From f25f0860bc5f7d838201f2f234291f5c9c91dfea Mon Sep 17 00:00:00 2001 From: Robert Cowart Date: Sat, 4 May 2019 18:47:17 +0200 Subject: [PATCH] bump to 3.5.0 - add ES 7.x support --- CHANGELOG.md | 228 +- Dockerfile | 2 +- INSTALL.md | 178 +- README.md | 24 +- SERVICES.md | 10 +- SPONSORS.md | 1 + docker-compose.yml | 10 +- docker_build.sh | 2 +- kibana/elastiflow.kibana.7.0.x.json | 9563 +++ .../conf.d/20_filter_10_begin.logstash.conf | 2 +- .../conf.d/30_output_10_single.logstash.conf | 4 +- .../30_output_20_multi.logstash.conf.disabled | 4 +- .../dictionaries/iana_service_names_tcp.yml | 18 +- .../templates/elastiflow.template.json | 57170 ++++++++-------- .../elastiflow_dynamic.template.json | 57170 ++++++++-------- .../templates/elastiflow_static.template.json | 21824 +++--- 16 files changed, 77983 insertions(+), 68227 deletions(-) create mode 100644 kibana/elastiflow.kibana.7.0.x.json diff --git a/CHANGELOG.md b/CHANGELOG.md index 4dfdf98..0767f08 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,21 @@ +## v3.5.0 + +v3.5.0 is a minor release. No migration of data from v3.4.x to v3.5.0 is required. + +### Breaking Changes + +ElasiFlow v3.5.0 provides support Elastic Stack 7.0.0. The support for document tyes has been completely removed in Elasticsearch 7.0.0. This has required changes to the index templates provided with ElastiFlow. You _MUST_ first successfully upgrade to Elastic Stack 7.0.x _PRIOR_ to using ElastiFlow v3.5.0. + +### New Features + +* Support for Elastic Stack 7.0.x + +### Updates + +* Dashboard tweaks for Kibana 7.0.x. + +--- + ## v3.4.2 v3.4.2 is a minor release. No migration of data from v3.4.1 to v3.4.2 is required. @@ -8,22 +26,22 @@ If you are upgrading from a release prior to 3.4.0, see the Breaking Changes not ### New Features -- Added support for Cisco AVC flow records (normalized to ElastiFlow schema) -- Determine client/server based on SYN+RST TCP flags -- Support for Elastic Stack 6.7.x +* Added support for Cisco AVC flow records (normalized to ElastiFlow schema) +* Determine client/server based on SYN+RST TCP flags +* Support for Elastic Stack 6.7.x ### Updates -- Added A LOT of new Fortinet App IDs -- Index Pattern now includes all fields from codec definitions -- Updated GeoLite2-City and GeoLite2-ASN DBs -- Updated IP Reputation dictionary +* Added A LOT of new Fortinet App IDs +* Index Pattern now includes all fields from codec definitions +* Updated GeoLite2-City and GeoLite2-ASN DBs +* Updated IP Reputation dictionary ### Fixes -- Numerous index template fixes -- Removed duplicate TCP service names -- Fixed instances of double close brackets +* Numerous index template fixes +* Removed duplicate TCP service names +* Fixed instances of double close brackets --- @@ -37,16 +55,16 @@ If you are upgrading from a release prior to 3.4.0, see the Breaking Changes not ### New Features -- Added Docker support +* Added Docker support ### Updates -- Updated GeoLite2-City and GeoLite2-ASN DBs -- Updated IP Reputation dictionary +* Updated GeoLite2-City and GeoLite2-ASN DBs +* Updated IP Reputation dictionary ### Fixes -- Netflow application id regression. Now uses field `netflow.app_id`. +* Netflow application id regression. Now uses field `netflow.app_id`. --- @@ -58,21 +76,21 @@ v3.4.0 adds custom field definitions for the Netflow codec. While greatly expand ### New Features -- Add a new Threats dashboard, based on IP reputation tags -- Netflow and IPFIX now default to included field definitions -- Provide a `sysctl.d` file to set `net.core.rmem_max` -- Added application ID support for Sophos, Sonicwall, Citrix Netscaler, IXIA IxFlow and Palo Alto -- Added support for Ziften ZFlow IPFIX host agents -- Added enrichment of enumerated values for many vendor-specific fields. +* Add a new Threats dashboard, based on IP reputation tags +* Netflow and IPFIX now default to included field definitions +* Provide a `sysctl.d` file to set `net.core.rmem_max` +* Added application ID support for Sophos, Sonicwall, Citrix Netscaler, IXIA IxFlow and Palo Alto +* Added support for Ziften ZFlow IPFIX host agents +* Added enrichment of enumerated values for many vendor-specific fields. ### Updates -- Updated GeoLite2-City and GeoLite2-ASN DBs -- Updated IP Reputation dictionary -- Set all `translate` filters to use the new option `refresh_behaviour`, setting it to `replace` -- Updated FortiOS 5.6 Application IDs -- Disabled name lookups for connections to the `tcp` input -- Kibana index pattern now contains many new vendor-specific fields +* Updated GeoLite2-City and GeoLite2-ASN DBs +* Updated IP Reputation dictionary +* Set all `translate` filters to use the new option `refresh_behaviour`, setting it to `replace` +* Updated FortiOS 5.6 Application IDs +* Disabled name lookups for connections to the `tcp` input +* Kibana index pattern now contains many new vendor-specific fields --- @@ -82,16 +100,16 @@ v3.3.0 is a minor release. No migration of data from v3.0.x or later to v3.3.0 i ### New Features -- Sample interval can be manually set if not sent by the device. -- DNS resolution of IP addresses can be enabled for only exporters, endpoints or both. -- Split docs into `README.md` and `INSTALL.md`. -- Removed `sflow.size_header`. +* Sample interval can be manually set if not sent by the device. +* DNS resolution of IP addresses can be enabled for only exporters, endpoints or both. +* Split docs into `README.md` and `INSTALL.md`. +* Removed `sflow.size_header`. ### Updates -- Updated GeoLite2-City and GeoLite2-ASN DBs -- Updated IP Reputation dictionary -- Added field 99 to `netflow.yml` definitions +* Updated GeoLite2-City and GeoLite2-ASN DBs +* Updated IP Reputation dictionary +* Added field 99 to `netflow.yml` definitions --- @@ -101,21 +119,21 @@ v3.2.3 is a maintenance release. No migration of data from v3.0.x or later to v3 ### New Features -- Support for Kibana 6.4. -- Support for additional sFlow fields, including TCP Flags. -- Added an IP reputation whitelist dictionary. -- Added a CHANGELOG.md which documents all changes since v1.0.0. +* Support for Kibana 6.4. +* Support for additional sFlow fields, including TCP Flags. +* Added an IP reputation whitelist dictionary. +* Added a CHANGELOG.md which documents all changes since v1.0.0. ### Fixes -- Minor dashboard tweaks. -- Fixed document/index name version inconsistency. +* Minor dashboard tweaks. +* Fixed document/index name version inconsistency. ### Updates -- Updated GeoLite2-ASN DB -- Updated service name dictionary. -- Updated IP Reputation dictionary. +* Updated GeoLite2-ASN DB +* Updated service name dictionary. +* Updated IP Reputation dictionary. --- @@ -125,14 +143,14 @@ v3.2.2 is a maintenance release. No migration of data from v3.0.x or later to v3 ### Fixes -- Minor changes to README.md. +* Minor changes to README.md. ### Updates -- Added additional Riverbed fields to netflow.yml. -- Updated GeoLite2-ASN DB -- Updated GeoLite2-City DB -- Updated IP Reputation Dictionary +* Added additional Riverbed fields to netflow.yml. +* Updated GeoLite2-ASN DB +* Updated GeoLite2-City DB +* Updated IP Reputation Dictionary --- @@ -142,7 +160,7 @@ v3.2.1 is a minor release. No migration of data from v3.0.x or later to v3.2.1 i ### Fixes -- Well v3.2.0 was short lived! Found a bug related to the enrichment of Riverbed port numbers that I wanted to fix quickly. +* Well v3.2.0 was short lived! Found a bug related to the enrichment of Riverbed port numbers that I wanted to fix quickly. --- @@ -152,17 +170,17 @@ v3.2.0 is a minor release. No migration of data from v3.0.x or v3.1.0 to v3.2.0 ### New Features -- Add a multi-server output option. -- Add support for RiverBed WAN Optimizers using a custom Netflow field definitions file. -- Consider SYN-only TCP Flags when determining client/server. -- Provide the option to lookup interface names from a YAML dictionary. -- Add the ability to set the UDP receive buffer via an environment variable. +* Add a multi-server output option. +* Add support for RiverBed WAN Optimizers using a custom Netflow field definitions file. +* Consider SYN-only TCP Flags when determining client/server. +* Provide the option to lookup interface names from a YAML dictionary. +* Add the ability to set the UDP receive buffer via an environment variable. ### Updates -- Cleanup of NBAR2 application IDs. -- Update GeoIP DBs. -- Update ASN DB. +* Cleanup of NBAR2 application IDs. +* Update GeoIP DBs. +* Update ASN DB. --- @@ -172,12 +190,12 @@ v3.1.0 is a minor release. No migration of data from v3.0.x to v3.1.0 is require ### New Features -- Added country_code related fields. -- Normalized IPFIX NAT-related fields. -- Added a configurable default value of App ID source type. -- Added option for SSL connection to Elasticsearch. -- Added support for App IDs from v4.x of the Netflow codec. Compatibility with v3.x is maintained. -- Dashboards optimized for Kibana 6.3. (separate import file for 6.2 is also available) +* Added country_code related fields. +* Normalized IPFIX NAT-related fields. +* Added a configurable default value of App ID source type. +* Added option for SSL connection to Elasticsearch. +* Added support for App IDs from v4.x of the Netflow codec. Compatibility with v3.x is maintained. +* Dashboards optimized for Kibana 6.3. (separate import file for 6.2 is also available) --- @@ -187,7 +205,7 @@ v3.0.3 is a maintenance release. No migration of data from v3.0.x to v3.0.3 is r ### New Features -- Added support for nDPI detected application names sent via Netflow from nProbe. A configuration file for nProbe, which works well with ElastiFlow™, is available [HERE](https://gist.github.com/robcowart/afd538026db29ee96dd9c495efb52ea6). +* Added support for nDPI detected application names sent via Netflow from nProbe. A configuration file for nProbe, which works well with ElastiFlow™, is available [HERE](https://gist.github.com/robcowart/afd538026db29ee96dd9c495efb52ea6). --- @@ -197,7 +215,7 @@ v3.0.2 is a maintenance release. No migration of data from v3.0.0/v3.0.1 to v3.0 ### Updates -- Updated IP Reputation Dictionary +* Updated IP Reputation Dictionary --- @@ -207,18 +225,18 @@ v3.0.1 is a maintenance release. No migration of data from v3.0.0 to v3.0.1 is r ### New Features -- Added field formatters to the Index Pattern to launch external URLs for IP addresses (www.talosintelligence.com/reputation_center/), Autonomous System Numbers (http://viewdns.info/asnlookup/) and Ports (http://www.adminsub.net/tcp-udp-port-finder/). -- Added recommended Kibana settings to README.md. +* Added field formatters to the Index Pattern to launch external URLs for IP addresses (www.talosintelligence.com/reputation_center/), Autonomous System Numbers (http://viewdns.info/asnlookup/) and Ports (http://www.adminsub.net/tcp-udp-port-finder/). +* Added recommended Kibana settings to README.md. ### Fixes -- Fixed a few errors in README.md. -- Ignore application_id of 0:0. +* Fixed a few errors in README.md. +* Ignore application_id of 0:0. ### Updates -- Updated GeoLite2-ASN DB -- Updated IP Reputation Dictionary +* Updated GeoLite2-ASN DB +* Updated IP Reputation Dictionary --- @@ -226,18 +244,18 @@ v3.0.1 is a maintenance release. No migration of data from v3.0.0 to v3.0.1 is r ### New Features -- Dashboards have been rebuilt to leverage features added since the release of Kibana 6.x. This includes the addition of experimental dashboards which leverage the new Vega visualization. -- The schema was refactored to minimize the volume of data stored and increase the efficiency of processing. The result is a reduction of storage requirements by 20-30%, and better throughput. -- IP reputation tagging has been added to assist in the identification of suspect network traffic. -- Improved support for application identification data has been added for Cisco NBAR2 and Fortinet. -- Added support for simultaneous collection over IPv4 and IPv6 on separate interfaces. -- Versioning has been added for indices and index templates. This will make it possible in the future to create reindexing methods for the migration of historical data to newer versions. -- GeoIP and ASN lookups can now be enabled/disabled using an environment variable. Users who don't need these capabilities will be able to disable them, saving disk space and increasing processing efficiency. -- Index mappings were modified to more gracefully handle various vendor-specific flow field implementations. +* Dashboards have been rebuilt to leverage features added since the release of Kibana 6.x. This includes the addition of experimental dashboards which leverage the new Vega visualization. +* The schema was refactored to minimize the volume of data stored and increase the efficiency of processing. The result is a reduction of storage requirements by 20-30%, and better throughput. +* IP reputation tagging has been added to assist in the identification of suspect network traffic. +* Improved support for application identification data has been added for Cisco NBAR2 and Fortinet. +* Added support for simultaneous collection over IPv4 and IPv6 on separate interfaces. +* Versioning has been added for indices and index templates. This will make it possible in the future to create reindexing methods for the migration of historical data to newer versions. +* GeoIP and ASN lookups can now be enabled/disabled using an environment variable. Users who don't need these capabilities will be able to disable them, saving disk space and increasing processing efficiency. +* Index mappings were modified to more gracefully handle various vendor-specific flow field implementations. ### Fixes -- Fixed a regression related to the field type of various IPFIX date fields. +* Fixed a regression related to the field type of various IPFIX date fields. --- @@ -245,15 +263,15 @@ v3.0.1 is a maintenance release. No migration of data from v3.0.0 to v3.0.1 is r ### New Features -- Added support for flow proxies, such as nProbe, which populate the exporterIPv4Address or exporterIPv6Address fields with the IP of the device from which the flow originated. This applies to both Netflow v9 and IPFIX flow types. +* Added support for flow proxies, such as nProbe, which populate the exporterIPv4Address or exporterIPv6Address fields with the IP of the device from which the flow originated. This applies to both Netflow v9 and IPFIX flow types. ### New Features -- Added the option to remove fields from the original flow records to save storage space. This is done by setting the environment variable ELASTIFLOW_KEEP_ORIG_DATA to false (default is true). The result of setting this to false is that the netflow, ipfix and sflow objects will be removed prior to sending the data to Elasticsearch. This has no adverse affect on the provided dashboards, as they they are populated from the normalized flow object. However the original flow fields will no longer be available if they are desired for additional analytics. +* Added the option to remove fields from the original flow records to save storage space. This is done by setting the environment variable ELASTIFLOW_KEEP_ORIG_DATA to false (default is true). The result of setting this to false is that the netflow, ipfix and sflow objects will be removed prior to sending the data to Elasticsearch. This has no adverse affect on the provided dashboards, as they they are populated from the normalized flow object. However the original flow fields will no longer be available if they are desired for additional analytics. ### Updates -- Updated MaxMind GeoLite2 DBs to those released 6 Feb 2018. +* Updated MaxMind GeoLite2 DBs to those released 6 Feb 2018. --- @@ -263,23 +281,23 @@ ElastiFlow™ 2.0.0 is a major release which adds support for IPFIX and sFlow, i ### New Features -- Support added for IPFIX (#34) -- Support added for sFlow (#26) -- Index name changed from netflow to elastiflow. -- All flow types are normalized under the flow object (previously Netflow v5 and v9 were normalized to a netflow object), but all original data is retained. -- Reworked Top-N dashboards. Now includes Top Talkers, Top Services and Top Conversations (replace old Conversations dashboard). -- Reworked Geo Location dashboards. Now includes client/server and source/destination perspectives. -- Autonomous System dashboard updated to simplify analysis of traffic to/from Autonomous Systems. -- Changed most timelion graphs to display bit/s instead of bytes/s (requested by a number of users) -- Index Pattern now imported via Kibana API. (see README.md) +* Support added for IPFIX (#34) +* Support added for sFlow (#26) +* Index name changed from netflow to elastiflow. +* All flow types are normalized under the flow object (previously Netflow v5 and v9 were normalized to a netflow object), but all original data is retained. +* Reworked Top-N dashboards. Now includes Top Talkers, Top Services and Top Conversations (replace old Conversations dashboard). +* Reworked Geo Location dashboards. Now includes client/server and source/destination perspectives. +* Autonomous System dashboard updated to simplify analysis of traffic to/from Autonomous Systems. +* Changed most timelion graphs to display bit/s instead of bytes/s (requested by a number of users) +* Index Pattern now imported via Kibana API. (see README.md) ### Fixes -- Change netflow.conn_id to a long (#33) +* Change netflow.conn_id to a long (#33) ### Updates -- License updated. +* License updated. --- @@ -287,33 +305,33 @@ ElastiFlow™ 2.0.0 is a major release which adds support for IPFIX and sFlow, i This release has been tested with Elastic Stack versions 5.4.3, 5.5.3, 5.6.5 and 6.0.1. It will also work with 6.1.0 and 6.1.1, however due to issues with Kibana visualization scaling (see elastic/kibana#15594) I cannot yet recommend users making a move 6.1.x. -- Modified index templates to support Elasticsearch 6.0. (#20) -- Improved support for bi-directional flows to better handle flows from devices such as Cisco ASA. (#29) -- Changed application_id to a keyword to better handle flows from devices such as Fortinet devices. (#14) -- Improved presentation of units for traffic volume (e.g. 100KB/s instead of 100000) in Timelion charts. (#24) +* Modified index templates to support Elasticsearch 6.0. (#20) +* Improved support for bi-directional flows to better handle flows from devices such as Cisco ASA. (#29) +* Changed application_id to a keyword to better handle flows from devices such as Fortinet devices. (#14) +* Improved presentation of units for traffic volume (e.g. 100KB/s instead of 100000) in Timelion charts. (#24) --- ## v1.1.2 -- Fixed the if statement that controls conditions when geoip_dst.autonomous_system is set. Thanks to @vpiserchia for contributing the PR. -- Modified the index template to use "codec": "best_compression" to reduce storage capacity requirements. +* Fixed the if statement that controls conditions when geoip_dst.autonomous_system is set. Thanks to @vpiserchia for contributing the PR. +* Modified the index template to use "codec": "best_compression" to reduce storage capacity requirements. --- ## v1.1.1 -- Fixed destination port normalization in case of UDP. Thanks to @vpiserchia for contributing the PR. +* Fixed destination port normalization in case of UDP. Thanks to @vpiserchia for contributing the PR. --- ## v1.1.0 -- Enhanced with basic determination of client, server and service from the source and destination addresses and ports. -- Dashboards updated to use client/server instead of source/destination. -- Conversation Partners dashboard replaced by the Conversations dashboard. -- Updated GeoLite City and ASN databases. -- Corrected a problem where geoip.autonomous_system was not always set. +* Enhanced with basic determination of client, server and service from the source and destination addresses and ports. +* Dashboards updated to use client/server instead of source/destination. +* Conversation Partners dashboard replaced by the Conversations dashboard. +* Updated GeoLite City and ASN databases. +* Corrected a problem where geoip.autonomous_system was not always set. --- diff --git a/Dockerfile b/Dockerfile index 4d07cfa..8676889 100644 --- a/Dockerfile +++ b/Dockerfile @@ -24,7 +24,7 @@ LABEL org.opencontainers.image.created="$BUILD_DATE" \ org.opencontainers.image.url="https://github.com/robcowart/elastiflow-docker/elastiflow-logstash" \ org.opencontainers.image.documentation="https://github.com/robcowart/elastiflow-docker/elastiflow-logstash/README.md" \ org.opencontainers.image.source="https://github.com/robcowart/elastiflow" \ - org.opencontainers.image.version="v3.4.2_6.1.3" \ + org.opencontainers.image.version="v3.5.0_6.1.3" \ org.opencontainers.image.vendor="Robert Cowart" \ org.opencontainers.image.title="ElastiFlow™ - Logstash" \ org.opencontainers.image.description="" diff --git a/INSTALL.md b/INSTALL.md index 2e1834a..d8c3f8c 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -1,4 +1,5 @@ # ElastiFlow™ Installation + [![patreon](https://user-images.githubusercontent.com/10326954/52966127-c9847680-33a6-11e9-8640-10dd7abc3af0.png)](https://www.patreon.com/elastiflow) [![Donate](https://img.shields.io/badge/Donate-PayPal-green.svg)](https://www.paypal.me/robcowart) [![Tweet](https://img.shields.io/twitter/url/http/shields.io.svg?style=social)](https://twitter.com/intent/tweet?text=ElastiFlow%E2%84%A2%20provides%20Netflow%20v5%2Fv9%2C%20sFlow%20and%20IPFIX%20data%20collection%20and%20visualization%20using%20the%20Elastic%20Stack.&url=https://github.com/robcowart/elastiflow&hashtags=elastiflow,netflow,sflow,ipfix) ElastiFlow™ is built using the Elastic Stack, including Elasticsearch, Logstash and Kibana. To install and configure ElastiFlow™, you must first have a working Elastic Stack environment. @@ -9,6 +10,7 @@ Refer to the following compatibility chart to choose a release of ElastiFlow&tra Elastic Stack | ElastiFlow™ 1.x | ElastiFlow™ 2.x | ElastiFlow™ 3.x :---:|:---:|:---:|:---: +7.0 | | | ✓ v3.5.0 6.7 | | | ✓ v3.4.2 6.6 | | | ✓ v3.4.1 6.5 | | | ✓ @@ -21,9 +23,10 @@ Elastic Stack | ElastiFlow™ 1.x | ElastiFlow™ 2.x | ElastiFlow&trade 5.5 | ✓ | | 5.4 | ✓ | | -> NOTE: The instructions that follow are for ElastiFlow™ 3.x. +> NOTE: The instructions that follow are for ElastiFlow™ 3.5.0 and above on Elastic Stack 7.x. ## Requirements + Please be aware that in production environments the volume of data generated by many network flow sources can be considerable. It is not uncommon for a core router or firewall to produce 1000s of flow records per second. For this reason it is recommended that ElastiFlow™ be given its own dedicated Logstash instance. Multiple instances may be necessary as the volume of flow data increases. > Due to the way NIC receive queues and the Linux kernel interact, raw UDP packet reception will be bound to a single CPU core and kernel receive buffer. While additional UDP input workers allow Logstash to share the load of processing packets from the receive buffer, it does not scale linearly. As worker threads are increased, so is contention for buffer access. The sweetspot seems to be to use 4-core Logstash instances, adding additional instances as needed for high-volume environments. @@ -43,11 +46,18 @@ The above recommendations are a starting point. Once you are up and running you > I plan to do some additional benchmarking soon, and will update the above table based on those results. ## Setting up Elasticsearch -Currently there is no specific configuration required for Elasticsearch. As long as Kibana and Logstash can talk to your Elasticsearch cluster you should be ready to go. The index template required by Elasticsearch will be uploaded by Logstash. + +Previous versions of ElastiFlow™ required no special configuration for Elasticsearch. However changes made to Elasticsearch 7.x, require that the following settings be made in `elasticsearch.yml`: + +``` +indices.query.bool.max_clause_count: 8192 +search.max_buckets: 100000 +``` At high ingest rates (>10K flows/s), or for data redundancy and high availability, a multi-node cluster is recommended. ## Setting up Logstash + > **IMPORTANT!!! If you are upgrading from version 2.x of ElastiFlow™ you MUST delete the old** `elastiflow` **index template from Elasticsearch PRIOR to starting Logstash with the v3.0.0 pipeline. This can be done by executing** `DELETE _template/elastiflow` **from Dev Tools --> Console in Kibana. Use** `GET _template` **to confirm that it was deleted.** The ElastiFlow™ Logstash pipeline is the heart of the solution. It is here that the raw flow data is collected, decoded, parsed, formatted and enriched. It is this processing that makes possible the analytics options provided by the Kibana [dashboards](#dashboards). @@ -55,24 +65,32 @@ The ElastiFlow™ Logstash pipeline is the heart of the solution. It is here Follow these steps to ensure that Logstash and ElastiFlow™ are optimally configured to meet your needs. ### 1. Set JVM heap size. + To increase performance, ElastiFlow™ takes advantage of the caching and queueing features available in many of the Logstash plugins. These features increase the consumption of the JVM heap. The JVM heap space used by Logstash is configured in `jvm.options`. It is recommended that Logstash be given at least 2GB of JVM heap. If all options, incl. DNS lookups (requires version 3.0.10 or later of the DNS filter), are enabled increase this to 4GB. This is configured in `jvm.options` as follows: + ``` -Xms4g -Xmx4g ``` ### 2. Add and Update Required Logstash plugins + To use ElastiFlow™ you will need to install the community supported [sFlow](https://github.com/ashangit/logstash-codec-sflow) codec for Logstash. It is also recommended that you always use the latest version of the [Netflow](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-netflow.html) codec, the [UDP](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-udp.html) input, and the [DNS](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dns.html) filter. This can achieved by running the following commands: ``` LS_HOME/bin/logstash-plugin install logstash-codec-sflow LS_HOME/bin/logstash-plugin update logstash-codec-netflow LS_HOME/bin/logstash-plugin update logstash-input-udp +LS_HOME/bin/logstash-plugin update logstash-input-tcp LS_HOME/bin/logstash-plugin update logstash-filter-dns +LS_HOME/bin/logstash-plugin update logstash-filter-geoip +LS_HOME/bin/logstash-plugin update logstash-filter-translate ``` ### 3. Copy the pipeline files to the Logstash configuration path. + There are five sets of configuration files provided within the `logstash/elastiflow` folder: + ``` logstash `- elastiflow @@ -92,6 +110,7 @@ ELASTIFLOW_TEMPLATE_PATH | The path to where index templates are located | /etc/ ELASTIFLOW_GEOIP_DB_PATH | The path where GeoIP DBs are located | /etc/logstash/elastiflow/geoipdbs ### 4. Setup environment variable helper files + Rather than directly editing the pipeline configuration files for your environment, environment variables are used to provide a single location for most configuration options. These environment variables will be referred to in the remaining instructions. A [reference](#environment-variable-reference) of all environment variables can be found [here](#environment-variable-reference). Depending on your environment there may be many ways to define environment variables. The files `profile.d/elastiflow.sh` and `logstash.service.d/elastiflow.conf` are provided to help you with this setup. @@ -101,6 +120,7 @@ Recent versions of both RedHat/CentOS and Ubuntu use systemd to start background > Remember that for your changes to take effect, you must issue the command `sudo systemctl daemon-reload`. ### 5. Add the ElastiFlow™ pipeline to pipelines.yml + Logstash 6.0 introduced the ability to run multiple pipelines from a single Logstash instance. The `pipelines.yml` file is where these pipelines are configured. While a single pipeline can be specified directly in `logstash.yml`, it is a good practice to use `pipelines.yml` for consistency across environments. Edit `pipelines.yml` (usually located at `/etc/logstash/pipelines.yml`) and add the ElasiFlow™ pipeline (adjust the path as necessary). @@ -111,6 +131,7 @@ Edit `pipelines.yml` (usually located at `/etc/logstash/pipelines.yml`) and add ``` ### 6. Configure inputs + By default flow data will be recieved on all IPv4 addresses of the Logstash host using the standard ports for each flow type. You can change both the IPs and ports used by modifying the following environment variables: Environment Variable | Description | Default Value @@ -153,24 +174,8 @@ ELASTIFLOW_IPFIX_UDP_RCV_BUFF | The socket receive buffer size (bytes) for IPFIX > WARNING! Increasing `queue_size` will increase heap_usage. Make sure have configured