set to true.


[float]
=== pgsql.error_code

type: long

The PostgreSQL error code.

[float]
=== pgsql.error_message

The PostgreSQL error message.

[float]
=== pgsql.error_severity

The PostgreSQL error severity.

[float]
=== pgsql.num_fields

If the SELECT query if successful, this field is set to the number of fields returned.


[float]
=== pgsql.num_rows

If the SELECT query if successful, this field is set to the number of rows returned.


[[exported-fields-raw]]
== Raw Fields

These fields contain the raw transaction data.


[float]
=== request

type: text

For text protocols, this is the request as seen on the wire (application layer only). For binary protocols this is our representation of the request.


[float]
=== response

type: text

For text protocols, this is the response as seen on the wire (application layer only). For binary protocols this is our representation of the request.


[[exported-fields-redis]]
== Redis Fields

Redis-specific event fields.




[float]
=== redis.return_value

The return value of the Redis command in a human readable format.


[float]
=== redis.error

If the Redis command has resulted in an error, this field contains the error message returned by the Redis server.


[[exported-fields-thrift]]
== Thrift-RPC Fields

Thrift-RPC specific event fields.




[float]
=== thrift.params

The RPC method call parameters in a human readable format. If the IDL files are available, the parameters use names whenever possible. Otherwise, the IDs from the message are used.


[float]
=== thrift.service

The name of the Thrift-RPC service as defined in the IDL files.


[float]
=== thrift.return_value

The value returned by the Thrift-RPC call. This is encoded in a human readable format.


[float]
=== thrift.exceptions

If the call resulted in exceptions, this field contains the exceptions in a human readable format.


[[exported-fields-trans_event]]
== Transaction Event Fields

These fields contain data about the transaction itself.



[float]
=== direction

required: True

Indicates whether the transaction is inbound (emitted by server) or outbound (emitted by the client). Values can be in or out. No defaults.


[float]
=== status

required: True

The high level status of the transaction. The way to compute this value depends on the protocol, but the result has a meaning independent of the protocol.


[float]
=== method

The command/verb/method of the transaction. For HTTP, this is the method name (GET, POST, PUT, and so on), for SQL this is the verb (SELECT, UPDATE, DELETE, and so on).


[float]
=== resource

The logical resource that this transaction refers to. For HTTP, this is the URL path up to the last slash (/). For example, if the URL is `/users/1`, the resource is `/users`. For databases, the resource is typically the table name. The field is not filled for all transaction types.


[float]
=== path

required: True

The path the transaction refers to. For HTTP, this is the URL. For SQL databases, this is the table name. For key-value stores, this is the key.


[float]
=== query

type: keyword

The query in a human readable format. For HTTP, it will typically be something like `GET /users/_search?name=test`. For MySQL, it is something like `SELECT id from users where name=test`.


[float]
=== params

type: text

The request parameters. For HTTP, these are the POST or GET parameters. For Thrift-RPC, these are the parameters from the request.


[float]
=== notes

Messages from Packetbeat itself. This field usually contains error messages for interpreting the raw data. This information can be helpful for troubleshooting.


[[exported-fields-trans_measurements]]
== Measurements (Transactions) Fields

These fields contain measurements related to the transaction.



[float]
=== responsetime

type: long

The wall clock time it took to complete the transaction. The precision is in milliseconds.


[float]
=== cpu_time

type: long

The CPU time it took to complete the transaction.

[float]
=== bytes_in

type: long

format: bytes

The number of bytes of the request. Note that this size is the application layer message length, without the length of the IP or TCP headers.


[float]
=== bytes_out

type: long

format: bytes

The number of bytes of the response. Note that this size is the application layer message length, without the length of the IP or TCP headers.


[float]
=== dnstime

type: long

The time it takes to query the name server for a given request. This is typically used for RUM (real-user-monitoring) but can also have values for server-to-server communication when DNS is used for service discovery. The precision is in microseconds.


[float]
=== connecttime

type: long

The time it takes for the TCP connection to be established for the given transaction. The precision is in microseconds.


[float]
=== loadtime

type: long

The time it takes for the content to be loaded. This is typically used for RUM (real-user-monitoring) but it can make sense in other cases as well. The precision is in microseconds.


[float]
=== domloadtime

type: long

In RUM (real-user-monitoring), the total time it takes for the DOM to be loaded. In terms of the W3 Navigation Timing API, this is the difference between `domContentLoadedEnd` and `domContentLoadedStart`.


