Original Flow Data
Modern network devices often export specialized data known as Private Enterprise Elements: non-standard IPFIX fields unique to a specific vendor, such as proprietary security tags or custom performance metrics. The Original Flow Data service maps these elements to key names in syslog key-value pairs or JSON output, so vendor-specific data arrives downstream with meaningful names instead of raw element IDs.
To access it, navigate to the Services page and select the Original Flow Data tab.
The service uses one mapping file: Custom IPFIX Information Elements. It specifies key names for custom enterprise fields in IPFIX and can also override the names of standard IPFIX elements. The CSV file has the following format:
PEN, IE ID, Format, Name, Description
Where:
- PEN: IPFIX Private Enterprise Number, for example 5951 for NetScaler
- IE ID: IPFIX Information Element ID
- Format: one of the values in the table below
- Name: key name for this IPFIX element
- Description: optional description
| Format | Description | Example |
|---|---|---|
| FMT_NONE | no output | |
| FMT_UNKNOWN | N bytes as hex | 0102DEADBEEF0201 |
| FMT_UINT8_DEC | unsigned integer 1 byte as decimal | 127 |
| FMT_UINT8_HEX | unsigned integer 1 byte as hex | 1F |
| FMT_UINT16_DEC | unsigned integer 2 bytes as decimal | 5000 |
| FMT_FLOW_LABEL | unsigned integer 20 bits as decimal | 106000 |
| FMT_MPLS_LABEL | unsigned integer 3 bytes as text | 17:28:39 |
| FMT_APP_TAG | application tag 1 byte (engine ID) + n bytes (selector) | 1:7000 |
| FMT_HTTP_HOST | HTTP host n bytes: Application ID 4 bytes (engine ID + selector ID), sub-application ID 2 bytes, value (hostname) n bytes | "100:3000,hostA" |
| FMT_TCP_FLAGS | unsigned integer 1 byte as text | "FIN,RST" |
| FMT_UINT32_DEC | unsigned integer 4 bytes as decimal | 77000 |
| FMT_UINT32_HEX | unsigned integer 4 bytes as hex | 01ABCD02 |
| FMT_UINTN_DEC | unsigned integer n bytes as decimal | 9600000 |
| FMT_IPV4 | 4 bytes as text | 127.0.0.1 |
| FMT_IPV6 | 16 bytes as text | 2001:0db8:11a3:09d7:1f34:8a2e:07a0:765d |
| FMT_STRING | n bytes ASCII as text | "ascii text" |
| FMT_MAC | 6 bytes as text | 00:a1💿12:34:56 |
| FMT_ARR32 | 4 bytes array as hex | 01ABCD02 |
| FMT_ARR64 | 8 bytes array as hex | 01ABCD0201ABCD02 |
| FMT_EVENT | unsigned integer 1 byte as text | "Flow created" |
| FMT_DTIME_SEC | unsigned integer 4 or 8 byte as text (date) | "1985-04-12T23:20:50Z" |
| FMT_DTIME_MSEC | unsigned integer 4 or 8 byte as text (date) | "1985-04-12T23:20:50.001Z" |
| FMT_DTIME_USEC | unsigned integer 4 or 8 byte as text (date) | "1985-04-12T23:20:50.000001Z" |
| FMT_DTIME_NSEC | unsigned integer 4 or 8 byte as text (date) | "1985-04-12T23:20:50.000000001Z" |