JVM heap appropriately as specified in the [Requirements](#requirements) -#### 6.a. Using Custom Netflow and IPFIX Field Definitions -To properly decode flows from some devices it may be necessary to use customized field definitions. This is achieved by uncommenting one or both of the following lines in the pipeline's input. - -``` -#netflow_definitions => "${ELASTIFLOW_DEFINITION_PATH:/etc/logstash/elastiflow/definitions}/netflow.yml" -#ipfix_definitions => "${ELASTIFLOW_DEFINITION_PATH:/etc/logstash/elastiflow/definitions}/ipfix.yml" -``` - -The path to the custom field definitions is configured by setting the following environment variable: - -Environment Variable | Description | Default Value ---- | --- | --- -ELASTIFLOW_DEFINITION_PATH | The path where custom field definitions are located | /etc/logstash/elastiflow/definitions - -The included custom field definitions add support for the following devices: -* Riverbed WAN Optimizers - ### 7. Configure Elasticsearch output + Obviously the data needs to land in Elasticsearch, so you need to tell Logstash where to send it. The default is to send data to only a single Elasticsearch node. This node is specified using the following environment variable: @@ -205,6 +210,7 @@ ELASTIFLOW_ES_SSL_VERIFY | Enable or disable verification of the SSL certificate > If ELASTIFLOW_ES_SSL_ENABLE and ELASTIFLOW_ES_SSL_VERIFY are both `true`, you must uncomment the `cacert` option in the Elasticsearch output and set the path to the certificate. ### 8. Enable DNS name resolution (optional) + In the past it was recommended to avoid DNS queries as the latency costs of such lookups had a devastating effect on throughput. While the Logstash DNS filter provides a caching mechanism, its use was not recommended. When the cache was enabled all lookups were performed synchronously. If a name server failed to respond, all other queries were stuck waiting until the query timed out. The end result was even worse performance. Fortunately these problems have been resolved. Release 3.0.8 of the DNS filter introduced an enhancement which caches timeouts as failures, in addition to normal NXDOMAIN responses. This was an important step as many domain owner intentionally setup their nameservers to ignore the reverse lookups needed to enrich flow data. In addition to this change, I submitted am enhancement which allows for concurrent queries when caching is enabled. The Logstash team approved this change, and it is included in 3.0.10 of the plugin. @@ -225,13 +231,16 @@ ELASTIFLOW_DNS_FAILED_CACHE_SIZE | The cache size for failed DNS queries | 75000 ELASTIFLOW_DNS_FAILED_CACHE_TTL | The time in seconds failed DNS queries are cached | 3600 ### 9. Configure Application ID enrichment (optional) + Both Netflow and IPFIX allow devices with application identification features to specify the application associated with the traffic in the flow. For Netflow this is the `application_id` field. The IPFIX field is `applicationId`. The application names which correspond to values of these IDs is vendor-specific. In order for ElastiFlow™ to accurately translate the ID values, it must be told the type of device that is exporting the flows. To do so you must edit `elastiflow/dictionaries/app_id_srctype.yml` and specify the source type of your supported device. For example... + ``` "192.0.2.1": "cisco_nbar2" "192.0.2.2": "fortinet" ``` + > Currently supported is Cisco's NBAR2 and Fortinet's FortiOS. If you have a device that you would like added, I will need a mapping of Application IDs to names. This can often be extracted from the device's configuration. I would love to be able to build up a large knowledge base of such mappings. You can also define a default source type value by setting the following environment variable: @@ -241,28 +250,35 @@ Environment Variable | Description | Default Value ELASTIFLOW_DEFAULT_APPID_SRCTYPE | Sets the default source type for translating the App IDs to names. Valid values are `cisco_nbar2` and `fortinet` | __UNKNOWN Application identity is also supported from the following sources, and requires no additional configuration: -- Citrix Netscaler -- IXIA IxFlow -- ntop nProbe (An nProbe configuration file that works well with ElastiFlow™ is available [HERE](https://gist.github.com/robcowart/afd538026db29ee96dd9c495efb52ea6)) -- Palo Alto -- SonicWall -- Sophos + +* Citrix Netscaler +* IXIA IxFlow +* ntop nProbe (An nProbe configuration file that works well with ElastiFlow™ is available [HERE](https://gist.github.com/robcowart/afd538026db29ee96dd9c495efb52ea6)) +* Palo Alto +* SonicWall +* Sophos Once configured ElastiFlow™ will resolve the ID to an application name, which will be available in the dashboards. screen shot 2018-05-13 at 12 40 04 ### 10. Manually set the sampling interval for devices that don't send it. (optional) + Some devices which collect sampled flows do not include the sampling interval in the flow records that they send (e.g. some Cisco IOS XR and Huawei devices). In such situations the sampling interval can be set manually by adding the IP address and sampling rate for the device in `elastiflow/dictionaries/sampling_interval.yml`. ### 11. Start Logstash + You should now be able to start Logstash and begin collecting network flow data. Assuming you are running a recent version of RedHat/CentOS or Ubuntu, and using systemd, complete these steps: + 1. Run `systemctl daemon-reload` to ensure any changes to the environment variables are recognized. 2. Run `systemctl start logstash` + > NOTICE! Make sure that you have already setup the Logstash init files by running `LS_HOME/bin/system-install`. If the init files have not been setup you will receive an error. To follow along as Logstash starts you can tail its log by running: + ``` tail -f /var/log/logstash/logstash-plain.log ``` + Logstash takes a little time to start... BE PATIENT! If using Netflow v9 or IPFIX you will likely see warning messages related to the flow templates not yet being received. They will disappear after templates are received from the network devices, which should happen every few minutes. Some devices can take a bit longer to send templates. Fortinet in particular send templates rather infrequently. @@ -270,13 +286,17 @@ If using Netflow v9 or IPFIX you will likely see warning messages related to the Logstash setup is now complete. If you are receiving flow data, you should have an `elastiflow-` daily index in Elasticsearch. ## Setting up Kibana + Kibana 6.5 introduced the ability to export and import Index Patterns through the UI. This greatly simplifies the setup of Kibana. ### Kibana 6.5.x and Later + The Index Patterns, vizualizations and dashboards can be loaded into Kibana by importing the `elastiflow.kibana..json` file from within the Kibana UI. This is done from the `Management -> Saved Objects` page. ### Kibana 6.4.x and Earlier + An API (yet undocumented) is available to import and export Index Patterns. The JSON file which contains the Index Pattern configuration is `kibana/elastiflow.index_pattern.json`. To setup the `elastiflow-*` Index Pattern run the following command: + ``` curl -X POST -u USERNAME:PASSWORD http://KIBANASERVER:5601/api/saved_objects/index-pattern/elastiflow-* -H "Content-Type: application/json" -H "kbn-xsrf: true" -d @/PATH/TO/elastiflow.index_pattern.json ``` @@ -284,6 +304,7 @@ curl -X POST -u USERNAME:PASSWORD http://KIBANASERVER:5601/api/saved_objects/ind Finally the vizualizations and dashboards can be loaded into Kibana by importing the `elastiflow.dashboards..json` file from within the Kibana UI. This is done from the `Management -> Saved Objects` page. There are separate dashboard import files for version 6.2.x, 6.3.x and 6.4.x of Kibana. Select the file that corresponds to your version of Kibana. ### Recommended Kibana Advanced Settings + You may find that modifying a few of the Kibana advanced settings will produce a more user-friendly experience while using ElastiFlow™. These settings are made in Kibana, under `Management -> Advanced Settings`. Advanced Setting | Value | Why make the change? @@ -294,6 +315,7 @@ state:storeInSessionStorage | true | Kibana URLs can get pretty large. Especiall timepicker:quickRanges | [see below](#recommended-setting-for-timepicker:quickRanges) | The default options in the Time Picker are less than optimal, for most logging and monitoring use-cases. Fortunately Kibana now allows you to customize the time picker. Our recommended settings can be found [see below](#recommended-setting-for-timepicker:quickRanges). ## Environment Variable Reference + The supported environment variables are: Environment Variable | Description | Default Value @@ -350,122 +372,106 @@ ELASTIFLOW_IPFIX_UDP_QUEUE_SIZE | The number of unprocessed IPFIX UDP packets th ELASTIFLOW_IPFIX_UDP_RCV_BUFF | The socket receive buffer size (bytes) for IPFIX | 33554432 ## Recommended Setting for timepicker:quickRanges + I recommend configuring `timepicker:quickRanges` for the setting below. The result will look like this: -![screen shot 2018-05-17 at 19 57 03](https://user-images.githubusercontent.com/10326954/40195016-8d33cac4-5a0c-11e8-976f-cc6559e4439a.png) +![timepicker:quickRanges](https://user-images.githubusercontent.com/10326954/57178139-9a8d8500-6e6c-11e9-8539-db61a81b321b.png) ``` [ - { - "from": "now/d", - "to": "now/d", - "display": "Today", - "section": 0 - }, - { - "from": "now/w", - "to": "now/w", - "display": "This week", - "section": 0 - }, - { - "from": "now/M", - "to": "now/M", - "display": "This month", - "section": 0 - }, - { - "from": "now/d", - "to": "now", - "display": "Today so far", - "section": 0 - }, - { - "from": "now/w", - "to": "now", - "display": "Week to date", - "section": 0 - }, - { - "from": "now/M", - "to": "now", - "display": "Month to date", - "section": 0 - }, { "from": "now-15m", "to": "now", - "display": "Last 15 minutes", - "section": 1 + "display": "Last 15 minutes" }, { "from": "now-30m", "to": "now", - "display": "Last 30 minutes", - "section": 1 + "display": "Last 30 minutes" }, { "from": "now-1h", "to": "now", - "display": "Last 1 hour", - "section": 1 + "display": "Last 1 hour" }, { "from": "now-2h", "to": "now", - "display": "Last 2 hours", - "section": 1 + "display": "Last 2 hours" }, { "from": "now-4h", "to": "now", - "display": "Last 4 hours", - "section": 2 + "display": "Last 4 hours" }, { "from": "now-12h", "to": "now", - "display": "Last 12 hours", - "section": 2 + "display": "Last 12 hours" }, { "from": "now-24h", "to": "now", - "display": "Last 24 hours", - "section": 2 + "display": "Last 24 hours" }, { "from": "now-48h", "to": "now", - "display": "Last 48 hours", - "section": 2 + "display": "Last 48 hours" }, { "from": "now-7d", "to": "now", - "display": "Last 7 days", - "section": 3 + "display": "Last 7 days" }, { "from": "now-30d", "to": "now", - "display": "Last 30 days", - "section": 3 + "display": "Last 30 days" }, { "from": "now-60d", "to": "now", - "display": "Last 60 days", - "section": 3 + "display": "Last 60 days" }, { "from": "now-90d", "to": "now", - "display": "Last 90 days", - "section": 3 + "display": "Last 90 days" + }, + { + "from": "now/d", + "to": "now/d", + "display": "Today" + }, + { + "from": "now/w", + "to": "now/w", + "display": "This week" + }, + { + "from": "now/M", + "to": "now/M", + "display": "This month" + }, + { + "from": "now/d", + "to": "now", + "display": "Today so far" + }, + { + "from": "now/w", + "to": "now", + "display": "Week to date" + }, + { + "from": "now/M", + "to": "now", + "display": "Month to date" } ] ``` ## Attribution + This product includes GeoLite2 data created by MaxMind, available from (http://www.maxmind.com) diff --git a/README.md b/README.md index 354288f..bc78bb4 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ ElastiFlow™ provides network flow data collection and visualization using the Elastic Stack (Elasticsearch, Logstash and Kibana). It supports Netflow v5/v9, sFlow and IPFIX flow types (1.x versions support only Netflow v5/v9). -![ElastiFlow™](https://user-images.githubusercontent.com/10326954/52973891-f42ef900-33bf-11e9-8243-aed047decf3b.png) +![ElastiFlow™](https://user-images.githubusercontent.com/10326954/57181284-fc141a80-6e91-11e9-9ec5-d0864c25a088.png) I was inspired to create ElastiFlow™ following the overwhelmingly positive feedback received to an article I posted on Linkedin... [WTFlow?! Are you really still paying for commercial solutions to collect and analyze network flow data?](https://www.linkedin.com/pulse/wtflow-you-really-still-paying-commercial-solutions-collect-cowart) @@ -31,12 +31,12 @@ The following dashboards are provided. ### Overview -![Overview](https://user-images.githubusercontent.com/10326954/52973920-158fe500-33c0-11e9-96ed-606c01aca7c8.png) +![Overview](https://user-images.githubusercontent.com/10326954/57179336-290a0280-6e7d-11e9-8e34-f4d3f04567f7.png) ### Top-N There are separate Top-N dashboards for Top Talkers, Services, Conversations and Applications. -![Top-N](https://user-images.githubusercontent.com/10326954/52973927-19bc0280-33c0-11e9-9352-76c483738c24.png) +![Top-N](https://user-images.githubusercontent.com/10326954/57181182-c02c8580-6e90-11e9-8cc6-b32424566dea.png) ### Threats @@ -46,39 +46,39 @@ ElastiFlow™ includes a dictionary of public IP addresses that are known to 2. At-Risk Servers - Private Servers that are being reached by clients with a poor IP reputation. 3. High-Risk Clients - Private clients that are accessing public servers which have a poor reputation. -![Threats](https://user-images.githubusercontent.com/10326954/52973930-1c1e5c80-33c0-11e9-8aa8-87252461336c.png) +![Threats](https://user-images.githubusercontent.com/10326954/57181155-865b7f00-6e90-11e9-82f8-bb8e7b2df083.png) ### Flows There are separate Sankey dashboards for Client/Server, Source/Destination and Autonomous System perspectives. The sankey visualizations are built using the new Vega visualization plugin. -![Flows](https://user-images.githubusercontent.com/10326954/52973933-204a7a00-33c0-11e9-91d8-7b194bd978eb.png) +![Flows](https://user-images.githubusercontent.com/10326954/57180877-65455f00-6e8d-11e9-9411-ca2b952748e7.png) ### Geo IP There are separate Geo Loacation dashboards for Client/Server and Source/Destination perspectives. -![Geo IP](https://user-images.githubusercontent.com/10326954/52973940-27718800-33c0-11e9-88d9-466396e080e6.png) +![Geo IP](https://user-images.githubusercontent.com/10326954/57180209-cf0e3a80-6e86-11e9-8b7b-acd3a82181af.png) ### AS Traffic Provides a view of traffic to and from Autonomous Systems (public IP ranges) -![AS Traffic](https://user-images.githubusercontent.com/10326954/52973944-2cced280-33c0-11e9-9e95-e2f17fbb7ea6.png) +![AS Traffic](https://user-images.githubusercontent.com/10326954/57180844-17305b80-6e8d-11e9-875e-a715d0c66a25.png) -### Exporters +### Flow Exporters -![Flow Exporters](https://user-images.githubusercontent.com/10326954/52973950-322c1d00-33c0-11e9-954d-7446f0bc2e23.png) +![Flow Exporters](https://user-images.githubusercontent.com/10326954/57180767-51e5c400-6e8c-11e9-9c06-6c34ec6ea922.png) ### Traffic Details -![Traffic Details](https://user-images.githubusercontent.com/10326954/52973955-35bfa400-33c0-11e9-89db-74e8754a7c25.png) +![Traffic Details](https://user-images.githubusercontent.com/10326954/57180793-86598000-6e8c-11e9-9dc1-341abafbd20e.png) ### Flow Records -![Flow Records](https://user-images.githubusercontent.com/10326954/52973958-38ba9480-33c0-11e9-96b3-9de9f2dceca6.png) +![Flow Records](https://user-images.githubusercontent.com/10326954/57180815-bf91f000-6e8c-11e9-823d-6fb10d5a9d16.png) ### Ziften ZFlow ElastiFlow™ v3.4.0 added support for IPFIX records from Ziften's ZFlow agent. In addition to being fully integrated with the standard dashboards, a stand-alone ZFlow dashboards displays network traffic based on user and command data provided by ZFlow. -![Ziften ZFlow](https://user-images.githubusercontent.com/10326954/52973968-3ce6b200-33c0-11e9-98c5-20179ae80db3.png) +![Ziften ZFlow](https://user-images.githubusercontent.com/10326954/57181212-0da8f280-6e91-11e9-8725-4e06b22fc64b.png) ## Attribution diff --git a/SERVICES.md b/SERVICES.md index 82b1ae1..4a9b77d 100644 --- a/SERVICES.md +++ b/SERVICES.md @@ -15,6 +15,14 @@ VyoPath, Inc. 9689 Avalon Drive Frisco, Texas 75035 -Phone: 469.850.2419 +Phone: +1 469 850 2419 Email: info@vyopath.com ```` + +# ElastiFlow™ Services Consultants + +Independent ElastiFlow™ Services Consultants provide commercial deployment services and support for ElastiFlow. + +Consultant | Location | Email +--- | --- | --- +Dmitry Vasilets | Berlin, Germany | pronix.service@gmail.com diff --git a/SPONSORS.md b/SPONSORS.md index 558b369..c8307a7 100644 --- a/SPONSORS.md +++ b/SPONSORS.md @@ -13,3 +13,4 @@ I have received many notes of thanks for the ElastiFlow™ project. However * Radek Černík * Ian Graham * CSIRT Gadgets, LLC +* Dmitriy Vasilets diff --git a/docker-compose.yml b/docker-compose.yml index f3a929d..0e4a3c2 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -19,7 +19,7 @@ version: '3' services: elastiflow-elasticsearch-oss: - image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.7.1 + image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.0.1 container_name: elastiflow-elasticsearch-oss restart: 'no' ulimits: @@ -41,11 +41,15 @@ services: network.host: 0.0.0.0 http.port: 9200 + discovery.type: 'single-node' + + indices.query.bool.max_clause_count: 8192 + search.max_buckets: 100000 action.destructive_requires_name: 'true' elastiflow-kibana-oss: - image: docker.elastic.co/kibana/kibana-oss:6.7.1 + image: docker.elastic.co/kibana/kibana-oss:7.0.1 container_name: elastiflow-kibana-oss restart: 'no' depends_on: @@ -62,7 +66,7 @@ services: LOGGING_QUIET: 'true' elastiflow-logstash-oss: - image: robcowart/elastiflow-logstash-oss:3.4.2_6.1.3 + image: robcowart/elastiflow-logstash-oss:3.5.0_6.1.3 container_name: elastiflow-logstash-oss restart: 'no' depends_on: diff --git a/docker_build.sh b/docker_build.sh index dab5806..53ec1d0 100755 --- a/docker_build.sh +++ b/docker_build.sh @@ -15,4 +15,4 @@ # Robert Cowart are Copyright (C)2019 Robert Cowart. All Rights Reserved. #------------------------------------------------------------------------------ -docker build --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') -t robcowart/elastiflow-logstash-oss:3.4.2_6.1.3 . +docker build --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') -t robcowart/elastiflow-logstash-oss:3.5.0_6.1.3 . diff --git a/kibana/elastiflow.kibana.7.0.x.json b/kibana/elastiflow.kibana.7.0.x.json new file mode 100644 index 0000000..a85128e --- /dev/null +++ b/kibana/elastiflow.kibana.7.0.x.json @@ -0,0 +1,9563 @@ +[ + { + "_id": "0809c1f0-6719-11e7-b5b8-29fbded8e37c", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Top Services", + "hits": 0, + "description": "", + "panelsJSON": "[{\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"gridData\":{\"x\":0,\"y\":18,\"w\":24,\"h\":30,\"i\":\"13\"},\"panelIndex\":\"13\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_0\"},{\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"20\"},\"panelIndex\":\"20\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_1\"},{\"gridData\":{\"x\":10,\"y\":3,\"w\":38,\"h\":15,\"i\":\"23\"},\"panelIndex\":\"23\",\"title\":\"Services (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_2\"},{\"gridData\":{\"x\":0,\"y\":3,\"w\":10,\"h\":15,\"i\":\"24\"},\"panelIndex\":\"24\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_3\"},{\"gridData\":{\"x\":24,\"y\":18,\"w\":24,\"h\":30,\"i\":\"26\"},\"panelIndex\":\"26\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":0,\"w\":29,\"h\":3,\"i\":\"27\"},\"panelIndex\":\"27\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":29,\"y\":0,\"w\":14,\"h\":3,\"i\":\"28\"},\"panelIndex\":\"28\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_6\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "panel_0", + "type": "visualization", + "id": "f41316d0-8020-11e7-bcae-4bd056c878e8" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "b22f5660-55d2-11e8-a695-171fb712da36" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "7546a110-55fd-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "a04e4ba0-55fe-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "30ff5d70-336b-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "33f660e0-336c-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "64c19720-5619-11e8-b711-83a5f93b17f3", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Traffic Details (attributes)", + "hits": 0, + "description": "", + "panelsJSON": "[{\"panelIndex\":\"48\",\"gridData\":{\"x\":16,\"y\":49,\"w\":8,\"h\":11,\"i\":\"48\"},\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_0\"},{\"panelIndex\":\"49\",\"gridData\":{\"x\":40,\"y\":8,\"w\":8,\"h\":11,\"i\":\"49\"},\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_1\"},{\"panelIndex\":\"75\",\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"75\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_2\"},{\"panelIndex\":\"80\",\"gridData\":{\"x\":0,\"y\":19,\"w\":24,\"h\":15,\"i\":\"80\"},\"title\":\"IP Protocols (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_3\"},{\"panelIndex\":\"84\",\"gridData\":{\"x\":24,\"y\":60,\"w\":24,\"h\":15,\"i\":\"84\"},\"title\":\"TCP Flags (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_4\"},{\"panelIndex\":\"86\",\"gridData\":{\"x\":0,\"y\":60,\"w\":24,\"h\":15,\"i\":\"86\"},\"title\":\"Types of Service (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_5\"},{\"panelIndex\":\"87\",\"gridData\":{\"x\":24,\"y\":19,\"w\":24,\"h\":15,\"i\":\"87\"},\"title\":\"VLANs (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_6\"},{\"panelIndex\":\"88\",\"gridData\":{\"x\":16,\"y\":8,\"w\":8,\"h\":11,\"i\":\"88\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_7\"},{\"panelIndex\":\"94\",\"gridData\":{\"x\":40,\"y\":49,\"w\":8,\"h\":11,\"i\":\"94\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_8\"},{\"panelIndex\":\"111\",\"gridData\":{\"x\":0,\"y\":34,\"w\":24,\"h\":15,\"i\":\"111\"},\"title\":\"IP Protocols (pkts/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_9\"},{\"panelIndex\":\"114\",\"gridData\":{\"x\":24,\"y\":75,\"w\":24,\"h\":15,\"i\":\"114\"},\"title\":\"TCP Flags (pkts/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_10\"},{\"panelIndex\":\"116\",\"gridData\":{\"x\":0,\"y\":75,\"w\":24,\"h\":15,\"i\":\"116\"},\"title\":\"Types of Service (pkts/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_11\"},{\"panelIndex\":\"117\",\"gridData\":{\"x\":24,\"y\":34,\"w\":24,\"h\":15,\"i\":\"117\"},\"title\":\"VLANs (pkts/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_12\"},{\"panelIndex\":\"118\",\"gridData\":{\"x\":0,\"y\":3,\"w\":40,\"h\":5,\"i\":\"118\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_13\"},{\"panelIndex\":\"120\",\"gridData\":{\"x\":40,\"y\":3,\"w\":8,\"h\":5,\"i\":\"120\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_14\"},{\"panelIndex\":\"121\",\"gridData\":{\"x\":24,\"y\":8,\"w\":16,\"h\":11,\"i\":\"121\"},\"title\":\"VLANs (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_15\"},{\"panelIndex\":\"123\",\"gridData\":{\"x\":0,\"y\":49,\"w\":16,\"h\":11,\"i\":\"123\"},\"title\":\"Types of Service (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_16\"},{\"panelIndex\":\"124\",\"gridData\":{\"x\":24,\"y\":49,\"w\":16,\"h\":11,\"i\":\"124\"},\"title\":\"TCP Flags (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_17\"},{\"panelIndex\":\"125\",\"gridData\":{\"x\":0,\"y\":8,\"w\":16,\"h\":11,\"i\":\"125\"},\"title\":\"IP Protocols (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_18\"},{\"gridData\":{\"x\":0,\"y\":0,\"w\":29,\"h\":3,\"i\":\"126\"},\"version\":\"6.6.0\",\"panelIndex\":\"126\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_19\"},{\"gridData\":{\"x\":29,\"y\":0,\"w\":14,\"h\":3,\"i\":\"127\"},\"version\":\"6.6.0\",\"panelIndex\":\"127\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_20\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "panel_0", + "type": "visualization", + "id": "9accd4a0-657a-11e7-8471-e5432f50acbd" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "b13956f0-657a-11e7-8471-e5432f50acbd" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "114eba40-55d4-11e8-a695-171fb712da36" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "8b09a0f0-55d1-11e8-a695-171fb712da36" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "28ddcaf0-55d1-11e8-a695-171fb712da36" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "00b3a860-55d1-11e8-a695-171fb712da36" + }, + { + "name": "panel_7", + "type": "visualization", + "id": "e607f720-560f-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_8", + "type": "visualization", + "id": "be939000-560f-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_9", + "type": "visualization", + "id": "b3007880-5613-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_10", + "type": "visualization", + "id": "6a815bb0-5613-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_11", + "type": "visualization", + "id": "604bae20-5613-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_12", + "type": "visualization", + "id": "5af01150-5613-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_13", + "type": "visualization", + "id": "61ed9a20-561a-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_14", + "type": "visualization", + "id": "8fee97e0-55b5-11e8-a1f3-452446793d46" + }, + { + "name": "panel_15", + "type": "visualization", + "id": "d297fe60-2fd7-11e7-af27-99e728e71e91" + }, + { + "name": "panel_16", + "type": "visualization", + "id": "4dc994a0-2fd7-11e7-97a8-85d8d5a99269" + }, + { + "name": "panel_17", + "type": "visualization", + "id": "661ff9d0-55c5-11e8-a1f3-452446793d46" + }, + { + "name": "panel_18", + "type": "visualization", + "id": "d23a33d0-55c8-11e8-a1f3-452446793d46" + }, + { + "name": "panel_19", + "type": "visualization", + "id": "4bdddfe0-336b-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_20", + "type": "visualization", + "id": "fadebf50-336b-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "95ccacb0-5619-11e8-b711-83a5f93b17f3", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Traffic Details (locality)", + "hits": 0, + "description": "", + "panelsJSON": "[{\"panelIndex\":\"75\",\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"75\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_0\"},{\"panelIndex\":\"78\",\"gridData\":{\"x\":24,\"y\":19,\"w\":24,\"h\":15,\"i\":\"78\"},\"title\":\"Autonomous Systems (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_1\"},{\"panelIndex\":\"85\",\"gridData\":{\"x\":0,\"y\":19,\"w\":24,\"h\":15,\"i\":\"85\"},\"title\":\"Traffic Locality (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_2\"},{\"panelIndex\":\"96\",\"gridData\":{\"x\":40,\"y\":8,\"w\":8,\"h\":11,\"i\":\"96\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_3\"},{\"panelIndex\":\"98\",\"gridData\":{\"x\":16,\"y\":8,\"w\":8,\"h\":11,\"i\":\"98\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_4\"},{\"panelIndex\":\"100\",\"gridData\":{\"x\":40,\"y\":49,\"w\":8,\"h\":11,\"i\":\"100\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_5\"},{\"panelIndex\":\"101\",\"gridData\":{\"x\":16,\"y\":49,\"w\":8,\"h\":11,\"i\":\"101\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_6\"},{\"panelIndex\":\"103\",\"gridData\":{\"x\":0,\"y\":60,\"w\":24,\"h\":15,\"i\":\"103\"},\"title\":\"Countries (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_7\"},{\"panelIndex\":\"105\",\"gridData\":{\"x\":24,\"y\":60,\"w\":24,\"h\":15,\"i\":\"105\"},\"title\":\"Cities (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_8\"},{\"panelIndex\":\"107\",\"gridData\":{\"x\":24,\"y\":34,\"w\":24,\"h\":15,\"i\":\"107\"},\"title\":\"Autonomous Systems (pkts/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_9\"},{\"panelIndex\":\"108\",\"gridData\":{\"x\":24,\"y\":75,\"w\":24,\"h\":15,\"i\":\"108\"},\"title\":\"Cities (pkts/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_10\"},{\"panelIndex\":\"110\",\"gridData\":{\"x\":0,\"y\":75,\"w\":24,\"h\":15,\"i\":\"110\"},\"title\":\"Countries (pkts/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_11\"},{\"panelIndex\":\"115\",\"gridData\":{\"x\":0,\"y\":34,\"w\":24,\"h\":15,\"i\":\"115\"},\"title\":\"Traffic Locality (pkts/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_12\"},{\"panelIndex\":\"117\",\"gridData\":{\"x\":40,\"y\":3,\"w\":8,\"h\":5,\"i\":\"117\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_13\"},{\"panelIndex\":\"120\",\"gridData\":{\"x\":0,\"y\":3,\"w\":40,\"h\":5,\"i\":\"120\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_14\"},{\"panelIndex\":\"121\",\"gridData\":{\"x\":24,\"y\":8,\"w\":16,\"h\":11,\"i\":\"121\"},\"title\":\"Autonomous Systems (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_15\"},{\"title\":\"Cities (flow records)\",\"panelIndex\":\"122\",\"gridData\":{\"x\":24,\"y\":49,\"w\":16,\"h\":11,\"i\":\"122\"},\"version\":\"6.6.0\",\"panelRefName\":\"panel_16\"},{\"panelIndex\":\"123\",\"gridData\":{\"x\":0,\"y\":49,\"w\":16,\"h\":11,\"i\":\"123\"},\"title\":\"Countries (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_17\"},{\"panelIndex\":\"124\",\"gridData\":{\"x\":0,\"y\":8,\"w\":16,\"h\":11,\"i\":\"124\"},\"title\":\"Traffic Locality (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_18\"},{\"gridData\":{\"x\":0,\"y\":0,\"w\":29,\"h\":3,\"i\":\"125\"},\"version\":\"6.6.0\",\"panelIndex\":\"125\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_19\"},{\"gridData\":{\"x\":29,\"y\":0,\"w\":14,\"h\":3,\"i\":\"126\"},\"version\":\"6.6.0\",\"panelIndex\":\"126\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_20\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "panel_0", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "e1a87390-55cd-11e8-a695-171fb712da36" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "05aa2550-55d2-11e8-a695-171fb712da36" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "d5e94030-5617-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "003b4bd0-5618-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "c01e5510-5617-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "afa2d1c0-5617-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_7", + "type": "visualization", + "id": "3a281650-55d9-11e8-a695-171fb712da36" + }, + { + "name": "panel_8", + "type": "visualization", + "id": "c6e39d30-55d9-11e8-a695-171fb712da36" + }, + { + "name": "panel_9", + "type": "visualization", + "id": "f2b5acc0-5613-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_10", + "type": "visualization", + "id": "ebd23770-5613-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_11", + "type": "visualization", + "id": "d8e1bc80-5613-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_12", + "type": "visualization", + "id": "65162e80-5613-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_13", + "type": "visualization", + "id": "8fee97e0-55b5-11e8-a1f3-452446793d46" + }, + { + "name": "panel_14", + "type": "visualization", + "id": "c0ca16b0-561d-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_15", + "type": "visualization", + "id": "4abad150-55bc-11e8-a1f3-452446793d46" + }, + { + "name": "panel_16", + "type": "visualization", + "id": "849562d0-55be-11e8-a1f3-452446793d46" + }, + { + "name": "panel_17", + "type": "visualization", + "id": "64d75bf0-55bf-11e8-a1f3-452446793d46" + }, + { + "name": "panel_18", + "type": "visualization", + "id": "178b0af0-6230-11e7-9a50-efc26ded795d" + }, + { + "name": "panel_19", + "type": "visualization", + "id": "4bdddfe0-336b-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_20", + "type": "visualization", + "id": "e79ec4d0-336b-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "AWFgr4DaugC1WJLdy9iE", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Top Talkers", + "hits": 0, + "description": "", + "panelsJSON": "[{\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"gridData\":{\"x\":0,\"y\":18,\"w\":24,\"h\":30,\"i\":\"10\"},\"panelIndex\":\"10\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"gridData\":{\"x\":24,\"y\":18,\"w\":24,\"h\":30,\"i\":\"12\"},\"panelIndex\":\"12\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_1\"},{\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"18\"},\"panelIndex\":\"18\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_2\"},{\"gridData\":{\"x\":10,\"y\":3,\"w\":38,\"h\":15,\"i\":\"21\"},\"panelIndex\":\"21\",\"title\":\"Services (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_3\"},{\"gridData\":{\"x\":0,\"y\":3,\"w\":10,\"h\":15,\"i\":\"22\"},\"panelIndex\":\"22\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":0,\"w\":29,\"h\":3,\"i\":\"23\"},\"panelIndex\":\"23\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":29,\"y\":0,\"w\":14,\"h\":3,\"i\":\"24\"},\"panelIndex\":\"24\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_6\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "panel_0", + "type": "visualization", + "id": "bb92fa50-8020-11e7-bcae-4bd056c878e8" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "ce9157f0-8020-11e7-bcae-4bd056c878e8" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "b22f5660-55d2-11e8-a695-171fb712da36" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "7546a110-55fd-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "30ff5d70-336b-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "1d9c7c30-336c-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "10584050-6234-11e7-8236-19b4b4941e22", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Traffic Details (types)", + "hits": 0, + "description": "", + "panelsJSON": "[{\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}},\"gridData\":{\"x\":16,\"y\":8,\"w\":8,\"h\":11,\"i\":\"54\"},\"panelIndex\":\"54\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}},\"gridData\":{\"x\":40,\"y\":8,\"w\":8,\"h\":11,\"i\":\"59\"},\"panelIndex\":\"59\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}},\"gridData\":{\"x\":16,\"y\":49,\"w\":8,\"h\":11,\"i\":\"64\"},\"panelIndex\":\"64\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_2\"},{\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"75\"},\"panelIndex\":\"75\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_3\"},{\"gridData\":{\"x\":0,\"y\":19,\"w\":24,\"h\":15,\"i\":\"79\"},\"panelIndex\":\"79\",\"title\":\"Clients (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_4\"},{\"gridData\":{\"x\":24,\"y\":19,\"w\":24,\"h\":15,\"i\":\"81\"},\"panelIndex\":\"81\",\"title\":\"Servers (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_5\"},{\"gridData\":{\"x\":0,\"y\":60,\"w\":24,\"h\":15,\"i\":\"82\"},\"panelIndex\":\"82\",\"title\":\"Services (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_6\"},{\"gridData\":{\"x\":40,\"y\":49,\"w\":8,\"h\":11,\"i\":\"91\"},\"panelIndex\":\"91\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_7\"},{\"gridData\":{\"x\":24,\"y\":60,\"w\":24,\"h\":15,\"i\":\"92\"},\"panelIndex\":\"92\",\"title\":\"Applications (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_8\"},{\"gridData\":{\"x\":24,\"y\":75,\"w\":24,\"h\":15,\"i\":\"106\"},\"panelIndex\":\"106\",\"title\":\"Applications (pkts/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_9\"},{\"gridData\":{\"x\":0,\"y\":34,\"w\":24,\"h\":15,\"i\":\"109\"},\"panelIndex\":\"109\",\"title\":\"Clients (pkts/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_10\"},{\"gridData\":{\"x\":24,\"y\":34,\"w\":24,\"h\":15,\"i\":\"112\"},\"panelIndex\":\"112\",\"title\":\"Servers (pkts/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_11\"},{\"gridData\":{\"x\":0,\"y\":75,\"w\":24,\"h\":15,\"i\":\"113\"},\"panelIndex\":\"113\",\"title\":\"Services (pkts/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_12\"},{\"gridData\":{\"x\":40,\"y\":3,\"w\":8,\"h\":5,\"i\":\"119\"},\"panelIndex\":\"119\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_13\"},{\"gridData\":{\"x\":0,\"y\":3,\"w\":40,\"h\":5,\"i\":\"121\"},\"panelIndex\":\"121\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_14\"},{\"gridData\":{\"x\":24,\"y\":49,\"w\":16,\"h\":11,\"i\":\"122\"},\"panelIndex\":\"122\",\"title\":\"Applications (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_15\"},{\"gridData\":{\"x\":0,\"y\":8,\"w\":16,\"h\":11,\"i\":\"123\"},\"panelIndex\":\"123\",\"title\":\"Clients (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_16\"},{\"gridData\":{\"x\":24,\"y\":8,\"w\":16,\"h\":11,\"i\":\"124\"},\"panelIndex\":\"124\",\"title\":\"Servers (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_17\"},{\"gridData\":{\"x\":0,\"y\":49,\"w\":16,\"h\":11,\"i\":\"125\"},\"panelIndex\":\"125\",\"title\":\"Services (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_18\"},{\"gridData\":{\"x\":0,\"y\":0,\"w\":29,\"h\":3,\"i\":\"126\"},\"version\":\"6.6.0\",\"panelIndex\":\"126\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_19\"},{\"gridData\":{\"x\":29,\"y\":0,\"w\":14,\"h\":3,\"i\":\"127\"},\"version\":\"6.6.0\",\"panelIndex\":\"127\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_20\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "panel_0", + "type": "visualization", + "id": "1e6fb550-8017-11e7-9e6a-575834c68c0e" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "2e450d90-8017-11e7-9e6a-575834c68c0e" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "2f7d7110-8018-11e7-9e6a-575834c68c0e" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "9d557dd0-55d9-11e8-a695-171fb712da36" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "f7b9c440-55d2-11e8-a695-171fb712da36" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "b22f5660-55d2-11e8-a695-171fb712da36" + }, + { + "name": "panel_7", + "type": "visualization", + "id": "c1bbc780-560e-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_8", + "type": "visualization", + "id": "13b75a00-55cd-11e8-a695-171fb712da36" + }, + { + "name": "panel_9", + "type": "visualization", + "id": "fa458eb0-5613-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_10", + "type": "visualization", + "id": "de476b70-5613-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_11", + "type": "visualization", + "id": "98d03770-5613-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_12", + "type": "visualization", + "id": "8b7247d0-5613-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_13", + "type": "visualization", + "id": "8fee97e0-55b5-11e8-a1f3-452446793d46" + }, + { + "name": "panel_14", + "type": "visualization", + "id": "b577fca0-561d-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_15", + "type": "visualization", + "id": "d0e385d0-55ba-11e8-a1f3-452446793d46" + }, + { + "name": "panel_16", + "type": "visualization", + "id": "69f4d440-8019-11e7-af24-27fa1061e1bd" + }, + { + "name": "panel_17", + "type": "visualization", + "id": "aa56f4e0-801a-11e7-a69e-1db8cf608fe4" + }, + { + "name": "panel_18", + "type": "visualization", + "id": "be065300-801a-11e7-a69e-1db8cf608fe4" + }, + { + "name": "panel_19", + "type": "visualization", + "id": "4bdddfe0-336b-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_20", + "type": "visualization", + "id": "d2c71350-336b-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "653cf1e0-2fd2-11e7-99ed-49759aed30f5", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Overview", + "hits": 0, + "description": "", + "panelsJSON": "[{\"gridData\":{\"x\":16,\"y\":8,\"w\":16,\"h\":16,\"i\":\"34\"},\"panelIndex\":\"34\",\"title\":\"Services (bytes)\",\"version\":\"6.3.0\",\"panelRefName\":\"panel_0\"},{\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"35\"},\"panelIndex\":\"35\",\"title\":\"\",\"version\":\"6.3.0\",\"panelRefName\":\"panel_1\"},{\"gridData\":{\"x\":0,\"y\":3,\"w\":40,\"h\":5,\"i\":\"36\"},\"panelIndex\":\"36\",\"title\":\"\",\"version\":\"6.3.0\",\"panelRefName\":\"panel_2\"},{\"gridData\":{\"x\":0,\"y\":24,\"w\":16,\"h\":16,\"i\":\"37\"},\"panelIndex\":\"37\",\"title\":\"Autonomous Systems (bytes)\",\"version\":\"6.3.0\",\"panelRefName\":\"panel_3\"},{\"gridData\":{\"x\":16,\"y\":24,\"w\":16,\"h\":16,\"i\":\"39\"},\"panelIndex\":\"39\",\"title\":\"IP Versions and Protocols (bytes)\",\"version\":\"6.3.0\",\"panelRefName\":\"panel_4\"},{\"gridData\":{\"x\":0,\"y\":8,\"w\":16,\"h\":16,\"i\":\"40\"},\"panelIndex\":\"40\",\"title\":\"Servers and Clients (bytes)\",\"version\":\"6.3.0\",\"panelRefName\":\"panel_5\"},{\"gridData\":{\"x\":32,\"y\":8,\"w\":16,\"h\":10,\"i\":\"41\"},\"panelIndex\":\"41\",\"title\":\"\",\"version\":\"6.3.0\",\"panelRefName\":\"panel_6\"},{\"gridData\":{\"x\":32,\"y\":18,\"w\":16,\"h\":24,\"i\":\"42\"},\"panelIndex\":\"42\",\"title\":\"\",\"version\":\"6.3.0\",\"panelRefName\":\"panel_7\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":40,\"y\":3,\"w\":8,\"h\":5,\"i\":\"43\"},\"panelIndex\":\"43\",\"title\":\"\",\"version\":\"6.3.0\",\"panelRefName\":\"panel_8\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":0,\"w\":43,\"h\":3,\"i\":\"44\"},\"panelIndex\":\"44\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_9\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"*\"}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "panel_0", + "type": "visualization", + "id": "36e56dc0-801a-11e7-8b60-018ea0aa61a0" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "95799400-55b3-11e8-a1f3-452446793d46" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "98519990-55bb-11e8-a1f3-452446793d46" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "7b10dd00-55e3-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "cc28fff0-801f-11e7-8a72-651c4183643b" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "4b025da0-55e8-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_7", + "type": "visualization", + "id": "4c2019f0-55f9-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_8", + "type": "visualization", + "id": "8fee97e0-55b5-11e8-a1f3-452446793d46" + }, + { + "name": "panel_9", + "type": "visualization", + "id": "70567480-335d-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "8e383000-3309-11e9-aec0-c1d93190f676", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Threats", + "hits": 0, + "description": "", + "panelsJSON": "[{\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"18\"},\"panelIndex\":\"18\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":18,\"w\":8,\"h\":29,\"i\":\"26\"},\"panelIndex\":\"26\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":35,\"y\":18,\"w\":13,\"h\":29,\"i\":\"27\"},\"panelIndex\":\"27\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":8,\"y\":18,\"w\":14,\"h\":29,\"i\":\"28\"},\"panelIndex\":\"28\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":22,\"y\":18,\"w\":13,\"h\":29,\"i\":\"29\"},\"panelIndex\":\"29\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":10,\"y\":3,\"w\":38,\"h\":15,\"i\":\"30\"},\"panelIndex\":\"30\",\"title\":\"IP Reputations (flows)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_5\"},{\"gridData\":{\"x\":0,\"y\":3,\"w\":10,\"h\":15,\"i\":\"31\"},\"version\":\"6.6.0\",\"panelIndex\":\"31\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_6\"},{\"gridData\":{\"x\":0,\"y\":0,\"w\":43,\"h\":3,\"i\":\"32\"},\"version\":\"6.6.0\",\"panelIndex\":\"32\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_7\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "panel_0", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "1fdbf870-330a-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "de602310-330b-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "ee65abb0-330e-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "31db9c00-3310-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "5ece5010-3345-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "7546a110-55fd-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_7", + "type": "visualization", + "id": "279aff10-336a-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "153634a0-33b2-11e9-aec0-c1d93190f676", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Ziften ZFlow", + "hits": 0, + "description": "", + "panelsJSON": "[{\"gridData\":{\"x\":42,\"y\":0,\"w\":6,\"h\":4,\"i\":\"35\"},\"panelIndex\":\"35\",\"title\":\"\",\"version\":\"6.3.0\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":17,\"w\":12,\"h\":12,\"i\":\"38\"},\"panelIndex\":\"38\",\"title\":\"Commands (bytes) \",\"version\":\"6.6.0\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":5,\"w\":12,\"h\":12,\"i\":\"39\"},\"panelIndex\":\"39\",\"title\":\"Users (bytes)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":29,\"w\":12,\"h\":12,\"i\":\"40\"},\"panelIndex\":\"40\",\"title\":\"Platforms (bytes)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":12,\"y\":17,\"w\":36,\"h\":12,\"i\":\"41\"},\"panelIndex\":\"41\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":12,\"y\":5,\"w\":36,\"h\":12,\"i\":\"42\"},\"panelIndex\":\"42\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":0,\"w\":42,\"h\":5,\"i\":\"43\"},\"panelIndex\":\"43\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_6\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":12,\"y\":29,\"w\":36,\"h\":12,\"i\":\"44\"},\"panelIndex\":\"44\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_7\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "panel_0", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "aefd37a0-33ad-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "19873c10-33ae-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "601e5470-33ad-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "d827d2e0-33b0-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "f3c9cc60-33b0-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "4ba1be70-33b1-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_7", + "type": "visualization", + "id": "11a64c90-33b1-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "AWFgw02HugC1WJLdzCFZ", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Top Conversations", + "hits": 0, + "description": "", + "panelsJSON": "[{\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":3,\"direction\":\"desc\"}}}},\"gridData\":{\"x\":0,\"y\":18,\"w\":48,\"h\":30,\"i\":\"16\"},\"panelIndex\":\"16\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_0\"},{\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"21\"},\"panelIndex\":\"21\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_1\"},{\"gridData\":{\"x\":10,\"y\":3,\"w\":38,\"h\":15,\"i\":\"22\"},\"panelIndex\":\"22\",\"title\":\"Services (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_2\"},{\"gridData\":{\"x\":0,\"y\":3,\"w\":10,\"h\":15,\"i\":\"23\"},\"panelIndex\":\"23\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":0,\"w\":29,\"h\":3,\"i\":\"24\"},\"panelIndex\":\"24\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":29,\"y\":0,\"w\":14,\"h\":3,\"i\":\"25\"},\"panelIndex\":\"25\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_5\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "panel_0", + "type": "visualization", + "id": "6d0c50a0-801d-11e7-bcae-4bd056c878e8" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "b22f5660-55d2-11e8-a695-171fb712da36" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "7546a110-55fd-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "30ff5d70-336b-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "47ee87d0-336c-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "0d0216f0-2fe0-11e7-9d02-3f49bde5c1d5", + "_type": "search", + "_source": { + "title": "ElastiFlow: Flow Records (src/dst) - search", + "description": "", + "hits": 0, + "columns": [ + "node.hostname", + "flow.src_hostname", + "flow.src_port_name", + "flow.dst_hostname", + "flow.dst_port_name", + "flow.bytes", + "flow.packets" + ], + "sort": [ + "@timestamp", + "desc" + ], + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"highlightAll\":true,\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"version\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "search": "7.0.0" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "18a8f720-55dd-11e8-b711-83a5f93b17f3", + "_type": "search", + "_source": { + "title": "ElastiFlow: Flow Records (client/server) - search", + "description": "", + "hits": 0, + "columns": [ + "node.hostname", + "flow.client_hostname", + "flow.server_hostname", + "flow.service_name", + "flow.bytes", + "flow.packets" + ], + "sort": [ + "@timestamp", + "desc" + ], + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"highlightAll\":true,\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"version\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "search": "7.0.0" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "c824e870-5629-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sankey Client/Server (flow records) - vega", + "visState": "{\"title\":\"ElastiFlow: Sankey Client/Server (flow records) - vega\",\"type\":\"vega\",\"params\":{\"spec\":\"{\\n \\\"$schema\\\": \\\"https://vega.github.io/schema/vega/v3.0.json\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"rawData\\\",\\n \\\"url\\\": {\\n \\\"%context%\\\": true,\\n \\\"%timefield%\\\": \\\"@timestamp\\\",\\n \\\"index\\\": \\\"elastiflow-*\\\",\\n \\\"body\\\": {\\n \\\"size\\\": 0,\\n \\\"aggs\\\": {\\n \\\"table\\\": {\\n \\\"composite\\\": {\\n \\\"size\\\": 1000,\\n \\\"sources\\\": [\\n {\\\"stk1\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.client_hostname\\\"}}},\\n {\\\"stk2\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.server_hostname\\\"}}}\\n ]\\n }\\n }\\n }\\n }\\n },\\n \\\"format\\\": {\\\"property\\\": \\\"aggregations.table.buckets\\\"},\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk1\\\", \\\"as\\\": \\\"stk1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk2\\\", \\\"as\\\": \\\"stk2\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.doc_count\\\", \\\"as\\\": \\\"size\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"nodes\\\",\\n \\\"source\\\": \\\"rawData\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"filter\\\",\\n \\\"expr\\\": \\\"!groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stk1+datum.stk2\\\", \\\"as\\\": \\\"key\\\"},\\n {\\\"type\\\": \\\"fold\\\", \\\"fields\\\": [\\\"stk1\\\", \\\"stk2\\\"], \\\"as\\\": [\\\"stack\\\", \\\"grpId\\\"]},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.stack == 'stk1' ? datum.stk1+datum.stk2 : datum.stk2+datum.stk1\\\",\\n \\\"as\\\": \\\"sortField\\\"\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"sortField\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"size\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"(datum.y0+datum.y1)/2\\\", \\\"as\\\": \\\"yc\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groups\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"aggregate\\\",\\n \\\"groupby\\\": [\\\"stack\\\", \\\"grpId\\\"],\\n \\\"fields\\\": [\\\"size\\\"],\\n \\\"ops\\\": [\\\"sum\\\"],\\n \\\"as\\\": [\\\"total\\\"]\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"grpId\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"total\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y0)\\\", \\\"as\\\": \\\"scaledY0\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y1)\\\", \\\"as\\\": \\\"scaledY1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\", \\\"as\\\": \\\"rightLabel\\\"},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.total/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n },\\n {\\n \\\"name\\\": \\\"destinationNodes\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk2'\\\"}]\\n },\\n {\\n \\\"name\\\": \\\"edges\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\"},\\n {\\n \\\"type\\\": \\\"lookup\\\",\\n \\\"from\\\": \\\"destinationNodes\\\",\\n \\\"key\\\": \\\"key\\\",\\n \\\"fields\\\": [\\\"key\\\"],\\n \\\"as\\\": [\\\"target\\\"]\\n },\\n {\\n \\\"type\\\": \\\"linkpath\\\",\\n \\\"orient\\\": \\\"horizontal\\\",\\n \\\"shape\\\": \\\"diagonal\\\",\\n \\\"sourceY\\\": {\\\"expr\\\": \\\"scale('y', datum.yc)\\\"},\\n \\\"sourceX\\\": {\\\"expr\\\": \\\"scale('x', 'stk1') + bandwidth('x')\\\"},\\n \\\"targetY\\\": {\\\"expr\\\": \\\"scale('y', datum.target.yc)\\\"},\\n \\\"targetX\\\": {\\\"expr\\\": \\\"scale('x', 'stk2')\\\"}\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"range('y')[0]-scale('y', datum.size)\\\",\\n \\\"as\\\": \\\"strokeWidth\\\"\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.size/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n }\\n ],\\n \\\"scales\\\": [\\n {\\n \\\"name\\\": \\\"x\\\",\\n \\\"type\\\": \\\"band\\\",\\n \\\"range\\\": \\\"width\\\",\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"],\\n \\\"paddingOuter\\\": 0.01,\\n \\\"paddingInner\\\": 0.98\\n },\\n {\\n \\\"name\\\": \\\"y\\\",\\n \\\"type\\\": \\\"linear\\\",\\n \\\"range\\\": \\\"height\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"nodes\\\", \\\"field\\\": \\\"y1\\\"}\\n },\\n {\\n \\\"name\\\": \\\"color\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": \\\"category\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"rawData\\\", \\\"fields\\\": [\\\"stk1\\\",\\\"stk2\\\"]}\\n },\\n {\\n \\\"name\\\": \\\"stackNames\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": [\\\"Client\\\", \\\"Server\\\"],\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"]\\n }\\n ],\\n \\\"axes\\\": [\\n {\\n \\\"orient\\\": \\\"bottom\\\",\\n \\\"scale\\\": \\\"x\\\",\\n \\\"encode\\\": {\\n \\\"labels\\\": {\\n \\\"update\\\": {\\n \\\"text\\\": {\\\"scale\\\": \\\"stackNames\\\", \\\"field\\\": \\\"value\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14}\\n }\\n }\\n }\\n },\\n {\\n \\\"orient\\\": \\\"left\\\",\\n \\\"scale\\\": \\\"y\\\",\\n \\\"encode\\\": {\\\"labels\\\": {\\\"update\\\": {\\\"fontSize\\\": {\\\"value\\\": 12}}}}\\n }\\n ],\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"path\\\",\\n \\\"name\\\": \\\"edgeMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"edges\\\"},\\n \\\"clip\\\": true,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"stroke\\\": [\\n {\\n \\\"test\\\": \\\"groupSelector && groupSelector.stack=='stk1'\\\",\\n \\\"scale\\\": \\\"color\\\",\\n \\\"field\\\": \\\"stk2\\\"\\n },\\n {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"stk1\\\"}\\n ],\\n \\\"strokeWidth\\\": {\\\"field\\\": \\\"strokeWidth\\\"},\\n \\\"path\\\": {\\\"field\\\": \\\"path\\\"},\\n \\\"strokeOpacity\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.75 : 0.3\\\"\\n },\\n \\\"zindex\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\\\"\\n },\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"strokeOpacity\\\": {\\\"value\\\": 0.75}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"rect\\\",\\n \\\"name\\\": \\\"groupMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"fill\\\": {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"grpId\\\"},\\n \\\"width\\\": {\\\"scale\\\": \\\"x\\\", \\\"band\\\": 1}\\n },\\n \\\"update\\\": {\\n \\\"x\\\": {\\\"scale\\\": \\\"x\\\", \\\"field\\\": \\\"stack\\\"},\\n \\\"y\\\": {\\\"field\\\": \\\"scaledY0\\\"},\\n \\\"y2\\\": {\\\"field\\\": \\\"scaledY1\\\"},\\n \\\"fillOpacity\\\": {\\\"value\\\": 0.7},\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"fillOpacity\\\": {\\\"value\\\": 1}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"x\\\": {\\n \\\"signal\\\": \\\"scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\\\"\\n },\\n \\\"yc\\\": {\\\"signal\\\": \\\"(datum.scaledY0 + datum.scaledY1)/2\\\"},\\n \\\"align\\\": {\\\"signal\\\": \\\"datum.rightLabel ? 'left' : 'right'\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"fontWeight\\\": {\\\"value\\\": \\\"bold\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 12},\\n \\\"text\\\": {\\n \\\"signal\\\": \\\"abs(datum.scaledY0-datum.scaledY1) > 10 ? datum.grpId : ''\\\"\\n }\\n }\\n }\\n },\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"dataForShowAll\\\",\\n \\\"values\\\": [{}],\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"groupSelector\\\"}]\\n }\\n ],\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"signal\\\": \\\"width/2\\\"},\\n \\\"y\\\": {\\\"value\\\": 30},\\n \\\"width\\\": {\\\"value\\\": 100},\\n \\\"height\\\": {\\\"value\\\": 36}\\n }\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"name\\\": \\\"groupReset\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"dataForShowAll\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"cornerRadius\\\": {\\\"value\\\": 3.5},\\n \\\"fill\\\": {\\\"value\\\": \\\"#666666\\\"},\\n \\\"height\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}},\\n \\\"width\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}}\\n },\\n \\\"update\\\": {\\\"opacity\\\": {\\\"value\\\": 1}},\\n \\\"hover\\\": {\\\"fill\\\": {\\\"value\\\": \\\"#444444\\\"}}\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}, \\\"mult\\\": 0.5},\\n \\\"yc\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}, \\\"mult\\\": 0.5, \\\"offset\\\": 1},\\n \\\"align\\\": {\\\"value\\\": \\\"center\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"text\\\": {\\\"value\\\": \\\"Show All\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14},\\n \\\"stroke\\\": {\\\"value\\\": \\\"#ecf0f1\\\"}\\n }\\n }\\n }\\n ]\\n }\\n ]\\n }\\n ],\\n \\\"signals\\\": [\\n {\\n \\\"name\\\": \\\"groupHover\\\",\\n \\\"value\\\": {},\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:mouseover\\\",\\n \\\"update\\\": \\\"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\\"events\\\": \\\"mouseout\\\", \\\"update\\\": \\\"{}\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groupSelector\\\",\\n \\\"value\\\": false,\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:click!\\\",\\n \\\"update\\\": \\\"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\n \\\"events\\\": [\\n {\\\"type\\\": \\\"click\\\", \\\"markname\\\": \\\"groupReset\\\"},\\n {\\\"type\\\": \\\"dblclick\\\"}\\n ],\\n \\\"update\\\": \\\"false\\\"\\n }\\n ]\\n }\\n ]\\n}\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "ca480720-2fdf-11e7-9d02-3f49bde5c1d5", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Flow Records (client/server)", + "hits": 0, + "description": "", + "panelsJSON": "[{\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"6\"},\"panelIndex\":\"6\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_0\"},{\"gridData\":{\"x\":19,\"y\":3,\"w\":29,\"h\":10,\"i\":\"8\"},\"panelIndex\":\"8\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_1\"},{\"gridData\":{\"x\":10,\"y\":3,\"w\":9,\"h\":10,\"i\":\"9\"},\"panelIndex\":\"9\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_2\"},{\"gridData\":{\"x\":0,\"y\":3,\"w\":10,\"h\":10,\"i\":\"10\"},\"panelIndex\":\"10\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_3\"},{\"gridData\":{\"x\":0,\"y\":13,\"w\":48,\"h\":30,\"i\":\"12\"},\"panelIndex\":\"12\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_4\"},{\"gridData\":{\"x\":0,\"y\":0,\"w\":29,\"h\":3,\"i\":\"13\"},\"version\":\"6.6.0\",\"panelIndex\":\"13\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_5\"},{\"gridData\":{\"x\":29,\"y\":0,\"w\":14,\"h\":3,\"i\":\"14\"},\"version\":\"6.6.0\",\"panelIndex\":\"14\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_6\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "panel_0", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "644c9760-55db-11e8-a695-171fb712da36" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "1d773d80-55dc-11e8-a695-171fb712da36" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "53f4a4d0-55df-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_4", + "type": "search", + "id": "18a8f720-55dd-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "dc7a8e00-336a-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "f06e8450-336c-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "ebd23770-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Cities (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Cities (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"f5d79820-5611-11e8-937b-f9dd7f7e8b36\",\"type\":\"calculation\",\"variables\":[{\"id\":\"f9111840-5611-11e8-937b-f9dd7f7e8b36\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.city\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "65162e80-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Traffic Locality (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Traffic Locality (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"2fbfdab0-5613-11e8-9246-a5562341aeaa\",\"type\":\"calculation\",\"variables\":[{\"id\":\"31d17ca0-5613-11e8-9246-a5562341aeaa\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.traffic_locality\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "d45c0d50-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Autonomous Systems (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Destination Autonomous Systems (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"5b93e7e0-5612-11e8-b71a-cfa3c16427ce\",\"type\":\"calculation\",\"variables\":[{\"id\":\"5f2c77f0-5612-11e8-b71a-cfa3c16427ce\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.dst_autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.dst_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "2e0f7f50-55d6-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Egress Interfaces (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Egress Interfaces (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.output_snmp\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "d6729740-55d1-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Traffic Locality (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Traffic Locality (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.traffic_locality\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "ead75f80-55cd-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Autonomous Systems (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Autonomous Systems (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "854eee30-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Autonomous Systems (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Source Autonomous Systems (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"eb6ed730-5612-11e8-88fd-2774a33bc32f\",\"type\":\"calculation\",\"variables\":[{\"id\":\"f0d103b0-5612-11e8-88fd-2774a33bc32f\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.src_autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.src_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "114eba40-55d4-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Protocols (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: IP Protocols (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.ip_protocol\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "f7b9c440-55d2-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Servers (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Servers (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.server_hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "1d773d80-55dc-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Record Count - TSVB (metric)", + "visState": "{\"title\":\"ElastiFlow: Flow Record Count - TSVB (metric)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"},{\"id\":\"bdd65820-55db-11e8-a230-6b3654bd4d61\",\"type\":\"cumulative_sum\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"bar\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"gradient\",\"label\":\"Flow Records\",\"terms_field\":\"event.type\",\"terms_size\":\"25\",\"filter\":\"\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"background_color_rules\":[{\"id\":\"c5d26960-55db-11e8-a230-6b3654bd4d61\"}]},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "822d3da0-55d8-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Ports (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Source Ports (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.src_port_name\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "532f1340-55d1-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Types of Service (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Types of Service (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.tos\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "AWFhE8NZugC1WJLdzYri", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Geo Location (src/dst)", + "hits": 0, + "description": "", + "panelsJSON": "[{\"panelIndex\":\"27\",\"gridData\":{\"x\":24,\"y\":3,\"w\":12,\"h\":11,\"i\":\"27\"},\"title\":\"Destinations and Sources (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_0\"},{\"panelIndex\":\"28\",\"gridData\":{\"x\":36,\"y\":3,\"w\":12,\"h\":11,\"i\":\"28\"},\"title\":\"Destination Ports (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_1\"},{\"panelIndex\":\"30\",\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"30\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_2\"},{\"panelIndex\":\"33\",\"gridData\":{\"x\":12,\"y\":3,\"w\":12,\"h\":11,\"i\":\"33\"},\"title\":\"Cities (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_3\"},{\"panelIndex\":\"34\",\"gridData\":{\"x\":0,\"y\":3,\"w\":12,\"h\":11,\"i\":\"34\"},\"title\":\"Countries (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_4\"},{\"title\":\"Destination Locations (flow records)\",\"panelIndex\":\"35\",\"gridData\":{\"x\":24,\"y\":14,\"w\":24,\"h\":29,\"i\":\"35\"},\"version\":\"6.6.0\",\"embeddableConfig\":{\"mapZoom\":2,\"mapCenter\":[29.6880527498568,22.148437500000004]},\"panelRefName\":\"panel_5\"},{\"title\":\"Source Locations (flow records)\",\"panelIndex\":\"36\",\"gridData\":{\"x\":0,\"y\":14,\"w\":24,\"h\":29,\"i\":\"36\"},\"version\":\"6.6.0\",\"embeddableConfig\":{\"mapZoom\":2,\"mapCenter\":[30.600093873550072,22.148437500000004]},\"panelRefName\":\"panel_6\"},{\"gridData\":{\"x\":0,\"y\":0,\"w\":29,\"h\":3,\"i\":\"37\"},\"version\":\"6.6.0\",\"panelIndex\":\"37\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_7\"},{\"gridData\":{\"x\":29,\"y\":0,\"w\":14,\"h\":3,\"i\":\"38\"},\"version\":\"6.6.0\",\"panelIndex\":\"38\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_8\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[{\"meta\":{\"negate\":false,\"disabled\":false,\"alias\":\"Public\",\"type\":\"phrase\",\"key\":\"flow.traffic_locality\",\"value\":\"public\",\"params\":{\"query\":\"public\",\"type\":\"phrase\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"flow.traffic_locality\":{\"query\":\"public\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"highlightAll\":true,\"version\":true,\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"default_field\":\"*\"}},\"language\":\"lucene\"}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "panel_0", + "type": "visualization", + "id": "793a6f00-2fdd-11e7-afd7-595689f3f18c" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "6f6d05b0-2fc8-11e7-bf24-57efade8fd83" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "849562d0-55be-11e8-a1f3-452446793d46" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "64d75bf0-55bf-11e8-a1f3-452446793d46" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "33c10ae0-5603-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "46a5ed10-5603-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_7", + "type": "visualization", + "id": "f16133a0-336a-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_8", + "type": "visualization", + "id": "af914ad0-336c-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "d7e31d40-6589-11e7-bfc3-d74b7bb89482", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: AS Traffic", + "hits": 0, + "description": "", + "panelsJSON": "[{\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"21\"},\"panelIndex\":\"21\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_0\"},{\"gridData\":{\"x\":24,\"y\":8,\"w\":24,\"h\":15,\"i\":\"34\"},\"panelIndex\":\"34\",\"title\":\"Destination Autonomous Systems (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_1\"},{\"gridData\":{\"x\":0,\"y\":8,\"w\":24,\"h\":15,\"i\":\"36\"},\"panelIndex\":\"36\",\"title\":\"Source Autonomous Systems (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_2\"},{\"gridData\":{\"x\":40,\"y\":3,\"w\":8,\"h\":5,\"i\":\"38\"},\"panelIndex\":\"38\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_3\"},{\"gridData\":{\"x\":0,\"y\":3,\"w\":40,\"h\":5,\"i\":\"39\"},\"panelIndex\":\"39\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_4\"},{\"gridData\":{\"x\":24,\"y\":23,\"w\":24,\"h\":15,\"i\":\"40\"},\"panelIndex\":\"40\",\"title\":\"Destination Autonomous Systems (pkts/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_5\"},{\"gridData\":{\"x\":0,\"y\":23,\"w\":24,\"h\":15,\"i\":\"41\"},\"panelIndex\":\"41\",\"title\":\"Source Autonomous Systems (pkts/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_6\"},{\"gridData\":{\"x\":0,\"y\":0,\"w\":43,\"h\":3,\"i\":\"42\"},\"version\":\"6.6.0\",\"panelIndex\":\"42\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_7\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "panel_0", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "9271c180-55cf-11e8-a695-171fb712da36" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "290d5be0-55d0-11e8-a695-171fb712da36" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "8fee97e0-55b5-11e8-a1f3-452446793d46" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "e3c2e2c0-5607-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "d45c0d50-5613-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "854eee30-5613-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_7", + "type": "visualization", + "id": "a44cb030-336a-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "04157d70-6591-11e7-bfc3-d74b7bb89482", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Flow Exporters", + "hits": 0, + "description": "", + "panelsJSON": "[{\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"13\"},\"panelIndex\":\"13\",\"title\":\"\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_0\"},{\"gridData\":{\"x\":40,\"y\":3,\"w\":8,\"h\":5,\"i\":\"14\"},\"panelIndex\":\"14\",\"title\":\"\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_1\"},{\"gridData\":{\"x\":0,\"y\":3,\"w\":40,\"h\":5,\"i\":\"15\"},\"panelIndex\":\"15\",\"title\":\"\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_2\"},{\"gridData\":{\"x\":24,\"y\":8,\"w\":24,\"h\":15,\"i\":\"16\"},\"panelIndex\":\"16\",\"title\":\"Egress Interfaces (bits/s)\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_3\"},{\"gridData\":{\"x\":0,\"y\":8,\"w\":24,\"h\":15,\"i\":\"18\"},\"panelIndex\":\"18\",\"title\":\"Ingress Interfaces (bits/s)\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_4\"},{\"gridData\":{\"x\":0,\"y\":23,\"w\":24,\"h\":15,\"i\":\"19\"},\"panelIndex\":\"19\",\"title\":\"Ingress Interfaces (pkts/s)\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_5\"},{\"gridData\":{\"x\":24,\"y\":23,\"w\":24,\"h\":15,\"i\":\"20\"},\"panelIndex\":\"20\",\"title\":\"Egress Interfaces (pkts/s)\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_6\"},{\"gridData\":{\"x\":0,\"y\":0,\"w\":43,\"h\":3,\"i\":\"21\"},\"version\":\"6.6.0\",\"panelIndex\":\"21\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_7\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "panel_0", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "8fee97e0-55b5-11e8-a1f3-452446793d46" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "a65eb880-5609-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "1f0f0340-55d6-11e8-a695-171fb712da36" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "86262810-55d6-11e8-a695-171fb712da36" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "b79dce60-5613-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "c481fa20-5613-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_7", + "type": "visualization", + "id": "c2506770-336a-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "d8e1bc80-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Countries (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Countries (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"47b1b9f0-5612-11e8-8f25-dd843d63ccd9\",\"type\":\"calculation\",\"variables\":[{\"id\":\"4ba84880-5612-11e8-8f25-dd843d63ccd9\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.country\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "fa458eb0-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Applications (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Applications (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"b907a980-5611-11e8-9d88-a7d70f388fc4\",\"type\":\"calculation\",\"variables\":[{\"id\":\"bbfd42d0-5611-11e8-9d88-a7d70f388fc4\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.application\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "9271c180-55cf-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Autonomous Systems (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Destination Autonomous Systems (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.dst_autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.dst_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "b48fcce0-55d8-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Exporters (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Flow Exporters (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"node.hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "8b09a0f0-55d1-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: TCP Flags (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: TCP Flags (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.tcp_flags\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "9b6dfa20-55ce-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Client Autonomous Systems (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Client Autonomous Systems (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.client_autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.client_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "1d3b5c10-55d3-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Servers (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Servers (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.server_hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "58858cb0-55e1-11e8-b711-83a5f93b17f3", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Flow Records (src/dst)", + "hits": 0, + "description": "", + "panelsJSON": "[{\"panelIndex\":\"5\",\"gridData\":{\"x\":0,\"y\":13,\"w\":48,\"h\":30,\"i\":\"5\"},\"title\":\"\",\"version\":\"6.6.0\",\"embeddableConfig\":{\"columns\":[\"node.hostname\",\"flow.src_hostname\",\"flow.src_port_name\",\"flow.dst_hostname\",\"flow.dst_port_name\",\"flow.bytes\",\"flow.packets\"],\"sort\":[\"@timestamp\",\"desc\"]},\"panelRefName\":\"panel_0\"},{\"panelIndex\":\"6\",\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"6\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_1\"},{\"panelIndex\":\"8\",\"gridData\":{\"x\":19,\"y\":3,\"w\":29,\"h\":10,\"i\":\"8\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_2\"},{\"panelIndex\":\"9\",\"gridData\":{\"x\":11,\"y\":3,\"w\":8,\"h\":10,\"i\":\"9\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_3\"},{\"panelIndex\":\"10\",\"gridData\":{\"x\":0,\"y\":3,\"w\":10,\"h\":10,\"i\":\"10\"},\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_4\"},{\"gridData\":{\"x\":0,\"y\":0,\"w\":29,\"h\":3,\"i\":\"12\"},\"version\":\"6.6.0\",\"panelIndex\":\"12\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_5\"},{\"gridData\":{\"x\":29,\"y\":0,\"w\":14,\"h\":3,\"i\":\"13\"},\"version\":\"6.6.0\",\"panelIndex\":\"13\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_6\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "panel_0", + "type": "search", + "id": "0d0216f0-2fe0-11e7-9d02-3f49bde5c1d5" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "644c9760-55db-11e8-a695-171fb712da36" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "1d773d80-55dc-11e8-a695-171fb712da36" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "53f4a4d0-55df-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "dc7a8e00-336a-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "e0216400-336c-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "f2b5acc0-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Autonomous Systems (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Autonomous Systems (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"e64ae1a0-5611-11e8-ace5-73cdd5366849\",\"type\":\"calculation\",\"variables\":[{\"id\":\"e9f01be0-5611-11e8-ace5-73cdd5366849\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "de476b70-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Clients (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Clients (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"35bed8e0-5612-11e8-9abc-51bfe6c5250a\",\"type\":\"calculation\",\"variables\":[{\"id\":\"38885920-5612-11e8-9abc-51bfe6c5250a\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.client_hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "00a54450-5630-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sankey Src AS/Dst AS (flow records) - vega", + "visState": "{\"title\":\"ElastiFlow: Sankey Src AS/Dst AS (flow records) - vega\",\"type\":\"vega\",\"params\":{\"spec\":\"{\\n \\\"$schema\\\": \\\"https://vega.github.io/schema/vega/v3.0.json\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"rawData\\\",\\n \\\"url\\\": {\\n \\\"%context%\\\": true,\\n \\\"%timefield%\\\": \\\"@timestamp\\\",\\n \\\"index\\\": \\\"elastiflow-*\\\",\\n \\\"body\\\": {\\n \\\"size\\\": 0,\\n \\\"aggs\\\": {\\n \\\"table\\\": {\\n \\\"composite\\\": {\\n \\\"size\\\": 1000,\\n \\\"sources\\\": [\\n {\\\"stk1\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.src_autonomous_system\\\"}}},\\n {\\\"stk2\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.dst_autonomous_system\\\"}}}\\n ]\\n }\\n }\\n }\\n }\\n },\\n \\\"format\\\": {\\\"property\\\": \\\"aggregations.table.buckets\\\"},\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk1\\\", \\\"as\\\": \\\"stk1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk2\\\", \\\"as\\\": \\\"stk2\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.doc_count\\\", \\\"as\\\": \\\"size\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"nodes\\\",\\n \\\"source\\\": \\\"rawData\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"filter\\\",\\n \\\"expr\\\": \\\"!groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stk1+datum.stk2\\\", \\\"as\\\": \\\"key\\\"},\\n {\\\"type\\\": \\\"fold\\\", \\\"fields\\\": [\\\"stk1\\\", \\\"stk2\\\"], \\\"as\\\": [\\\"stack\\\", \\\"grpId\\\"]},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.stack == 'stk1' ? datum.stk1+datum.stk2 : datum.stk2+datum.stk1\\\",\\n \\\"as\\\": \\\"sortField\\\"\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"sortField\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"size\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"(datum.y0+datum.y1)/2\\\", \\\"as\\\": \\\"yc\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groups\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"aggregate\\\",\\n \\\"groupby\\\": [\\\"stack\\\", \\\"grpId\\\"],\\n \\\"fields\\\": [\\\"size\\\"],\\n \\\"ops\\\": [\\\"sum\\\"],\\n \\\"as\\\": [\\\"total\\\"]\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"grpId\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"total\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y0)\\\", \\\"as\\\": \\\"scaledY0\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y1)\\\", \\\"as\\\": \\\"scaledY1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\", \\\"as\\\": \\\"rightLabel\\\"},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.total/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n },\\n {\\n \\\"name\\\": \\\"destinationNodes\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk2'\\\"}]\\n },\\n {\\n \\\"name\\\": \\\"edges\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\"},\\n {\\n \\\"type\\\": \\\"lookup\\\",\\n \\\"from\\\": \\\"destinationNodes\\\",\\n \\\"key\\\": \\\"key\\\",\\n \\\"fields\\\": [\\\"key\\\"],\\n \\\"as\\\": [\\\"target\\\"]\\n },\\n {\\n \\\"type\\\": \\\"linkpath\\\",\\n \\\"orient\\\": \\\"horizontal\\\",\\n \\\"shape\\\": \\\"diagonal\\\",\\n \\\"sourceY\\\": {\\\"expr\\\": \\\"scale('y', datum.yc)\\\"},\\n \\\"sourceX\\\": {\\\"expr\\\": \\\"scale('x', 'stk1') + bandwidth('x')\\\"},\\n \\\"targetY\\\": {\\\"expr\\\": \\\"scale('y', datum.target.yc)\\\"},\\n \\\"targetX\\\": {\\\"expr\\\": \\\"scale('x', 'stk2')\\\"}\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"range('y')[0]-scale('y', datum.size)\\\",\\n \\\"as\\\": \\\"strokeWidth\\\"\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.size/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n }\\n ],\\n \\\"scales\\\": [\\n {\\n \\\"name\\\": \\\"x\\\",\\n \\\"type\\\": \\\"band\\\",\\n \\\"range\\\": \\\"width\\\",\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"],\\n \\\"paddingOuter\\\": 0.01,\\n \\\"paddingInner\\\": 0.98\\n },\\n {\\n \\\"name\\\": \\\"y\\\",\\n \\\"type\\\": \\\"linear\\\",\\n \\\"range\\\": \\\"height\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"nodes\\\", \\\"field\\\": \\\"y1\\\"}\\n },\\n {\\n \\\"name\\\": \\\"color\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": \\\"category\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"rawData\\\", \\\"fields\\\": [\\\"stk1\\\",\\\"stk2\\\"]}\\n },\\n {\\n \\\"name\\\": \\\"stackNames\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": [\\\"Source AS\\\", \\\"Dest AS\\\"],\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"]\\n }\\n ],\\n \\\"axes\\\": [\\n {\\n \\\"orient\\\": \\\"bottom\\\",\\n \\\"scale\\\": \\\"x\\\",\\n \\\"encode\\\": {\\n \\\"labels\\\": {\\n \\\"update\\\": {\\n \\\"text\\\": {\\\"scale\\\": \\\"stackNames\\\", \\\"field\\\": \\\"value\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14}\\n }\\n }\\n }\\n },\\n {\\n \\\"orient\\\": \\\"left\\\",\\n \\\"scale\\\": \\\"y\\\",\\n \\\"encode\\\": {\\\"labels\\\": {\\\"update\\\": {\\\"fontSize\\\": {\\\"value\\\": 12}}}}\\n }\\n ],\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"path\\\",\\n \\\"name\\\": \\\"edgeMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"edges\\\"},\\n \\\"clip\\\": true,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"stroke\\\": [\\n {\\n \\\"test\\\": \\\"groupSelector && groupSelector.stack=='stk1'\\\",\\n \\\"scale\\\": \\\"color\\\",\\n \\\"field\\\": \\\"stk2\\\"\\n },\\n {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"stk1\\\"}\\n ],\\n \\\"strokeWidth\\\": {\\\"field\\\": \\\"strokeWidth\\\"},\\n \\\"path\\\": {\\\"field\\\": \\\"path\\\"},\\n \\\"strokeOpacity\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.75 : 0.3\\\"\\n },\\n \\\"zindex\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\\\"\\n },\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"strokeOpacity\\\": {\\\"value\\\": 0.75}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"rect\\\",\\n \\\"name\\\": \\\"groupMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"fill\\\": {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"grpId\\\"},\\n \\\"width\\\": {\\\"scale\\\": \\\"x\\\", \\\"band\\\": 1}\\n },\\n \\\"update\\\": {\\n \\\"x\\\": {\\\"scale\\\": \\\"x\\\", \\\"field\\\": \\\"stack\\\"},\\n \\\"y\\\": {\\\"field\\\": \\\"scaledY0\\\"},\\n \\\"y2\\\": {\\\"field\\\": \\\"scaledY1\\\"},\\n \\\"fillOpacity\\\": {\\\"value\\\": 0.7},\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"fillOpacity\\\": {\\\"value\\\": 1}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"x\\\": {\\n \\\"signal\\\": \\\"scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\\\"\\n },\\n \\\"yc\\\": {\\\"signal\\\": \\\"(datum.scaledY0 + datum.scaledY1)/2\\\"},\\n \\\"align\\\": {\\\"signal\\\": \\\"datum.rightLabel ? 'left' : 'right'\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"fontWeight\\\": {\\\"value\\\": \\\"bold\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 12},\\n \\\"text\\\": {\\n \\\"signal\\\": \\\"abs(datum.scaledY0-datum.scaledY1) > 10 ? datum.grpId : ''\\\"\\n }\\n }\\n }\\n },\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"dataForShowAll\\\",\\n \\\"values\\\": [{}],\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"groupSelector\\\"}]\\n }\\n ],\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"signal\\\": \\\"width/2\\\"},\\n \\\"y\\\": {\\\"value\\\": 30},\\n \\\"width\\\": {\\\"value\\\": 100},\\n \\\"height\\\": {\\\"value\\\": 36}\\n }\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"name\\\": \\\"groupReset\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"dataForShowAll\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"cornerRadius\\\": {\\\"value\\\": 3.5},\\n \\\"fill\\\": {\\\"value\\\": \\\"#666666\\\"},\\n \\\"height\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}},\\n \\\"width\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}}\\n },\\n \\\"update\\\": {\\\"opacity\\\": {\\\"value\\\": 1}},\\n \\\"hover\\\": {\\\"fill\\\": {\\\"value\\\": \\\"#444444\\\"}}\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}, \\\"mult\\\": 0.5},\\n \\\"yc\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}, \\\"mult\\\": 0.5, \\\"offset\\\": 1},\\n \\\"align\\\": {\\\"value\\\": \\\"center\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"text\\\": {\\\"value\\\": \\\"Show All\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14},\\n \\\"stroke\\\": {\\\"value\\\": \\\"#ecf0f1\\\"}\\n }\\n }\\n }\\n ]\\n }\\n ]\\n }\\n ],\\n \\\"signals\\\": [\\n {\\n \\\"name\\\": \\\"groupHover\\\",\\n \\\"value\\\": {},\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:mouseover\\\",\\n \\\"update\\\": \\\"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\\"events\\\": \\\"mouseout\\\", \\\"update\\\": \\\"{}\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groupSelector\\\",\\n \\\"value\\\": false,\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:click!\\\",\\n \\\"update\\\": \\\"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\n \\\"events\\\": [\\n {\\\"type\\\": \\\"click\\\", \\\"markname\\\": \\\"groupReset\\\"},\\n {\\\"type\\\": \\\"dblclick\\\"}\\n ],\\n \\\"update\\\": \\\"false\\\"\\n }\\n ]\\n }\\n ]\\n}\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "6a815bb0-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: TCP Flags (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: TCP Flags (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"21a94970-5613-11e8-932f-d5f0b2e476ba\",\"type\":\"calculation\",\"variables\":[{\"id\":\"23e04db0-5613-11e8-932f-d5f0b2e476ba\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.tcp_flags\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "e12188f0-55d0-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: VLANs (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: VLANs (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.vlan\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "e160f860-55cf-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Server Autonomous Systems (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Server Autonomous Systems (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.server_autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.server_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "b22f5660-55d2-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Services (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Services (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.service_name\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "ae9de1b0-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Version (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: IP Version (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"bc2c73b0-5612-11e8-a8ff-859eba5de32f\",\"type\":\"calculation\",\"variables\":[{\"id\":\"bf205f50-5612-11e8-a8ff-859eba5de32f\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.ip_version\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "d1548dc0-55d3-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Version (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: IP Version (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.ip_version\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "7a609f00-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Ports (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Source Ports (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"f82d7990-5612-11e8-aa3f-47704e17ccf8\",\"type\":\"calculation\",\"variables\":[{\"id\":\"fc0f6eb0-5612-11e8-aa3f-47704e17ccf8\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.src_port_name\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "00b3a860-55d1-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: VLANs (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: VLANs (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.vlan\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "98d03770-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Servers (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Servers (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"d5c99c80-5612-11e8-a6a3-f9047d0437a6\",\"type\":\"calculation\",\"variables\":[{\"id\":\"d7fecc00-5612-11e8-a6a3-f9047d0437a6\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.server_hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "70ad67e0-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sources (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Sources (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"05cb3150-5613-11e8-95ce-e7b2166211be\",\"type\":\"calculation\",\"variables\":[{\"id\":\"0f6b0780-5613-11e8-95ce-e7b2166211be\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.src_hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "e68a40f0-55d7-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destinations (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Destinations (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.dst_hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "97a057b0-55cb-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Applications (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Applications (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.application\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "fe07e1f0-55d3-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Protocols (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: IP Protocols (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.ip_protocol\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "8dd6aa00-55d9-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Clients (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Clients (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.client_hostname\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "11b0a5d0-55d3-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Servers (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Servers (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.server_hostname\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "561570b0-55d9-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Countries (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Countries (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.country\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "bf600af0-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Exporters (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Flow Exporters (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"95108cd0-5612-11e8-8cf4-f1fcac410c6e\",\"type\":\"calculation\",\"variables\":[{\"id\":\"97231920-5612-11e8-8cf4-f1fcac410c6e\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"node.hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "b3007880-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Protocols (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: IP Protocols (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"ac032f10-5612-11e8-987a-399b859ae9e0\",\"type\":\"calculation\",\"variables\":[{\"id\":\"aefebbd0-5612-11e8-987a-399b859ae9e0\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.ip_protocol\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "c8e924d0-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destinations (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Destinations (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"73319730-5612-11e8-aef2-8d6be7224727\",\"type\":\"calculation\",\"variables\":[{\"id\":\"76164090-5612-11e8-aef2-8d6be7224727\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.dst_hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "a9d0ba20-55cf-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Autonomous Systems (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Destination Autonomous Systems (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.dst_autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.dst_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "39c991b0-55d0-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Autonomous Systems (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Source Autonomous Systems (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.src_autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.src_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "ec11c960-55cf-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Server Autonomous Systems (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Server Autonomous Systems (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.server_autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.server_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "a2722160-55cf-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Autonomous Systems (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Destination Autonomous Systems (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.dst_autonomous_system\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.dst_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "f279d050-55d3-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Protocols (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: IP Protocols (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.ip_protocol\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "d2606630-55d8-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Exporters (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Flow Exporters (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"node.hostname\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "8fee97e0-55b5-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Blank", + "visState": "{\"title\":\"ElastiFlow: Blank\",\"type\":\"markdown\",\"params\":{\"fontSize\":8,\"markdown\":\"![](http://www.koiossian.com/public/elastiflow.gif)\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "5af01150-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: VLANs (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: VLANs (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"4a7ea020-5613-11e8-9991-679c12b3fef7\",\"type\":\"calculation\",\"variables\":[{\"id\":\"4d43b390-5613-11e8-9991-679c12b3fef7\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.vlan\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "446257c0-55d9-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Countries (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Countries (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.country\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "92720510-55ce-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Client Autonomous Systems (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Client Autonomous Systems (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.client_autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.client_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "e1a87390-55cd-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Autonomous Systems (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Autonomous Systems (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "604bae20-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Types of Service (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Types of Service (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"3a636540-5613-11e8-bbfc-bb680694cbb3\",\"type\":\"calculation\",\"variables\":[{\"id\":\"3e0a2620-5613-11e8-bbfc-bb680694cbb3\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.tos\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "13b75a00-55cd-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Applications (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Applications (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.application\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "1bf3da30-55ce-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Autonomous Systems (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Autonomous Systems (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.autonomous_system\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "6486b700-55d7-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Ports (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Destination Ports (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.dst_port_name\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "3d778910-55d1-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Types of Service (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Types of Service (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.tos\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "58714360-55cb-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Applications (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Applications (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.application\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "a65eb880-5609-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Ingress/Egress Interfaces - input list", + "visState": "{\"title\":\"ElastiFlow: Ingress/Egress Interfaces - input list\",\"type\":\"input_control_vis\",\"params\":{\"controls\":[{\"id\":\"1526107640219\",\"fieldName\":\"event.type\",\"label\":\"Flow Type\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":10,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1526107541713\",\"fieldName\":\"node.hostname\",\"label\":\"Flow Exporter\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":500,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"},{\"id\":\"1526108883717\",\"fieldName\":\"flow.input_ifname\",\"label\":\"Ingress Interface\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":1000,\"order\":\"desc\"},\"parent\":\"1526107541713\",\"indexPatternRefName\":\"control_2_index_pattern\"},{\"id\":\"1526108909005\",\"fieldName\":\"flow.output_ifname\",\"label\":\"Egress Interface\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":1000,\"order\":\"desc\"},\"parent\":\"1526107541713\",\"indexPatternRefName\":\"control_3_index_pattern\"}],\"updateFiltersOnChange\":true,\"useTimeFilter\":true,\"pinFilters\":true},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "control_0_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_1_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_2_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_3_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "b577fca0-561d-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Traffic Types - input list", + "visState": "{\"title\":\"ElastiFlow: Traffic Types - input list\",\"type\":\"input_control_vis\",\"params\":{\"controls\":[{\"id\":\"1526107640219\",\"fieldName\":\"flow.client_hostname\",\"label\":\"Client\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":2500,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1526107541713\",\"fieldName\":\"flow.server_hostname\",\"label\":\"Server\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":2500,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"},{\"id\":\"1526153132040\",\"fieldName\":\"flow.service_name\",\"label\":\"Service\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":1000,\"order\":\"desc\"},\"indexPatternRefName\":\"control_2_index_pattern\"},{\"id\":\"1526153149794\",\"fieldName\":\"flow.application\",\"label\":\"Application\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":2000,\"order\":\"desc\"},\"indexPatternRefName\":\"control_3_index_pattern\"}],\"updateFiltersOnChange\":true,\"useTimeFilter\":true,\"pinFilters\":true},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "control_0_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_1_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_2_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_3_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "c0ca16b0-561d-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Traffic Locality - input list", + "visState": "{\"title\":\"ElastiFlow: Traffic Locality - input list\",\"type\":\"input_control_vis\",\"params\":{\"controls\":[{\"id\":\"1526107640219\",\"fieldName\":\"flow.traffic_locality\",\"label\":\"Traffic Locality\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":10,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1526107541713\",\"fieldName\":\"flow.autonomous_system\",\"label\":\"Autonomous System\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":2500,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"},{\"id\":\"1526153132040\",\"fieldName\":\"flow.country\",\"label\":\"Country\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":1000,\"order\":\"desc\"},\"indexPatternRefName\":\"control_2_index_pattern\"},{\"id\":\"1526153149794\",\"fieldName\":\"flow.city\",\"label\":\"City\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":2500,\"order\":\"desc\"},\"indexPatternRefName\":\"control_3_index_pattern\"}],\"updateFiltersOnChange\":true,\"useTimeFilter\":true,\"pinFilters\":true},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "control_0_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_1_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_2_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_3_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "17c29c50-55bd-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Src/Dst - input list", + "visState": "{\"title\":\"ElastiFlow: Src/Dst - input list\",\"type\":\"input_control_vis\",\"params\":{\"controls\":[{\"id\":\"1526107541713\",\"fieldName\":\"node.hostname\",\"label\":\"Flow Exporter\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":500,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1526107640219\",\"fieldName\":\"flow.src_hostname\",\"label\":\"Source\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":5000,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"},{\"id\":\"1526108883717\",\"fieldName\":\"flow.dst_hostname\",\"label\":\"Destnation\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":5000,\"order\":\"desc\"},\"indexPatternRefName\":\"control_2_index_pattern\"},{\"id\":\"1526108909005\",\"fieldName\":\"flow.dst_port_name\",\"label\":\"Destination Port\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":5000,\"order\":\"desc\"},\"indexPatternRefName\":\"control_3_index_pattern\"}],\"updateFiltersOnChange\":true,\"useTimeFilter\":true,\"pinFilters\":true},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "control_0_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_1_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_2_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_3_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "86262810-55d6-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Ingress Interfaces (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Ingress Interfaces (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.input_ifname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "b79dce60-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Ingress Interfaces (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Ingress Interfaces (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"a00fcbf0-5612-11e8-833a-d52124abe7ce\",\"type\":\"calculation\",\"variables\":[{\"id\":\"a25ec500-5612-11e8-833a-d52124abe7ce\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.input_ifname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "64d369b0-55d2-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sources (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Sources (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.src_hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "e2f1d4c0-55d3-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Version (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: IP Version (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.ip_version\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "71b7df60-55d9-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Countries (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Countries (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.country\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "05719e40-55d4-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Protocols (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: IP Protocols (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.ip_protocol\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "cd197750-562f-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sankey Src/Dst (flow records) - vega", + "visState": "{\"title\":\"ElastiFlow: Sankey Src/Dst (flow records) - vega\",\"type\":\"vega\",\"params\":{\"spec\":\"{\\n \\\"$schema\\\": \\\"https://vega.github.io/schema/vega/v3.0.json\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"rawData\\\",\\n \\\"url\\\": {\\n \\\"%context%\\\": true,\\n \\\"%timefield%\\\": \\\"@timestamp\\\",\\n \\\"index\\\": \\\"elastiflow-*\\\",\\n \\\"body\\\": {\\n \\\"size\\\": 0,\\n \\\"aggs\\\": {\\n \\\"table\\\": {\\n \\\"composite\\\": {\\n \\\"size\\\": 1000,\\n \\\"sources\\\": [\\n {\\\"stk1\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.src_hostname\\\"}}},\\n {\\\"stk2\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.dst_hostname\\\"}}}\\n ]\\n }\\n }\\n }\\n }\\n },\\n \\\"format\\\": {\\\"property\\\": \\\"aggregations.table.buckets\\\"},\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk1\\\", \\\"as\\\": \\\"stk1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk2\\\", \\\"as\\\": \\\"stk2\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.doc_count\\\", \\\"as\\\": \\\"size\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"nodes\\\",\\n \\\"source\\\": \\\"rawData\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"filter\\\",\\n \\\"expr\\\": \\\"!groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stk1+datum.stk2\\\", \\\"as\\\": \\\"key\\\"},\\n {\\\"type\\\": \\\"fold\\\", \\\"fields\\\": [\\\"stk1\\\", \\\"stk2\\\"], \\\"as\\\": [\\\"stack\\\", \\\"grpId\\\"]},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.stack == 'stk1' ? datum.stk1+datum.stk2 : datum.stk2+datum.stk1\\\",\\n \\\"as\\\": \\\"sortField\\\"\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"sortField\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"size\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"(datum.y0+datum.y1)/2\\\", \\\"as\\\": \\\"yc\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groups\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"aggregate\\\",\\n \\\"groupby\\\": [\\\"stack\\\", \\\"grpId\\\"],\\n \\\"fields\\\": [\\\"size\\\"],\\n \\\"ops\\\": [\\\"sum\\\"],\\n \\\"as\\\": [\\\"total\\\"]\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"grpId\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"total\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y0)\\\", \\\"as\\\": \\\"scaledY0\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y1)\\\", \\\"as\\\": \\\"scaledY1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\", \\\"as\\\": \\\"rightLabel\\\"},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.total/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n },\\n {\\n \\\"name\\\": \\\"destinationNodes\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk2'\\\"}]\\n },\\n {\\n \\\"name\\\": \\\"edges\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\"},\\n {\\n \\\"type\\\": \\\"lookup\\\",\\n \\\"from\\\": \\\"destinationNodes\\\",\\n \\\"key\\\": \\\"key\\\",\\n \\\"fields\\\": [\\\"key\\\"],\\n \\\"as\\\": [\\\"target\\\"]\\n },\\n {\\n \\\"type\\\": \\\"linkpath\\\",\\n \\\"orient\\\": \\\"horizontal\\\",\\n \\\"shape\\\": \\\"diagonal\\\",\\n \\\"sourceY\\\": {\\\"expr\\\": \\\"scale('y', datum.yc)\\\"},\\n \\\"sourceX\\\": {\\\"expr\\\": \\\"scale('x', 'stk1') + bandwidth('x')\\\"},\\n \\\"targetY\\\": {\\\"expr\\\": \\\"scale('y', datum.target.yc)\\\"},\\n \\\"targetX\\\": {\\\"expr\\\": \\\"scale('x', 'stk2')\\\"}\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"range('y')[0]-scale('y', datum.size)\\\",\\n \\\"as\\\": \\\"strokeWidth\\\"\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.size/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n }\\n ],\\n \\\"scales\\\": [\\n {\\n \\\"name\\\": \\\"x\\\",\\n \\\"type\\\": \\\"band\\\",\\n \\\"range\\\": \\\"width\\\",\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"],\\n \\\"paddingOuter\\\": 0.01,\\n \\\"paddingInner\\\": 0.98\\n },\\n {\\n \\\"name\\\": \\\"y\\\",\\n \\\"type\\\": \\\"linear\\\",\\n \\\"range\\\": \\\"height\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"nodes\\\", \\\"field\\\": \\\"y1\\\"}\\n },\\n {\\n \\\"name\\\": \\\"color\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": \\\"category\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"rawData\\\", \\\"fields\\\": [\\\"stk1\\\",\\\"stk2\\\"]}\\n },\\n {\\n \\\"name\\\": \\\"stackNames\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": [\\\"Source\\\", \\\"Dest\\\"],\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"]\\n }\\n ],\\n \\\"axes\\\": [\\n {\\n \\\"orient\\\": \\\"bottom\\\",\\n \\\"scale\\\": \\\"x\\\",\\n \\\"encode\\\": {\\n \\\"labels\\\": {\\n \\\"update\\\": {\\n \\\"text\\\": {\\\"scale\\\": \\\"stackNames\\\", \\\"field\\\": \\\"value\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14}\\n }\\n }\\n }\\n },\\n {\\n \\\"orient\\\": \\\"left\\\",\\n \\\"scale\\\": \\\"y\\\",\\n \\\"encode\\\": {\\\"labels\\\": {\\\"update\\\": {\\\"fontSize\\\": {\\\"value\\\": 12}}}}\\n }\\n ],\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"path\\\",\\n \\\"name\\\": \\\"edgeMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"edges\\\"},\\n \\\"clip\\\": true,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"stroke\\\": [\\n {\\n \\\"test\\\": \\\"groupSelector && groupSelector.stack=='stk1'\\\",\\n \\\"scale\\\": \\\"color\\\",\\n \\\"field\\\": \\\"stk2\\\"\\n },\\n {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"stk1\\\"}\\n ],\\n \\\"strokeWidth\\\": {\\\"field\\\": \\\"strokeWidth\\\"},\\n \\\"path\\\": {\\\"field\\\": \\\"path\\\"},\\n \\\"strokeOpacity\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.75 : 0.3\\\"\\n },\\n \\\"zindex\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\\\"\\n },\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"strokeOpacity\\\": {\\\"value\\\": 0.75}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"rect\\\",\\n \\\"name\\\": \\\"groupMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"fill\\\": {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"grpId\\\"},\\n \\\"width\\\": {\\\"scale\\\": \\\"x\\\", \\\"band\\\": 1}\\n },\\n \\\"update\\\": {\\n \\\"x\\\": {\\\"scale\\\": \\\"x\\\", \\\"field\\\": \\\"stack\\\"},\\n \\\"y\\\": {\\\"field\\\": \\\"scaledY0\\\"},\\n \\\"y2\\\": {\\\"field\\\": \\\"scaledY1\\\"},\\n \\\"fillOpacity\\\": {\\\"value\\\": 0.7},\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"fillOpacity\\\": {\\\"value\\\": 1}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"x\\\": {\\n \\\"signal\\\": \\\"scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\\\"\\n },\\n \\\"yc\\\": {\\\"signal\\\": \\\"(datum.scaledY0 + datum.scaledY1)/2\\\"},\\n \\\"align\\\": {\\\"signal\\\": \\\"datum.rightLabel ? 'left' : 'right'\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"fontWeight\\\": {\\\"value\\\": \\\"bold\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 12},\\n \\\"text\\\": {\\n \\\"signal\\\": \\\"abs(datum.scaledY0-datum.scaledY1) > 10 ? datum.grpId : ''\\\"\\n }\\n }\\n }\\n },\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"dataForShowAll\\\",\\n \\\"values\\\": [{}],\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"groupSelector\\\"}]\\n }\\n ],\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"signal\\\": \\\"width/2\\\"},\\n \\\"y\\\": {\\\"value\\\": 30},\\n \\\"width\\\": {\\\"value\\\": 100},\\n \\\"height\\\": {\\\"value\\\": 36}\\n }\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"name\\\": \\\"groupReset\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"dataForShowAll\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"cornerRadius\\\": {\\\"value\\\": 3.5},\\n \\\"fill\\\": {\\\"value\\\": \\\"#666666\\\"},\\n \\\"height\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}},\\n \\\"width\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}}\\n },\\n \\\"update\\\": {\\\"opacity\\\": {\\\"value\\\": 1}},\\n \\\"hover\\\": {\\\"fill\\\": {\\\"value\\\": \\\"#444444\\\"}}\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}, \\\"mult\\\": 0.5},\\n \\\"yc\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}, \\\"mult\\\": 0.5, \\\"offset\\\": 1},\\n \\\"align\\\": {\\\"value\\\": \\\"center\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"text\\\": {\\\"value\\\": \\\"Show All\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14},\\n \\\"stroke\\\": {\\\"value\\\": \\\"#ecf0f1\\\"}\\n }\\n }\\n }\\n ]\\n }\\n ]\\n }\\n ],\\n \\\"signals\\\": [\\n {\\n \\\"name\\\": \\\"groupHover\\\",\\n \\\"value\\\": {},\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:mouseover\\\",\\n \\\"update\\\": \\\"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\\"events\\\": \\\"mouseout\\\", \\\"update\\\": \\\"{}\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groupSelector\\\",\\n \\\"value\\\": false,\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:click!\\\",\\n \\\"update\\\": \\\"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\n \\\"events\\\": [\\n {\\\"type\\\": \\\"click\\\", \\\"markname\\\": \\\"groupReset\\\"},\\n {\\\"type\\\": \\\"dblclick\\\"}\\n ],\\n \\\"update\\\": \\\"false\\\"\\n }\\n ]\\n }\\n ]\\n}\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "53f4a4d0-55df-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Types & Exporters - input list", + "visState": "{\"title\":\"ElastiFlow: Flow Types & Exporters - input list\",\"type\":\"input_control_vis\",\"params\":{\"controls\":[{\"id\":\"1526107640219\",\"fieldName\":\"event.type\",\"label\":\"Flow Type\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":20,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1526107541713\",\"fieldName\":\"node.hostname\",\"label\":\"Flow Exporter\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":500,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"}],\"updateFiltersOnChange\":true,\"useTimeFilter\":true,\"pinFilters\":true},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "control_0_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_1_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "ae3c66c0-55d1-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: TCP Flags (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: TCP Flags (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.tcp_flags\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "61ed9a20-561a-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Traffic Attributes - input list", + "visState": "{\"title\":\"ElastiFlow: Traffic Attributes - input list\",\"type\":\"input_control_vis\",\"params\":{\"controls\":[{\"id\":\"1526107640219\",\"fieldName\":\"flow.ip_protocol\",\"label\":\"IP Protocol\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":50,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1526107541713\",\"fieldName\":\"flow.vlan\",\"label\":\"VLAN\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":1000,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"},{\"id\":\"1526153132040\",\"fieldName\":\"flow.tos\",\"label\":\"Type of Service\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":1000,\"order\":\"desc\"},\"indexPatternRefName\":\"control_2_index_pattern\"},{\"id\":\"1526153149794\",\"fieldName\":\"flow.tcp_flags\",\"label\":\"TCP Flag\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":10,\"order\":\"desc\"},\"indexPatternRefName\":\"control_3_index_pattern\"}],\"updateFiltersOnChange\":true,\"useTimeFilter\":true,\"pinFilters\":true},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "control_0_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_1_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_2_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_3_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "95799400-55b3-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Client/Server - input list", + "visState": "{\"title\":\"ElastiFlow: Client/Server - input list\",\"type\":\"input_control_vis\",\"params\":{\"controls\":[{\"id\":\"1526107541713\",\"fieldName\":\"node.hostname\",\"label\":\"Flow Exporter\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":500,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1526107640219\",\"fieldName\":\"flow.client_hostname\",\"label\":\"Client\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":5000,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"},{\"id\":\"1526108883717\",\"fieldName\":\"flow.server_hostname\",\"label\":\"Server\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":5000,\"order\":\"desc\"},\"indexPatternRefName\":\"control_2_index_pattern\"},{\"id\":\"1526108909005\",\"fieldName\":\"flow.service_name\",\"label\":\"Service\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":1000,\"order\":\"desc\"},\"indexPatternRefName\":\"control_3_index_pattern\"}],\"updateFiltersOnChange\":true,\"useTimeFilter\":true,\"pinFilters\":true},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "control_0_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_1_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_2_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_3_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "e3c2e2c0-5607-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Src/Dst Autonomous Systems - input list", + "visState": "{\"title\":\"ElastiFlow: Src/Dst Autonomous Systems - input list\",\"type\":\"input_control_vis\",\"params\":{\"controls\":[{\"id\":\"1526107541713\",\"fieldName\":\"node.hostname\",\"label\":\"Flow Exporter\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":500,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1526107640219\",\"fieldName\":\"flow.src_autonomous_system\",\"label\":\"Source AS\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":5000,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"},{\"id\":\"1526108883717\",\"fieldName\":\"flow.dst_autonomous_system\",\"label\":\"Destnation AS\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":5000,\"order\":\"desc\"},\"indexPatternRefName\":\"control_2_index_pattern\"},{\"id\":\"1526108909005\",\"fieldName\":\"flow.service_name\",\"label\":\"Service\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":5000,\"order\":\"desc\"},\"indexPatternRefName\":\"control_3_index_pattern\"}],\"updateFiltersOnChange\":true,\"useTimeFilter\":true,\"pinFilters\":true},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "control_0_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_1_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_2_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_3_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "266da690-55d7-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Ports (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Destination Ports (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.dst_port_name\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "8f6da1e0-55d2-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sources (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Sources (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.src_hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "da47ecc0-55d2-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Services (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Services (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.service_name\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "c481fa20-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Egress Interfaces (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Egress Interfaces (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"83a0e580-5612-11e8-9770-ed998bc0982c\",\"type\":\"calculation\",\"variables\":[{\"id\":\"88cdd130-5612-11e8-9770-ed998bc0982c\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.output_ifname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "1f0f0340-55d6-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Egress Interfaces (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Egress Interfaces (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.output_ifname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "644c9760-55db-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Types (flow records) - TSVB (stacked bar)", + "visState": "{\"title\":\"ElastiFlow: Flow Types (flow records) - TSVB (stacked bar)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"bar\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"gradient\",\"label\":\"Flows\",\"terms_field\":\"event.type\",\"terms_size\":\"25\",\"filter\":\"\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "8b7247d0-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Services (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Services (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"dfd5f020-5612-11e8-8874-4b2cb46d3ac9\",\"type\":\"calculation\",\"variables\":[{\"id\":\"e35ca5e0-5612-11e8-8874-4b2cb46d3ac9\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.service_name\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "81128960-55d9-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Clients (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Clients (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.client_hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "ce449a90-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Ports (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Destination Ports (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"670b6440-5612-11e8-b312-79bc7794402d\",\"type\":\"calculation\",\"variables\":[{\"id\":\"6ac62250-5612-11e8-b312-79bc7794402d\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.dst_port_name\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "f058c840-55d7-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destinations (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Destinations (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.dst_hostname\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "1fb54370-55d8-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Ports (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Source Ports (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.src_port_name\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "fb44e2a0-55d9-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Cities (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Cities (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.city\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "cebac580-55d2-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Services (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Services (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.service_name\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "f262c2b0-55cf-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Server Autonomous Systems (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Server Autonomous Systems (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.server_autonomous_system\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.server_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "a8323470-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Server Autonomous Systems (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Server Autonomous Systems (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"c89ecad0-5612-11e8-b8f4-81e5f5de0f37\",\"type\":\"calculation\",\"variables\":[{\"id\":\"cb30e760-5612-11e8-b8f4-81e5f5de0f37\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.server_autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.server_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "9d557dd0-55d9-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Clients (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Clients (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.client_hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "c6e39d30-55d9-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Cities (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Cities (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.city\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "c3861b50-55ce-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Client Autonomous Systems (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Client Autonomous Systems (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.client_autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.client_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "fa17b8d0-55cf-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Server Autonomous Systems (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Server Autonomous Systems (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.server_autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.server_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "6f3cf880-55d2-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sources (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Sources (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.src_hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "290d5be0-55d0-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Autonomous Systems (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Source Autonomous Systems (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.src_autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.src_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "3a281650-55d9-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Countries (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Countries (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.country\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "9e614fe0-55d6-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Ingress Interfaces (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Ingress Interfaces (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.input_snmp\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "f98654a0-55d7-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destinations (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Destinations (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.dst_hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "a819b0c0-55ce-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Client Autonomous Systems (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Client Autonomous Systems (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.client_autonomous_system\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.client_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "2b35e790-55d8-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Ports (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Source Ports (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.src_port_name\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "94bf2860-55d9-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Clients (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Clients (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.client_hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "4aad7a20-55d8-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Ports (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Source Ports (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.src_port_name\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "a109f3f0-55d1-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: TCP Flags (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: TCP Flags (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.tcp_flags\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "f15da330-55d9-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Cities (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Cities (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.city\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "7546a110-55fd-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Types, Exporters & Services - input list", + "visState": "{\"title\":\"ElastiFlow: Flow Types, Exporters & Services - input list\",\"type\":\"input_control_vis\",\"params\":{\"controls\":[{\"id\":\"1526107640219\",\"fieldName\":\"event.type\",\"label\":\"Flow Type\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":20,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1526107541713\",\"fieldName\":\"node.hostname\",\"label\":\"Flow Exporter\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":500,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"},{\"id\":\"1526140705539\",\"fieldName\":\"flow.service_name\",\"label\":\"Service\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":500,\"order\":\"desc\"},\"indexPatternRefName\":\"control_2_index_pattern\"}],\"updateFiltersOnChange\":true,\"useTimeFilter\":true,\"pinFilters\":true},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "control_0_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_1_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_2_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "72ac9770-560c-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Types, Exporters & Apps - input list", + "visState": "{\"title\":\"ElastiFlow: Flow Types, Exporters & Apps - input list\",\"type\":\"input_control_vis\",\"params\":{\"controls\":[{\"id\":\"1526107640219\",\"fieldName\":\"event.type\",\"label\":\"Flow Type\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":20,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1526107541713\",\"fieldName\":\"node.hostname\",\"label\":\"Flow Exporter\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":500,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"},{\"id\":\"1526140705539\",\"fieldName\":\"flow.application\",\"label\":\"Application\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":500,\"order\":\"desc\"},\"indexPatternRefName\":\"control_2_index_pattern\"}],\"updateFiltersOnChange\":true,\"useTimeFilter\":true,\"pinFilters\":true},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "control_0_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_1_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_2_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "981e3d70-55cf-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Autonomous Systems (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Destination Autonomous Systems (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.dst_autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.dst_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "32231a80-55d0-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Autonomous Systems (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Source Autonomous Systems (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.src_autonomous_system\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.src_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "94b202a0-55d1-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: TCP Flags (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: TCP Flags (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.tcp_flags\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "96e6a3a0-55d6-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Ingress Interfaces (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Ingress Interfaces (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.input_snmp\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "f54e7b80-55d0-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: VLANs (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: VLANs (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.vlan\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "eab88580-55d0-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: VLANs (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: VLANs (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.vlan\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "d827d2e0-33b0-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: ZFlow - Commands (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: ZFlow - Commands (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bit Rate\",\"terms_field\":\"flow.application\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"axis_scale\":\"normal\",\"filter\":\"_exists_: ipfix.ziften_agent_guid\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "3f597140-3374-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sankey Client/Server (packets) - vega", + "visState": "{\"title\":\"ElastiFlow: Sankey Client/Server (packets) - vega\",\"type\":\"vega\",\"params\":{\"spec\":\"{\\n \\\"$schema\\\": \\\"https://vega.github.io/schema/vega/v3.0.json\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"rawData\\\",\\n \\\"url\\\": {\\n \\\"%context%\\\": true,\\n \\\"%timefield%\\\": \\\"@timestamp\\\",\\n \\\"index\\\": \\\"elastiflow-*\\\",\\n \\\"body\\\": {\\n \\\"size\\\": 0,\\n \\\"aggs\\\": {\\n \\\"table\\\": {\\n \\\"composite\\\": {\\n \\\"size\\\": 1000,\\n \\\"sources\\\": [\\n {\\\"stk1\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.client_hostname\\\"}}},\\n {\\\"stk2\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.server_hostname\\\"}}}\\n ]\\n },\\n \\t\\t\\t\\\"aggs\\\": {\\n \\t\\t\\t\\t\\\"bytes\\\": {\\n \\t\\t\\t\\t\\t\\\"sum\\\": {\\n \\t\\t\\t\\t\\t\\t\\\"field\\\": \\\"flow.packets\\\"\\n \\t\\t\\t\\t\\t}\\n \\t\\t\\t\\t}\\n \\t\\t\\t}\\n }\\n }\\n }\\n },\\n \\\"format\\\": {\\\"property\\\": \\\"aggregations.table.buckets\\\"},\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk1\\\", \\\"as\\\": \\\"stk1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk2\\\", \\\"as\\\": \\\"stk2\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.doc_count\\\", \\\"as\\\": \\\"size\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"nodes\\\",\\n \\\"source\\\": \\\"rawData\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"filter\\\",\\n \\\"expr\\\": \\\"!groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stk1+datum.stk2\\\", \\\"as\\\": \\\"key\\\"},\\n {\\\"type\\\": \\\"fold\\\", \\\"fields\\\": [\\\"stk1\\\", \\\"stk2\\\"], \\\"as\\\": [\\\"stack\\\", \\\"grpId\\\"]},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.stack == 'stk1' ? datum.stk1+datum.stk2 : datum.stk2+datum.stk1\\\",\\n \\\"as\\\": \\\"sortField\\\"\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"sortField\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"size\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"(datum.y0+datum.y1)/2\\\", \\\"as\\\": \\\"yc\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groups\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"aggregate\\\",\\n \\\"groupby\\\": [\\\"stack\\\", \\\"grpId\\\"],\\n \\\"fields\\\": [\\\"size\\\"],\\n \\\"ops\\\": [\\\"sum\\\"],\\n \\\"as\\\": [\\\"total\\\"]\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"grpId\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"total\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y0)\\\", \\\"as\\\": \\\"scaledY0\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y1)\\\", \\\"as\\\": \\\"scaledY1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\", \\\"as\\\": \\\"rightLabel\\\"},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.total/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n },\\n {\\n \\\"name\\\": \\\"destinationNodes\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk2'\\\"}]\\n },\\n {\\n \\\"name\\\": \\\"edges\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\"},\\n {\\n \\\"type\\\": \\\"lookup\\\",\\n \\\"from\\\": \\\"destinationNodes\\\",\\n \\\"key\\\": \\\"key\\\",\\n \\\"fields\\\": [\\\"key\\\"],\\n \\\"as\\\": [\\\"target\\\"]\\n },\\n {\\n \\\"type\\\": \\\"linkpath\\\",\\n \\\"orient\\\": \\\"horizontal\\\",\\n \\\"shape\\\": \\\"diagonal\\\",\\n \\\"sourceY\\\": {\\\"expr\\\": \\\"scale('y', datum.yc)\\\"},\\n \\\"sourceX\\\": {\\\"expr\\\": \\\"scale('x', 'stk1') + bandwidth('x')\\\"},\\n \\\"targetY\\\": {\\\"expr\\\": \\\"scale('y', datum.target.yc)\\\"},\\n \\\"targetX\\\": {\\\"expr\\\": \\\"scale('x', 'stk2')\\\"}\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"range('y')[0]-scale('y', datum.size)\\\",\\n \\\"as\\\": \\\"strokeWidth\\\"\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.size/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n }\\n ],\\n \\\"scales\\\": [\\n {\\n \\\"name\\\": \\\"x\\\",\\n \\\"type\\\": \\\"band\\\",\\n \\\"range\\\": \\\"width\\\",\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"],\\n \\\"paddingOuter\\\": 0.01,\\n \\\"paddingInner\\\": 0.98\\n },\\n {\\n \\\"name\\\": \\\"y\\\",\\n \\\"type\\\": \\\"linear\\\",\\n \\\"range\\\": \\\"height\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"nodes\\\", \\\"field\\\": \\\"y1\\\"}\\n },\\n {\\n \\\"name\\\": \\\"color\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": \\\"category\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"rawData\\\", \\\"fields\\\": [\\\"stk1\\\",\\\"stk2\\\"]}\\n },\\n {\\n \\\"name\\\": \\\"stackNames\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": [\\\"Client\\\", \\\"Server\\\"],\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"]\\n }\\n ],\\n \\\"axes\\\": [\\n {\\n \\\"orient\\\": \\\"bottom\\\",\\n \\\"scale\\\": \\\"x\\\",\\n \\\"encode\\\": {\\n \\\"labels\\\": {\\n \\\"update\\\": {\\n \\\"text\\\": {\\\"scale\\\": \\\"stackNames\\\", \\\"field\\\": \\\"value\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14}\\n }\\n }\\n }\\n },\\n {\\n \\\"orient\\\": \\\"left\\\",\\n \\\"scale\\\": \\\"y\\\",\\n \\\"encode\\\": {\\\"labels\\\": {\\\"update\\\": {\\\"fontSize\\\": {\\\"value\\\": 12}}}}\\n }\\n ],\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"path\\\",\\n \\\"name\\\": \\\"edgeMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"edges\\\"},\\n \\\"clip\\\": true,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"stroke\\\": [\\n {\\n \\\"test\\\": \\\"groupSelector && groupSelector.stack=='stk1'\\\",\\n \\\"scale\\\": \\\"color\\\",\\n \\\"field\\\": \\\"stk2\\\"\\n },\\n {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"stk1\\\"}\\n ],\\n \\\"strokeWidth\\\": {\\\"field\\\": \\\"strokeWidth\\\"},\\n \\\"path\\\": {\\\"field\\\": \\\"path\\\"},\\n \\\"strokeOpacity\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.75 : 0.3\\\"\\n },\\n \\\"zindex\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\\\"\\n },\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"strokeOpacity\\\": {\\\"value\\\": 0.75}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"rect\\\",\\n \\\"name\\\": \\\"groupMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"fill\\\": {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"grpId\\\"},\\n \\\"width\\\": {\\\"scale\\\": \\\"x\\\", \\\"band\\\": 1}\\n },\\n \\\"update\\\": {\\n \\\"x\\\": {\\\"scale\\\": \\\"x\\\", \\\"field\\\": \\\"stack\\\"},\\n \\\"y\\\": {\\\"field\\\": \\\"scaledY0\\\"},\\n \\\"y2\\\": {\\\"field\\\": \\\"scaledY1\\\"},\\n \\\"fillOpacity\\\": {\\\"value\\\": 0.7},\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"fillOpacity\\\": {\\\"value\\\": 1}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"x\\\": {\\n \\\"signal\\\": \\\"scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\\\"\\n },\\n \\\"yc\\\": {\\\"signal\\\": \\\"(datum.scaledY0 + datum.scaledY1)/2\\\"},\\n \\\"align\\\": {\\\"signal\\\": \\\"datum.rightLabel ? 'left' : 'right'\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"fontWeight\\\": {\\\"value\\\": \\\"bold\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 12},\\n \\\"text\\\": {\\n \\\"signal\\\": \\\"abs(datum.scaledY0-datum.scaledY1) > 10 ? datum.grpId : ''\\\"\\n }\\n }\\n }\\n },\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"dataForShowAll\\\",\\n \\\"values\\\": [{}],\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"groupSelector\\\"}]\\n }\\n ],\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"signal\\\": \\\"width/2\\\"},\\n \\\"y\\\": {\\\"value\\\": 30},\\n \\\"width\\\": {\\\"value\\\": 100},\\n \\\"height\\\": {\\\"value\\\": 36}\\n }\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"name\\\": \\\"groupReset\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"dataForShowAll\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"cornerRadius\\\": {\\\"value\\\": 3.5},\\n \\\"fill\\\": {\\\"value\\\": \\\"#666666\\\"},\\n \\\"height\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}},\\n \\\"width\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}}\\n },\\n \\\"update\\\": {\\\"opacity\\\": {\\\"value\\\": 1}},\\n \\\"hover\\\": {\\\"fill\\\": {\\\"value\\\": \\\"#444444\\\"}}\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}, \\\"mult\\\": 0.5},\\n \\\"yc\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}, \\\"mult\\\": 0.5, \\\"offset\\\": 1},\\n \\\"align\\\": {\\\"value\\\": \\\"center\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"text\\\": {\\\"value\\\": \\\"Show All\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14},\\n \\\"stroke\\\": {\\\"value\\\": \\\"#ecf0f1\\\"}\\n }\\n }\\n }\\n ]\\n }\\n ]\\n }\\n ],\\n \\\"signals\\\": [\\n {\\n \\\"name\\\": \\\"groupHover\\\",\\n \\\"value\\\": {},\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:mouseover\\\",\\n \\\"update\\\": \\\"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\\"events\\\": \\\"mouseout\\\", \\\"update\\\": \\\"{}\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groupSelector\\\",\\n \\\"value\\\": false,\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:click!\\\",\\n \\\"update\\\": \\\"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\n \\\"events\\\": [\\n {\\\"type\\\": \\\"click\\\", \\\"markname\\\": \\\"groupReset\\\"},\\n {\\\"type\\\": \\\"dblclick\\\"}\\n ],\\n \\\"update\\\": \\\"false\\\"\\n }\\n ]\\n }\\n ]\\n}\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "819e7820-3374-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sankey Src AS/Dst AS (bytes) - vega", + "visState": "{\"title\":\"ElastiFlow: Sankey Src AS/Dst AS (bytes) - vega\",\"type\":\"vega\",\"params\":{\"spec\":\"{\\n \\\"$schema\\\": \\\"https://vega.github.io/schema/vega/v3.0.json\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"rawData\\\",\\n \\\"url\\\": {\\n \\\"%context%\\\": true,\\n \\\"%timefield%\\\": \\\"@timestamp\\\",\\n \\\"index\\\": \\\"elastiflow-*\\\",\\n \\\"body\\\": {\\n \\\"size\\\": 0,\\n \\\"aggs\\\": {\\n \\\"table\\\": {\\n \\\"composite\\\": {\\n \\\"size\\\": 1000,\\n \\\"sources\\\": [\\n {\\\"stk1\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.src_autonomous_system\\\"}}},\\n {\\\"stk2\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.dst_autonomous_system\\\"}}}\\n ]\\n },\\n \\t\\t\\t\\\"aggs\\\": {\\n \\t\\t\\t\\t\\\"bytes\\\": {\\n \\t\\t\\t\\t\\t\\\"sum\\\": {\\n \\t\\t\\t\\t\\t\\t\\\"field\\\": \\\"flow.bytes\\\"\\n \\t\\t\\t\\t\\t}\\n \\t\\t\\t\\t}\\n \\t\\t\\t}\\n }\\n }\\n }\\n },\\n \\\"format\\\": {\\\"property\\\": \\\"aggregations.table.buckets\\\"},\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk1\\\", \\\"as\\\": \\\"stk1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk2\\\", \\\"as\\\": \\\"stk2\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.doc_count\\\", \\\"as\\\": \\\"size\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"nodes\\\",\\n \\\"source\\\": \\\"rawData\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"filter\\\",\\n \\\"expr\\\": \\\"!groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stk1+datum.stk2\\\", \\\"as\\\": \\\"key\\\"},\\n {\\\"type\\\": \\\"fold\\\", \\\"fields\\\": [\\\"stk1\\\", \\\"stk2\\\"], \\\"as\\\": [\\\"stack\\\", \\\"grpId\\\"]},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.stack == 'stk1' ? datum.stk1+datum.stk2 : datum.stk2+datum.stk1\\\",\\n \\\"as\\\": \\\"sortField\\\"\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"sortField\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"size\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"(datum.y0+datum.y1)/2\\\", \\\"as\\\": \\\"yc\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groups\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"aggregate\\\",\\n \\\"groupby\\\": [\\\"stack\\\", \\\"grpId\\\"],\\n \\\"fields\\\": [\\\"size\\\"],\\n \\\"ops\\\": [\\\"sum\\\"],\\n \\\"as\\\": [\\\"total\\\"]\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"grpId\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"total\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y0)\\\", \\\"as\\\": \\\"scaledY0\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y1)\\\", \\\"as\\\": \\\"scaledY1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\", \\\"as\\\": \\\"rightLabel\\\"},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.total/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n },\\n {\\n \\\"name\\\": \\\"destinationNodes\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk2'\\\"}]\\n },\\n {\\n \\\"name\\\": \\\"edges\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\"},\\n {\\n \\\"type\\\": \\\"lookup\\\",\\n \\\"from\\\": \\\"destinationNodes\\\",\\n \\\"key\\\": \\\"key\\\",\\n \\\"fields\\\": [\\\"key\\\"],\\n \\\"as\\\": [\\\"target\\\"]\\n },\\n {\\n \\\"type\\\": \\\"linkpath\\\",\\n \\\"orient\\\": \\\"horizontal\\\",\\n \\\"shape\\\": \\\"diagonal\\\",\\n \\\"sourceY\\\": {\\\"expr\\\": \\\"scale('y', datum.yc)\\\"},\\n \\\"sourceX\\\": {\\\"expr\\\": \\\"scale('x', 'stk1') + bandwidth('x')\\\"},\\n \\\"targetY\\\": {\\\"expr\\\": \\\"scale('y', datum.target.yc)\\\"},\\n \\\"targetX\\\": {\\\"expr\\\": \\\"scale('x', 'stk2')\\\"}\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"range('y')[0]-scale('y', datum.size)\\\",\\n \\\"as\\\": \\\"strokeWidth\\\"\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.size/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n }\\n ],\\n \\\"scales\\\": [\\n {\\n \\\"name\\\": \\\"x\\\",\\n \\\"type\\\": \\\"band\\\",\\n \\\"range\\\": \\\"width\\\",\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"],\\n \\\"paddingOuter\\\": 0.01,\\n \\\"paddingInner\\\": 0.98\\n },\\n {\\n \\\"name\\\": \\\"y\\\",\\n \\\"type\\\": \\\"linear\\\",\\n \\\"range\\\": \\\"height\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"nodes\\\", \\\"field\\\": \\\"y1\\\"}\\n },\\n {\\n \\\"name\\\": \\\"color\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": \\\"category\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"rawData\\\", \\\"fields\\\": [\\\"stk1\\\",\\\"stk2\\\"]}\\n },\\n {\\n \\\"name\\\": \\\"stackNames\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": [\\\"Source AS\\\", \\\"Dest AS\\\"],\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"]\\n }\\n ],\\n \\\"axes\\\": [\\n {\\n \\\"orient\\\": \\\"bottom\\\",\\n \\\"scale\\\": \\\"x\\\",\\n \\\"encode\\\": {\\n \\\"labels\\\": {\\n \\\"update\\\": {\\n \\\"text\\\": {\\\"scale\\\": \\\"stackNames\\\", \\\"field\\\": \\\"value\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14}\\n }\\n }\\n }\\n },\\n {\\n \\\"orient\\\": \\\"left\\\",\\n \\\"scale\\\": \\\"y\\\",\\n \\\"encode\\\": {\\\"labels\\\": {\\\"update\\\": {\\\"fontSize\\\": {\\\"value\\\": 12}}}}\\n }\\n ],\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"path\\\",\\n \\\"name\\\": \\\"edgeMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"edges\\\"},\\n \\\"clip\\\": true,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"stroke\\\": [\\n {\\n \\\"test\\\": \\\"groupSelector && groupSelector.stack=='stk1'\\\",\\n \\\"scale\\\": \\\"color\\\",\\n \\\"field\\\": \\\"stk2\\\"\\n },\\n {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"stk1\\\"}\\n ],\\n \\\"strokeWidth\\\": {\\\"field\\\": \\\"strokeWidth\\\"},\\n \\\"path\\\": {\\\"field\\\": \\\"path\\\"},\\n \\\"strokeOpacity\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.75 : 0.3\\\"\\n },\\n \\\"zindex\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\\\"\\n },\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"strokeOpacity\\\": {\\\"value\\\": 0.75}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"rect\\\",\\n \\\"name\\\": \\\"groupMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"fill\\\": {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"grpId\\\"},\\n \\\"width\\\": {\\\"scale\\\": \\\"x\\\", \\\"band\\\": 1}\\n },\\n \\\"update\\\": {\\n \\\"x\\\": {\\\"scale\\\": \\\"x\\\", \\\"field\\\": \\\"stack\\\"},\\n \\\"y\\\": {\\\"field\\\": \\\"scaledY0\\\"},\\n \\\"y2\\\": {\\\"field\\\": \\\"scaledY1\\\"},\\n \\\"fillOpacity\\\": {\\\"value\\\": 0.7},\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"fillOpacity\\\": {\\\"value\\\": 1}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"x\\\": {\\n \\\"signal\\\": \\\"scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\\\"\\n },\\n \\\"yc\\\": {\\\"signal\\\": \\\"(datum.scaledY0 + datum.scaledY1)/2\\\"},\\n \\\"align\\\": {\\\"signal\\\": \\\"datum.rightLabel ? 'left' : 'right'\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"fontWeight\\\": {\\\"value\\\": \\\"bold\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 12},\\n \\\"text\\\": {\\n \\\"signal\\\": \\\"abs(datum.scaledY0-datum.scaledY1) > 10 ? datum.grpId : ''\\\"\\n }\\n }\\n }\\n },\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"dataForShowAll\\\",\\n \\\"values\\\": [{}],\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"groupSelector\\\"}]\\n }\\n ],\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"signal\\\": \\\"width/2\\\"},\\n \\\"y\\\": {\\\"value\\\": 30},\\n \\\"width\\\": {\\\"value\\\": 100},\\n \\\"height\\\": {\\\"value\\\": 36}\\n }\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"name\\\": \\\"groupReset\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"dataForShowAll\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"cornerRadius\\\": {\\\"value\\\": 3.5},\\n \\\"fill\\\": {\\\"value\\\": \\\"#666666\\\"},\\n \\\"height\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}},\\n \\\"width\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}}\\n },\\n \\\"update\\\": {\\\"opacity\\\": {\\\"value\\\": 1}},\\n \\\"hover\\\": {\\\"fill\\\": {\\\"value\\\": \\\"#444444\\\"}}\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}, \\\"mult\\\": 0.5},\\n \\\"yc\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}, \\\"mult\\\": 0.5, \\\"offset\\\": 1},\\n \\\"align\\\": {\\\"value\\\": \\\"center\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"text\\\": {\\\"value\\\": \\\"Show All\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14},\\n \\\"stroke\\\": {\\\"value\\\": \\\"#ecf0f1\\\"}\\n }\\n }\\n }\\n ]\\n }\\n ]\\n }\\n ],\\n \\\"signals\\\": [\\n {\\n \\\"name\\\": \\\"groupHover\\\",\\n \\\"value\\\": {},\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:mouseover\\\",\\n \\\"update\\\": \\\"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\\"events\\\": \\\"mouseout\\\", \\\"update\\\": \\\"{}\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groupSelector\\\",\\n \\\"value\\\": false,\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:click!\\\",\\n \\\"update\\\": \\\"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\n \\\"events\\\": [\\n {\\\"type\\\": \\\"click\\\", \\\"markname\\\": \\\"groupReset\\\"},\\n {\\\"type\\\": \\\"dblclick\\\"}\\n ],\\n \\\"update\\\": \\\"false\\\"\\n }\\n ]\\n }\\n ]\\n}\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "734fbfe0-3374-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sankey Src AS/Dst AS (packets) - vega", + "visState": "{\"title\":\"ElastiFlow: Sankey Src AS/Dst AS (packets) - vega\",\"type\":\"vega\",\"params\":{\"spec\":\"{\\n \\\"$schema\\\": \\\"https://vega.github.io/schema/vega/v3.0.json\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"rawData\\\",\\n \\\"url\\\": {\\n \\\"%context%\\\": true,\\n \\\"%timefield%\\\": \\\"@timestamp\\\",\\n \\\"index\\\": \\\"elastiflow-*\\\",\\n \\\"body\\\": {\\n \\\"size\\\": 0,\\n \\\"aggs\\\": {\\n \\\"table\\\": {\\n \\\"composite\\\": {\\n \\\"size\\\": 1000,\\n \\\"sources\\\": [\\n {\\\"stk1\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.src_autonomous_system\\\"}}},\\n {\\\"stk2\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.dst_autonomous_system\\\"}}}\\n ]\\n },\\n \\t\\t\\t\\\"aggs\\\": {\\n \\t\\t\\t\\t\\\"bytes\\\": {\\n \\t\\t\\t\\t\\t\\\"sum\\\": {\\n \\t\\t\\t\\t\\t\\t\\\"field\\\": \\\"flow.packets\\\"\\n \\t\\t\\t\\t\\t}\\n \\t\\t\\t\\t}\\n \\t\\t\\t}\\n }\\n }\\n }\\n },\\n \\\"format\\\": {\\\"property\\\": \\\"aggregations.table.buckets\\\"},\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk1\\\", \\\"as\\\": \\\"stk1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk2\\\", \\\"as\\\": \\\"stk2\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.doc_count\\\", \\\"as\\\": \\\"size\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"nodes\\\",\\n \\\"source\\\": \\\"rawData\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"filter\\\",\\n \\\"expr\\\": \\\"!groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stk1+datum.stk2\\\", \\\"as\\\": \\\"key\\\"},\\n {\\\"type\\\": \\\"fold\\\", \\\"fields\\\": [\\\"stk1\\\", \\\"stk2\\\"], \\\"as\\\": [\\\"stack\\\", \\\"grpId\\\"]},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.stack == 'stk1' ? datum.stk1+datum.stk2 : datum.stk2+datum.stk1\\\",\\n \\\"as\\\": \\\"sortField\\\"\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"sortField\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"size\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"(datum.y0+datum.y1)/2\\\", \\\"as\\\": \\\"yc\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groups\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"aggregate\\\",\\n \\\"groupby\\\": [\\\"stack\\\", \\\"grpId\\\"],\\n \\\"fields\\\": [\\\"size\\\"],\\n \\\"ops\\\": [\\\"sum\\\"],\\n \\\"as\\\": [\\\"total\\\"]\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"grpId\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"total\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y0)\\\", \\\"as\\\": \\\"scaledY0\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y1)\\\", \\\"as\\\": \\\"scaledY1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\", \\\"as\\\": \\\"rightLabel\\\"},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.total/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n },\\n {\\n \\\"name\\\": \\\"destinationNodes\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk2'\\\"}]\\n },\\n {\\n \\\"name\\\": \\\"edges\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\"},\\n {\\n \\\"type\\\": \\\"lookup\\\",\\n \\\"from\\\": \\\"destinationNodes\\\",\\n \\\"key\\\": \\\"key\\\",\\n \\\"fields\\\": [\\\"key\\\"],\\n \\\"as\\\": [\\\"target\\\"]\\n },\\n {\\n \\\"type\\\": \\\"linkpath\\\",\\n \\\"orient\\\": \\\"horizontal\\\",\\n \\\"shape\\\": \\\"diagonal\\\",\\n \\\"sourceY\\\": {\\\"expr\\\": \\\"scale('y', datum.yc)\\\"},\\n \\\"sourceX\\\": {\\\"expr\\\": \\\"scale('x', 'stk1') + bandwidth('x')\\\"},\\n \\\"targetY\\\": {\\\"expr\\\": \\\"scale('y', datum.target.yc)\\\"},\\n \\\"targetX\\\": {\\\"expr\\\": \\\"scale('x', 'stk2')\\\"}\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"range('y')[0]-scale('y', datum.size)\\\",\\n \\\"as\\\": \\\"strokeWidth\\\"\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.size/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n }\\n ],\\n \\\"scales\\\": [\\n {\\n \\\"name\\\": \\\"x\\\",\\n \\\"type\\\": \\\"band\\\",\\n \\\"range\\\": \\\"width\\\",\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"],\\n \\\"paddingOuter\\\": 0.01,\\n \\\"paddingInner\\\": 0.98\\n },\\n {\\n \\\"name\\\": \\\"y\\\",\\n \\\"type\\\": \\\"linear\\\",\\n \\\"range\\\": \\\"height\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"nodes\\\", \\\"field\\\": \\\"y1\\\"}\\n },\\n {\\n \\\"name\\\": \\\"color\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": \\\"category\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"rawData\\\", \\\"fields\\\": [\\\"stk1\\\",\\\"stk2\\\"]}\\n },\\n {\\n \\\"name\\\": \\\"stackNames\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": [\\\"Source AS\\\", \\\"Dest AS\\\"],\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"]\\n }\\n ],\\n \\\"axes\\\": [\\n {\\n \\\"orient\\\": \\\"bottom\\\",\\n \\\"scale\\\": \\\"x\\\",\\n \\\"encode\\\": {\\n \\\"labels\\\": {\\n \\\"update\\\": {\\n \\\"text\\\": {\\\"scale\\\": \\\"stackNames\\\", \\\"field\\\": \\\"value\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14}\\n }\\n }\\n }\\n },\\n {\\n \\\"orient\\\": \\\"left\\\",\\n \\\"scale\\\": \\\"y\\\",\\n \\\"encode\\\": {\\\"labels\\\": {\\\"update\\\": {\\\"fontSize\\\": {\\\"value\\\": 12}}}}\\n }\\n ],\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"path\\\",\\n \\\"name\\\": \\\"edgeMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"edges\\\"},\\n \\\"clip\\\": true,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"stroke\\\": [\\n {\\n \\\"test\\\": \\\"groupSelector && groupSelector.stack=='stk1'\\\",\\n \\\"scale\\\": \\\"color\\\",\\n \\\"field\\\": \\\"stk2\\\"\\n },\\n {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"stk1\\\"}\\n ],\\n \\\"strokeWidth\\\": {\\\"field\\\": \\\"strokeWidth\\\"},\\n \\\"path\\\": {\\\"field\\\": \\\"path\\\"},\\n \\\"strokeOpacity\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.75 : 0.3\\\"\\n },\\n \\\"zindex\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\\\"\\n },\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"strokeOpacity\\\": {\\\"value\\\": 0.75}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"rect\\\",\\n \\\"name\\\": \\\"groupMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"fill\\\": {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"grpId\\\"},\\n \\\"width\\\": {\\\"scale\\\": \\\"x\\\", \\\"band\\\": 1}\\n },\\n \\\"update\\\": {\\n \\\"x\\\": {\\\"scale\\\": \\\"x\\\", \\\"field\\\": \\\"stack\\\"},\\n \\\"y\\\": {\\\"field\\\": \\\"scaledY0\\\"},\\n \\\"y2\\\": {\\\"field\\\": \\\"scaledY1\\\"},\\n \\\"fillOpacity\\\": {\\\"value\\\": 0.7},\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"fillOpacity\\\": {\\\"value\\\": 1}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"x\\\": {\\n \\\"signal\\\": \\\"scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\\\"\\n },\\n \\\"yc\\\": {\\\"signal\\\": \\\"(datum.scaledY0 + datum.scaledY1)/2\\\"},\\n \\\"align\\\": {\\\"signal\\\": \\\"datum.rightLabel ? 'left' : 'right'\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"fontWeight\\\": {\\\"value\\\": \\\"bold\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 12},\\n \\\"text\\\": {\\n \\\"signal\\\": \\\"abs(datum.scaledY0-datum.scaledY1) > 10 ? datum.grpId : ''\\\"\\n }\\n }\\n }\\n },\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"dataForShowAll\\\",\\n \\\"values\\\": [{}],\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"groupSelector\\\"}]\\n }\\n ],\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"signal\\\": \\\"width/2\\\"},\\n \\\"y\\\": {\\\"value\\\": 30},\\n \\\"width\\\": {\\\"value\\\": 100},\\n \\\"height\\\": {\\\"value\\\": 36}\\n }\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"name\\\": \\\"groupReset\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"dataForShowAll\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"cornerRadius\\\": {\\\"value\\\": 3.5},\\n \\\"fill\\\": {\\\"value\\\": \\\"#666666\\\"},\\n \\\"height\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}},\\n \\\"width\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}}\\n },\\n \\\"update\\\": {\\\"opacity\\\": {\\\"value\\\": 1}},\\n \\\"hover\\\": {\\\"fill\\\": {\\\"value\\\": \\\"#444444\\\"}}\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}, \\\"mult\\\": 0.5},\\n \\\"yc\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}, \\\"mult\\\": 0.5, \\\"offset\\\": 1},\\n \\\"align\\\": {\\\"value\\\": \\\"center\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"text\\\": {\\\"value\\\": \\\"Show All\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14},\\n \\\"stroke\\\": {\\\"value\\\": \\\"#ecf0f1\\\"}\\n }\\n }\\n }\\n ]\\n }\\n ]\\n }\\n ],\\n \\\"signals\\\": [\\n {\\n \\\"name\\\": \\\"groupHover\\\",\\n \\\"value\\\": {},\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:mouseover\\\",\\n \\\"update\\\": \\\"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\\"events\\\": \\\"mouseout\\\", \\\"update\\\": \\\"{}\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groupSelector\\\",\\n \\\"value\\\": false,\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:click!\\\",\\n \\\"update\\\": \\\"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\n \\\"events\\\": [\\n {\\\"type\\\": \\\"click\\\", \\\"markname\\\": \\\"groupReset\\\"},\\n {\\\"type\\\": \\\"dblclick\\\"}\\n ],\\n \\\"update\\\": \\\"false\\\"\\n }\\n ]\\n }\\n ]\\n}\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "AWFhGnANugC1WJLdzaom", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Logo", + "visState": "{\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"[![KOIOSSIAN](http://www.koiossian.com/public/elastiflow_logo.svg)](http://www.koiossian.com)\",\"openLinksInNewTab\":false,\"type\":\"markdown\"},\"title\":\"ElastiFlow: Logo\",\"type\":\"markdown\"}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":{\"match_all\":{}}},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "65ec5200-3374-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sankey Src/Dst (packets) - vega", + "visState": "{\"title\":\"ElastiFlow: Sankey Src/Dst (packets) - vega\",\"type\":\"vega\",\"params\":{\"spec\":\"{\\n \\\"$schema\\\": \\\"https://vega.github.io/schema/vega/v3.0.json\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"rawData\\\",\\n \\\"url\\\": {\\n \\\"%context%\\\": true,\\n \\\"%timefield%\\\": \\\"@timestamp\\\",\\n \\\"index\\\": \\\"elastiflow-*\\\",\\n \\\"body\\\": {\\n \\\"size\\\": 0,\\n \\\"aggs\\\": {\\n \\\"table\\\": {\\n \\\"composite\\\": {\\n \\\"size\\\": 1000,\\n \\\"sources\\\": [\\n {\\\"stk1\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.src_hostname\\\"}}},\\n {\\\"stk2\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.dst_hostname\\\"}}}\\n ]\\n },\\n \\t\\t\\t\\\"aggs\\\": {\\n \\t\\t\\t\\t\\\"bytes\\\": {\\n \\t\\t\\t\\t\\t\\\"sum\\\": {\\n \\t\\t\\t\\t\\t\\t\\\"field\\\": \\\"flow.packets\\\"\\n \\t\\t\\t\\t\\t}\\n \\t\\t\\t\\t}\\n \\t\\t\\t}\\n }\\n }\\n }\\n },\\n \\\"format\\\": {\\\"property\\\": \\\"aggregations.table.buckets\\\"},\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk1\\\", \\\"as\\\": \\\"stk1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk2\\\", \\\"as\\\": \\\"stk2\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.doc_count\\\", \\\"as\\\": \\\"size\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"nodes\\\",\\n \\\"source\\\": \\\"rawData\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"filter\\\",\\n \\\"expr\\\": \\\"!groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stk1+datum.stk2\\\", \\\"as\\\": \\\"key\\\"},\\n {\\\"type\\\": \\\"fold\\\", \\\"fields\\\": [\\\"stk1\\\", \\\"stk2\\\"], \\\"as\\\": [\\\"stack\\\", \\\"grpId\\\"]},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.stack == 'stk1' ? datum.stk1+datum.stk2 : datum.stk2+datum.stk1\\\",\\n \\\"as\\\": \\\"sortField\\\"\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"sortField\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"size\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"(datum.y0+datum.y1)/2\\\", \\\"as\\\": \\\"yc\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groups\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"aggregate\\\",\\n \\\"groupby\\\": [\\\"stack\\\", \\\"grpId\\\"],\\n \\\"fields\\\": [\\\"size\\\"],\\n \\\"ops\\\": [\\\"sum\\\"],\\n \\\"as\\\": [\\\"total\\\"]\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"grpId\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"total\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y0)\\\", \\\"as\\\": \\\"scaledY0\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y1)\\\", \\\"as\\\": \\\"scaledY1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\", \\\"as\\\": \\\"rightLabel\\\"},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.total/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n },\\n {\\n \\\"name\\\": \\\"destinationNodes\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk2'\\\"}]\\n },\\n {\\n \\\"name\\\": \\\"edges\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\"},\\n {\\n \\\"type\\\": \\\"lookup\\\",\\n \\\"from\\\": \\\"destinationNodes\\\",\\n \\\"key\\\": \\\"key\\\",\\n \\\"fields\\\": [\\\"key\\\"],\\n \\\"as\\\": [\\\"target\\\"]\\n },\\n {\\n \\\"type\\\": \\\"linkpath\\\",\\n \\\"orient\\\": \\\"horizontal\\\",\\n \\\"shape\\\": \\\"diagonal\\\",\\n \\\"sourceY\\\": {\\\"expr\\\": \\\"scale('y', datum.yc)\\\"},\\n \\\"sourceX\\\": {\\\"expr\\\": \\\"scale('x', 'stk1') + bandwidth('x')\\\"},\\n \\\"targetY\\\": {\\\"expr\\\": \\\"scale('y', datum.target.yc)\\\"},\\n \\\"targetX\\\": {\\\"expr\\\": \\\"scale('x', 'stk2')\\\"}\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"range('y')[0]-scale('y', datum.size)\\\",\\n \\\"as\\\": \\\"strokeWidth\\\"\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.size/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n }\\n ],\\n \\\"scales\\\": [\\n {\\n \\\"name\\\": \\\"x\\\",\\n \\\"type\\\": \\\"band\\\",\\n \\\"range\\\": \\\"width\\\",\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"],\\n \\\"paddingOuter\\\": 0.01,\\n \\\"paddingInner\\\": 0.98\\n },\\n {\\n \\\"name\\\": \\\"y\\\",\\n \\\"type\\\": \\\"linear\\\",\\n \\\"range\\\": \\\"height\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"nodes\\\", \\\"field\\\": \\\"y1\\\"}\\n },\\n {\\n \\\"name\\\": \\\"color\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": \\\"category\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"rawData\\\", \\\"fields\\\": [\\\"stk1\\\",\\\"stk2\\\"]}\\n },\\n {\\n \\\"name\\\": \\\"stackNames\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": [\\\"Source\\\", \\\"Dest\\\"],\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"]\\n }\\n ],\\n \\\"axes\\\": [\\n {\\n \\\"orient\\\": \\\"bottom\\\",\\n \\\"scale\\\": \\\"x\\\",\\n \\\"encode\\\": {\\n \\\"labels\\\": {\\n \\\"update\\\": {\\n \\\"text\\\": {\\\"scale\\\": \\\"stackNames\\\", \\\"field\\\": \\\"value\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14}\\n }\\n }\\n }\\n },\\n {\\n \\\"orient\\\": \\\"left\\\",\\n \\\"scale\\\": \\\"y\\\",\\n \\\"encode\\\": {\\\"labels\\\": {\\\"update\\\": {\\\"fontSize\\\": {\\\"value\\\": 12}}}}\\n }\\n ],\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"path\\\",\\n \\\"name\\\": \\\"edgeMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"edges\\\"},\\n \\\"clip\\\": true,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"stroke\\\": [\\n {\\n \\\"test\\\": \\\"groupSelector && groupSelector.stack=='stk1'\\\",\\n \\\"scale\\\": \\\"color\\\",\\n \\\"field\\\": \\\"stk2\\\"\\n },\\n {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"stk1\\\"}\\n ],\\n \\\"strokeWidth\\\": {\\\"field\\\": \\\"strokeWidth\\\"},\\n \\\"path\\\": {\\\"field\\\": \\\"path\\\"},\\n \\\"strokeOpacity\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.75 : 0.3\\\"\\n },\\n \\\"zindex\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\\\"\\n },\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"strokeOpacity\\\": {\\\"value\\\": 0.75}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"rect\\\",\\n \\\"name\\\": \\\"groupMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"fill\\\": {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"grpId\\\"},\\n \\\"width\\\": {\\\"scale\\\": \\\"x\\\", \\\"band\\\": 1}\\n },\\n \\\"update\\\": {\\n \\\"x\\\": {\\\"scale\\\": \\\"x\\\", \\\"field\\\": \\\"stack\\\"},\\n \\\"y\\\": {\\\"field\\\": \\\"scaledY0\\\"},\\n \\\"y2\\\": {\\\"field\\\": \\\"scaledY1\\\"},\\n \\\"fillOpacity\\\": {\\\"value\\\": 0.7},\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"fillOpacity\\\": {\\\"value\\\": 1}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"x\\\": {\\n \\\"signal\\\": \\\"scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\\\"\\n },\\n \\\"yc\\\": {\\\"signal\\\": \\\"(datum.scaledY0 + datum.scaledY1)/2\\\"},\\n \\\"align\\\": {\\\"signal\\\": \\\"datum.rightLabel ? 'left' : 'right'\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"fontWeight\\\": {\\\"value\\\": \\\"bold\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 12},\\n \\\"text\\\": {\\n \\\"signal\\\": \\\"abs(datum.scaledY0-datum.scaledY1) > 10 ? datum.grpId : ''\\\"\\n }\\n }\\n }\\n },\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"dataForShowAll\\\",\\n \\\"values\\\": [{}],\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"groupSelector\\\"}]\\n }\\n ],\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"signal\\\": \\\"width/2\\\"},\\n \\\"y\\\": {\\\"value\\\": 30},\\n \\\"width\\\": {\\\"value\\\": 100},\\n \\\"height\\\": {\\\"value\\\": 36}\\n }\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"name\\\": \\\"groupReset\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"dataForShowAll\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"cornerRadius\\\": {\\\"value\\\": 3.5},\\n \\\"fill\\\": {\\\"value\\\": \\\"#666666\\\"},\\n \\\"height\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}},\\n \\\"width\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}}\\n },\\n \\\"update\\\": {\\\"opacity\\\": {\\\"value\\\": 1}},\\n \\\"hover\\\": {\\\"fill\\\": {\\\"value\\\": \\\"#444444\\\"}}\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}, \\\"mult\\\": 0.5},\\n \\\"yc\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}, \\\"mult\\\": 0.5, \\\"offset\\\": 1},\\n \\\"align\\\": {\\\"value\\\": \\\"center\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"text\\\": {\\\"value\\\": \\\"Show All\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14},\\n \\\"stroke\\\": {\\\"value\\\": \\\"#ecf0f1\\\"}\\n }\\n }\\n }\\n ]\\n }\\n ]\\n }\\n ],\\n \\\"signals\\\": [\\n {\\n \\\"name\\\": \\\"groupHover\\\",\\n \\\"value\\\": {},\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:mouseover\\\",\\n \\\"update\\\": \\\"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\\"events\\\": \\\"mouseout\\\", \\\"update\\\": \\\"{}\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groupSelector\\\",\\n \\\"value\\\": false,\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:click!\\\",\\n \\\"update\\\": \\\"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\n \\\"events\\\": [\\n {\\\"type\\\": \\\"click\\\", \\\"markname\\\": \\\"groupReset\\\"},\\n {\\\"type\\\": \\\"dblclick\\\"}\\n ],\\n \\\"update\\\": \\\"false\\\"\\n }\\n ]\\n }\\n ]\\n}\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "54525bd0-3373-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sankey Client/Server (bytes) - vega", + "visState": "{\"title\":\"ElastiFlow: Sankey Client/Server (bytes) - vega\",\"type\":\"vega\",\"params\":{\"spec\":\"{\\n \\\"$schema\\\": \\\"https://vega.github.io/schema/vega/v3.0.json\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"rawData\\\",\\n \\\"url\\\": {\\n \\\"%context%\\\": true,\\n \\\"%timefield%\\\": \\\"@timestamp\\\",\\n \\\"index\\\": \\\"elastiflow-*\\\",\\n \\\"body\\\": {\\n \\\"size\\\": 0,\\n \\\"aggs\\\": {\\n \\\"table\\\": {\\n \\\"composite\\\": {\\n \\\"size\\\": 1000,\\n \\\"sources\\\": [\\n {\\\"stk1\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.client_hostname\\\"}}},\\n {\\\"stk2\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.server_hostname\\\"}}}\\n ]\\n },\\n \\t\\t\\t\\\"aggs\\\": {\\n \\t\\t\\t\\t\\\"bytes\\\": {\\n \\t\\t\\t\\t\\t\\\"sum\\\": {\\n \\t\\t\\t\\t\\t\\t\\\"field\\\": \\\"flow.bytes\\\"\\n \\t\\t\\t\\t\\t}\\n \\t\\t\\t\\t}\\n \\t\\t\\t}\\n }\\n }\\n }\\n },\\n \\\"format\\\": {\\\"property\\\": \\\"aggregations.table.buckets\\\"},\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk1\\\", \\\"as\\\": \\\"stk1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk2\\\", \\\"as\\\": \\\"stk2\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.doc_count\\\", \\\"as\\\": \\\"size\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"nodes\\\",\\n \\\"source\\\": \\\"rawData\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"filter\\\",\\n \\\"expr\\\": \\\"!groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stk1+datum.stk2\\\", \\\"as\\\": \\\"key\\\"},\\n {\\\"type\\\": \\\"fold\\\", \\\"fields\\\": [\\\"stk1\\\", \\\"stk2\\\"], \\\"as\\\": [\\\"stack\\\", \\\"grpId\\\"]},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.stack == 'stk1' ? datum.stk1+datum.stk2 : datum.stk2+datum.stk1\\\",\\n \\\"as\\\": \\\"sortField\\\"\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"sortField\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"size\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"(datum.y0+datum.y1)/2\\\", \\\"as\\\": \\\"yc\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groups\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"aggregate\\\",\\n \\\"groupby\\\": [\\\"stack\\\", \\\"grpId\\\"],\\n \\\"fields\\\": [\\\"size\\\"],\\n \\\"ops\\\": [\\\"sum\\\"],\\n \\\"as\\\": [\\\"total\\\"]\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"grpId\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"total\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y0)\\\", \\\"as\\\": \\\"scaledY0\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y1)\\\", \\\"as\\\": \\\"scaledY1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\", \\\"as\\\": \\\"rightLabel\\\"},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.total/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n },\\n {\\n \\\"name\\\": \\\"destinationNodes\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk2'\\\"}]\\n },\\n {\\n \\\"name\\\": \\\"edges\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\"},\\n {\\n \\\"type\\\": \\\"lookup\\\",\\n \\\"from\\\": \\\"destinationNodes\\\",\\n \\\"key\\\": \\\"key\\\",\\n \\\"fields\\\": [\\\"key\\\"],\\n \\\"as\\\": [\\\"target\\\"]\\n },\\n {\\n \\\"type\\\": \\\"linkpath\\\",\\n \\\"orient\\\": \\\"horizontal\\\",\\n \\\"shape\\\": \\\"diagonal\\\",\\n \\\"sourceY\\\": {\\\"expr\\\": \\\"scale('y', datum.yc)\\\"},\\n \\\"sourceX\\\": {\\\"expr\\\": \\\"scale('x', 'stk1') + bandwidth('x')\\\"},\\n \\\"targetY\\\": {\\\"expr\\\": \\\"scale('y', datum.target.yc)\\\"},\\n \\\"targetX\\\": {\\\"expr\\\": \\\"scale('x', 'stk2')\\\"}\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"range('y')[0]-scale('y', datum.size)\\\",\\n \\\"as\\\": \\\"strokeWidth\\\"\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.size/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n }\\n ],\\n \\\"scales\\\": [\\n {\\n \\\"name\\\": \\\"x\\\",\\n \\\"type\\\": \\\"band\\\",\\n \\\"range\\\": \\\"width\\\",\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"],\\n \\\"paddingOuter\\\": 0.01,\\n \\\"paddingInner\\\": 0.98\\n },\\n {\\n \\\"name\\\": \\\"y\\\",\\n \\\"type\\\": \\\"linear\\\",\\n \\\"range\\\": \\\"height\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"nodes\\\", \\\"field\\\": \\\"y1\\\"}\\n },\\n {\\n \\\"name\\\": \\\"color\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": \\\"category\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"rawData\\\", \\\"fields\\\": [\\\"stk1\\\",\\\"stk2\\\"]}\\n },\\n {\\n \\\"name\\\": \\\"stackNames\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": [\\\"Client\\\", \\\"Server\\\"],\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"]\\n }\\n ],\\n \\\"axes\\\": [\\n {\\n \\\"orient\\\": \\\"bottom\\\",\\n \\\"scale\\\": \\\"x\\\",\\n \\\"encode\\\": {\\n \\\"labels\\\": {\\n \\\"update\\\": {\\n \\\"text\\\": {\\\"scale\\\": \\\"stackNames\\\", \\\"field\\\": \\\"value\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14}\\n }\\n }\\n }\\n },\\n {\\n \\\"orient\\\": \\\"left\\\",\\n \\\"scale\\\": \\\"y\\\",\\n \\\"encode\\\": {\\\"labels\\\": {\\\"update\\\": {\\\"fontSize\\\": {\\\"value\\\": 12}}}}\\n }\\n ],\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"path\\\",\\n \\\"name\\\": \\\"edgeMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"edges\\\"},\\n \\\"clip\\\": true,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"stroke\\\": [\\n {\\n \\\"test\\\": \\\"groupSelector && groupSelector.stack=='stk1'\\\",\\n \\\"scale\\\": \\\"color\\\",\\n \\\"field\\\": \\\"stk2\\\"\\n },\\n {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"stk1\\\"}\\n ],\\n \\\"strokeWidth\\\": {\\\"field\\\": \\\"strokeWidth\\\"},\\n \\\"path\\\": {\\\"field\\\": \\\"path\\\"},\\n \\\"strokeOpacity\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.75 : 0.3\\\"\\n },\\n \\\"zindex\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\\\"\\n },\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"strokeOpacity\\\": {\\\"value\\\": 0.75}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"rect\\\",\\n \\\"name\\\": \\\"groupMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"fill\\\": {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"grpId\\\"},\\n \\\"width\\\": {\\\"scale\\\": \\\"x\\\", \\\"band\\\": 1}\\n },\\n \\\"update\\\": {\\n \\\"x\\\": {\\\"scale\\\": \\\"x\\\", \\\"field\\\": \\\"stack\\\"},\\n \\\"y\\\": {\\\"field\\\": \\\"scaledY0\\\"},\\n \\\"y2\\\": {\\\"field\\\": \\\"scaledY1\\\"},\\n \\\"fillOpacity\\\": {\\\"value\\\": 0.7},\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"fillOpacity\\\": {\\\"value\\\": 1}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"x\\\": {\\n \\\"signal\\\": \\\"scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\\\"\\n },\\n \\\"yc\\\": {\\\"signal\\\": \\\"(datum.scaledY0 + datum.scaledY1)/2\\\"},\\n \\\"align\\\": {\\\"signal\\\": \\\"datum.rightLabel ? 'left' : 'right'\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"fontWeight\\\": {\\\"value\\\": \\\"bold\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 12},\\n \\\"text\\\": {\\n \\\"signal\\\": \\\"abs(datum.scaledY0-datum.scaledY1) > 10 ? datum.grpId : ''\\\"\\n }\\n }\\n }\\n },\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"dataForShowAll\\\",\\n \\\"values\\\": [{}],\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"groupSelector\\\"}]\\n }\\n ],\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"signal\\\": \\\"width/2\\\"},\\n \\\"y\\\": {\\\"value\\\": 30},\\n \\\"width\\\": {\\\"value\\\": 100},\\n \\\"height\\\": {\\\"value\\\": 36}\\n }\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"name\\\": \\\"groupReset\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"dataForShowAll\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"cornerRadius\\\": {\\\"value\\\": 3.5},\\n \\\"fill\\\": {\\\"value\\\": \\\"#666666\\\"},\\n \\\"height\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}},\\n \\\"width\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}}\\n },\\n \\\"update\\\": {\\\"opacity\\\": {\\\"value\\\": 1}},\\n \\\"hover\\\": {\\\"fill\\\": {\\\"value\\\": \\\"#444444\\\"}}\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}, \\\"mult\\\": 0.5},\\n \\\"yc\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}, \\\"mult\\\": 0.5, \\\"offset\\\": 1},\\n \\\"align\\\": {\\\"value\\\": \\\"center\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"text\\\": {\\\"value\\\": \\\"Show All\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14},\\n \\\"stroke\\\": {\\\"value\\\": \\\"#ecf0f1\\\"}\\n }\\n }\\n }\\n ]\\n }\\n ]\\n }\\n ],\\n \\\"signals\\\": [\\n {\\n \\\"name\\\": \\\"groupHover\\\",\\n \\\"value\\\": {},\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:mouseover\\\",\\n \\\"update\\\": \\\"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\\"events\\\": \\\"mouseout\\\", \\\"update\\\": \\\"{}\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groupSelector\\\",\\n \\\"value\\\": false,\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:click!\\\",\\n \\\"update\\\": \\\"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\n \\\"events\\\": [\\n {\\\"type\\\": \\\"click\\\", \\\"markname\\\": \\\"groupReset\\\"},\\n {\\\"type\\\": \\\"dblclick\\\"}\\n ],\\n \\\"update\\\": \\\"false\\\"\\n }\\n ]\\n }\\n ]\\n}\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "8dc8f0d0-3374-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sankey Src/Dst (bytes) - vega", + "visState": "{\"title\":\"ElastiFlow: Sankey Src/Dst (bytes) - vega\",\"type\":\"vega\",\"params\":{\"spec\":\"{\\n \\\"$schema\\\": \\\"https://vega.github.io/schema/vega/v3.0.json\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"rawData\\\",\\n \\\"url\\\": {\\n \\\"%context%\\\": true,\\n \\\"%timefield%\\\": \\\"@timestamp\\\",\\n \\\"index\\\": \\\"elastiflow-*\\\",\\n \\\"body\\\": {\\n \\\"size\\\": 0,\\n \\\"aggs\\\": {\\n \\\"table\\\": {\\n \\\"composite\\\": {\\n \\\"size\\\": 1000,\\n \\\"sources\\\": [\\n {\\\"stk1\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.src_hostname\\\"}}},\\n {\\\"stk2\\\": {\\\"terms\\\": {\\\"field\\\": \\\"flow.dst_hostname\\\"}}}\\n ]\\n },\\n \\t\\t\\t\\\"aggs\\\": {\\n \\t\\t\\t\\t\\\"bytes\\\": {\\n \\t\\t\\t\\t\\t\\\"sum\\\": {\\n \\t\\t\\t\\t\\t\\t\\\"field\\\": \\\"flow.bytes\\\"\\n \\t\\t\\t\\t\\t}\\n \\t\\t\\t\\t}\\n \\t\\t\\t}\\n }\\n }\\n }\\n },\\n \\\"format\\\": {\\\"property\\\": \\\"aggregations.table.buckets\\\"},\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk1\\\", \\\"as\\\": \\\"stk1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.key.stk2\\\", \\\"as\\\": \\\"stk2\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.doc_count\\\", \\\"as\\\": \\\"size\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"nodes\\\",\\n \\\"source\\\": \\\"rawData\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"filter\\\",\\n \\\"expr\\\": \\\"!groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stk1+datum.stk2\\\", \\\"as\\\": \\\"key\\\"},\\n {\\\"type\\\": \\\"fold\\\", \\\"fields\\\": [\\\"stk1\\\", \\\"stk2\\\"], \\\"as\\\": [\\\"stack\\\", \\\"grpId\\\"]},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.stack == 'stk1' ? datum.stk1+datum.stk2 : datum.stk2+datum.stk1\\\",\\n \\\"as\\\": \\\"sortField\\\"\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"sortField\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"size\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"(datum.y0+datum.y1)/2\\\", \\\"as\\\": \\\"yc\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groups\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\n \\\"type\\\": \\\"aggregate\\\",\\n \\\"groupby\\\": [\\\"stack\\\", \\\"grpId\\\"],\\n \\\"fields\\\": [\\\"size\\\"],\\n \\\"ops\\\": [\\\"sum\\\"],\\n \\\"as\\\": [\\\"total\\\"]\\n },\\n {\\n \\\"type\\\": \\\"stack\\\",\\n \\\"groupby\\\": [\\\"stack\\\"],\\n \\\"sort\\\": {\\\"field\\\": \\\"grpId\\\", \\\"order\\\": \\\"descending\\\"},\\n \\\"field\\\": \\\"total\\\"\\n },\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y0)\\\", \\\"as\\\": \\\"scaledY0\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"scale('y', datum.y1)\\\", \\\"as\\\": \\\"scaledY1\\\"},\\n {\\\"type\\\": \\\"formula\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\", \\\"as\\\": \\\"rightLabel\\\"},\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.total/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n },\\n {\\n \\\"name\\\": \\\"destinationNodes\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk2'\\\"}]\\n },\\n {\\n \\\"name\\\": \\\"edges\\\",\\n \\\"source\\\": \\\"nodes\\\",\\n \\\"transform\\\": [\\n {\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"datum.stack == 'stk1'\\\"},\\n {\\n \\\"type\\\": \\\"lookup\\\",\\n \\\"from\\\": \\\"destinationNodes\\\",\\n \\\"key\\\": \\\"key\\\",\\n \\\"fields\\\": [\\\"key\\\"],\\n \\\"as\\\": [\\\"target\\\"]\\n },\\n {\\n \\\"type\\\": \\\"linkpath\\\",\\n \\\"orient\\\": \\\"horizontal\\\",\\n \\\"shape\\\": \\\"diagonal\\\",\\n \\\"sourceY\\\": {\\\"expr\\\": \\\"scale('y', datum.yc)\\\"},\\n \\\"sourceX\\\": {\\\"expr\\\": \\\"scale('x', 'stk1') + bandwidth('x')\\\"},\\n \\\"targetY\\\": {\\\"expr\\\": \\\"scale('y', datum.target.yc)\\\"},\\n \\\"targetX\\\": {\\\"expr\\\": \\\"scale('x', 'stk2')\\\"}\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"range('y')[0]-scale('y', datum.size)\\\",\\n \\\"as\\\": \\\"strokeWidth\\\"\\n },\\n {\\n \\\"type\\\": \\\"formula\\\",\\n \\\"expr\\\": \\\"datum.size/domain('y')[1]\\\",\\n \\\"as\\\": \\\"percentage\\\"\\n }\\n ]\\n }\\n ],\\n \\\"scales\\\": [\\n {\\n \\\"name\\\": \\\"x\\\",\\n \\\"type\\\": \\\"band\\\",\\n \\\"range\\\": \\\"width\\\",\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"],\\n \\\"paddingOuter\\\": 0.01,\\n \\\"paddingInner\\\": 0.98\\n },\\n {\\n \\\"name\\\": \\\"y\\\",\\n \\\"type\\\": \\\"linear\\\",\\n \\\"range\\\": \\\"height\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"nodes\\\", \\\"field\\\": \\\"y1\\\"}\\n },\\n {\\n \\\"name\\\": \\\"color\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": \\\"category\\\",\\n \\\"domain\\\": {\\\"data\\\": \\\"rawData\\\", \\\"fields\\\": [\\\"stk1\\\",\\\"stk2\\\"]}\\n },\\n {\\n \\\"name\\\": \\\"stackNames\\\",\\n \\\"type\\\": \\\"ordinal\\\",\\n \\\"range\\\": [\\\"Source\\\", \\\"Dest\\\"],\\n \\\"domain\\\": [\\\"stk1\\\", \\\"stk2\\\"]\\n }\\n ],\\n \\\"axes\\\": [\\n {\\n \\\"orient\\\": \\\"bottom\\\",\\n \\\"scale\\\": \\\"x\\\",\\n \\\"encode\\\": {\\n \\\"labels\\\": {\\n \\\"update\\\": {\\n \\\"text\\\": {\\\"scale\\\": \\\"stackNames\\\", \\\"field\\\": \\\"value\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14}\\n }\\n }\\n }\\n },\\n {\\n \\\"orient\\\": \\\"left\\\",\\n \\\"scale\\\": \\\"y\\\",\\n \\\"encode\\\": {\\\"labels\\\": {\\\"update\\\": {\\\"fontSize\\\": {\\\"value\\\": 12}}}}\\n }\\n ],\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"path\\\",\\n \\\"name\\\": \\\"edgeMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"edges\\\"},\\n \\\"clip\\\": true,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"stroke\\\": [\\n {\\n \\\"test\\\": \\\"groupSelector && groupSelector.stack=='stk1'\\\",\\n \\\"scale\\\": \\\"color\\\",\\n \\\"field\\\": \\\"stk2\\\"\\n },\\n {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"stk1\\\"}\\n ],\\n \\\"strokeWidth\\\": {\\\"field\\\": \\\"strokeWidth\\\"},\\n \\\"path\\\": {\\\"field\\\": \\\"path\\\"},\\n \\\"strokeOpacity\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.75 : 0.3\\\"\\n },\\n \\\"zindex\\\": {\\n \\\"signal\\\": \\\"!groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\\\"\\n },\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"strokeOpacity\\\": {\\\"value\\\": 0.75}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"rect\\\",\\n \\\"name\\\": \\\"groupMark\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"fill\\\": {\\\"scale\\\": \\\"color\\\", \\\"field\\\": \\\"grpId\\\"},\\n \\\"width\\\": {\\\"scale\\\": \\\"x\\\", \\\"band\\\": 1}\\n },\\n \\\"update\\\": {\\n \\\"x\\\": {\\\"scale\\\": \\\"x\\\", \\\"field\\\": \\\"stack\\\"},\\n \\\"y\\\": {\\\"field\\\": \\\"scaledY0\\\"},\\n \\\"y2\\\": {\\\"field\\\": \\\"scaledY1\\\"},\\n \\\"fillOpacity\\\": {\\\"value\\\": 0.7},\\n \\\"tooltip\\\": {\\n \\\"signal\\\": \\\"datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\\\"\\n }\\n },\\n \\\"hover\\\": {\\\"fillOpacity\\\": {\\\"value\\\": 1}}\\n }\\n },\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"groups\\\"},\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"update\\\": {\\n \\\"x\\\": {\\n \\\"signal\\\": \\\"scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\\\"\\n },\\n \\\"yc\\\": {\\\"signal\\\": \\\"(datum.scaledY0 + datum.scaledY1)/2\\\"},\\n \\\"align\\\": {\\\"signal\\\": \\\"datum.rightLabel ? 'left' : 'right'\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"fontWeight\\\": {\\\"value\\\": \\\"bold\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 12},\\n \\\"text\\\": {\\n \\\"signal\\\": \\\"abs(datum.scaledY0-datum.scaledY1) > 10 ? datum.grpId : ''\\\"\\n }\\n }\\n }\\n },\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"data\\\": [\\n {\\n \\\"name\\\": \\\"dataForShowAll\\\",\\n \\\"values\\\": [{}],\\n \\\"transform\\\": [{\\\"type\\\": \\\"filter\\\", \\\"expr\\\": \\\"groupSelector\\\"}]\\n }\\n ],\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"signal\\\": \\\"width/2\\\"},\\n \\\"y\\\": {\\\"value\\\": 30},\\n \\\"width\\\": {\\\"value\\\": 100},\\n \\\"height\\\": {\\\"value\\\": 36}\\n }\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"group\\\",\\n \\\"name\\\": \\\"groupReset\\\",\\n \\\"from\\\": {\\\"data\\\": \\\"dataForShowAll\\\"},\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"cornerRadius\\\": {\\\"value\\\": 3.5},\\n \\\"fill\\\": {\\\"value\\\": \\\"#666666\\\"},\\n \\\"height\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}},\\n \\\"width\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}}\\n },\\n \\\"update\\\": {\\\"opacity\\\": {\\\"value\\\": 1}},\\n \\\"hover\\\": {\\\"fill\\\": {\\\"value\\\": \\\"#444444\\\"}}\\n },\\n \\\"marks\\\": [\\n {\\n \\\"type\\\": \\\"text\\\",\\n \\\"interactive\\\": false,\\n \\\"encode\\\": {\\n \\\"enter\\\": {\\n \\\"xc\\\": {\\\"field\\\": {\\\"group\\\": \\\"width\\\"}, \\\"mult\\\": 0.5},\\n \\\"yc\\\": {\\\"field\\\": {\\\"group\\\": \\\"height\\\"}, \\\"mult\\\": 0.5, \\\"offset\\\": 1},\\n \\\"align\\\": {\\\"value\\\": \\\"center\\\"},\\n \\\"baseline\\\": {\\\"value\\\": \\\"middle\\\"},\\n \\\"text\\\": {\\\"value\\\": \\\"Show All\\\"},\\n \\\"fontSize\\\": {\\\"value\\\": 14},\\n \\\"stroke\\\": {\\\"value\\\": \\\"#ecf0f1\\\"}\\n }\\n }\\n }\\n ]\\n }\\n ]\\n }\\n ],\\n \\\"signals\\\": [\\n {\\n \\\"name\\\": \\\"groupHover\\\",\\n \\\"value\\\": {},\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:mouseover\\\",\\n \\\"update\\\": \\\"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\\"events\\\": \\\"mouseout\\\", \\\"update\\\": \\\"{}\\\"}\\n ]\\n },\\n {\\n \\\"name\\\": \\\"groupSelector\\\",\\n \\\"value\\\": false,\\n \\\"on\\\": [\\n {\\n \\\"events\\\": \\\"@groupMark:click!\\\",\\n \\\"update\\\": \\\"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\\\"\\n },\\n {\\n \\\"events\\\": [\\n {\\\"type\\\": \\\"click\\\", \\\"markname\\\": \\\"groupReset\\\"},\\n {\\\"type\\\": \\\"dblclick\\\"}\\n ],\\n \\\"update\\\": \\\"false\\\"\\n }\\n ]\\n }\\n ]\\n}\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "f3c9cc60-33b0-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: ZFlow - Users (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: ZFlow - Users (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bit Rate\",\"terms_field\":\"ipfix.userName\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"axis_scale\":\"normal\",\"filter\":\"_exists_: ipfix.ziften_agent_guid\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "4ba1be70-33b1-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: ZFlow - input list", + "visState": "{\"title\":\"ElastiFlow: ZFlow - input list\",\"type\":\"input_control_vis\",\"params\":{\"controls\":[{\"id\":\"1526107541713\",\"fieldName\":\"ipfix.ziften_hostname\",\"label\":\"Host\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":500,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1526107640219\",\"fieldName\":\"ipfix.userName\",\"label\":\"User\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":5000,\"order\":\"desc\"},\"parent\":\"1526107541713\",\"indexPatternRefName\":\"control_1_index_pattern\"},{\"id\":\"1526108883717\",\"fieldName\":\"flow.application\",\"label\":\"Command\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":5000,\"order\":\"desc\"},\"parent\":\"1526107541713\",\"indexPatternRefName\":\"control_2_index_pattern\"},{\"id\":\"1526108909005\",\"fieldName\":\"flow.service_name\",\"label\":\"Service\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":false,\"size\":1000,\"order\":\"desc\"},\"parent\":\"1526107541713\",\"indexPatternRefName\":\"control_3_index_pattern\"}],\"updateFiltersOnChange\":true,\"useTimeFilter\":true,\"pinFilters\":true},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "control_0_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_1_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_2_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "control_3_index_pattern", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "7ef9bfb0-55d2-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sources (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Sources (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.src_hostname\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "beb869d0-55d2-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Services (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Services (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.service_name\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "e71599c0-5613-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Client Autonomous Systems (pkts/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Client Autonomous Systems (pkts/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"},{\"script\":\"params.packets / (params._interval / 1000)\",\"id\":\"0c862c80-5612-11e8-9c03-ebe615bd9c32\",\"type\":\"calculation\",\"variables\":[{\"id\":\"142047a0-5612-11e8-9c03-ebe615bd9c32\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"packets\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.client_autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}pkts/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.client_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "ce773100-55cb-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Applications (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Applications (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.application\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "11a64c90-33b1-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: ZFlow - Platforms (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: ZFlow - Platforms (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bit Rate\",\"terms_field\":\"ipfix.ziften_platform\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"axis_scale\":\"normal\",\"filter\":\"_exists_: ipfix.ziften_agent_guid\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "25b5bdb0-55d6-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Egress Interfaces (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Egress Interfaces (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.output_snmp\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "d3271c20-55d9-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Cities (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Cities (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.city\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "5e5bf210-55d1-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Types of Service (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Types of Service (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.tos\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "8e644b60-55d6-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Ingress Interfaces (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Ingress Interfaces (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.input_snmp\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "c060cd30-55d3-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Version (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: IP Version (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.ip_version\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "2d872430-55d0-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Autonomous Systems (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Source Autonomous Systems (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.src_autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"NOT flow.src_autonomous_system: private\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "da14d960-55d3-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Version (flow records) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: IP Version (flow records) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Flow Records\",\"terms_field\":\"flow.ip_version\",\"terms_size\":\"100\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "7884d160-55d7-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Ports (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Destination Ports (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.dst_port_name\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "05aa2550-55d2-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Traffic Locality (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Traffic Locality (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.traffic_locality\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "dccd45d0-55d7-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destinations (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Destinations (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.dst_hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "5ece5010-3345-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Reputations (flows) - TSVB (stacked bar)", + "visState": "{\"title\":\"ElastiFlow: IP Reputations (flows) - TSVB (stacked bar)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\",\"field\":\"flow.rep_tags\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"bar\",\"line_width\":\"0\",\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bit Rate\",\"terms_field\":\"flow.rep_tags\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"axis_scale\":\"normal\",\"filter\":\"_exists_: flow.rep_tags\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "4023c4b0-55ce-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Autonomous Systems (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Autonomous Systems (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.autonomous_system\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "70733c50-55d7-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Ports (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Destination Ports (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.dst_port_name\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "f4939a80-55d1-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Traffic Locality (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Traffic Locality (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.traffic_locality\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "01eab6e0-55d3-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Servers (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Servers (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"flow.server_hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "88535d00-336c-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Flows (client/server)", + "visState": "{\"title\":\"ElastiFlow: NAV: Flows (client/server)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[**Client/Server**](#/dashboard/d7124e80-5625-11e8-b711-83a5f93b17f3) | [Src/Dst](#/dashboard/4b86b4c0-5628-11e8-b711-83a5f93b17f3) | [AS](#/dashboard/757d59f0-5628-11e8-b711-83a5f93b17f3)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "75a2aa30-336c-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Flows (src/dst)", + "visState": "{\"title\":\"ElastiFlow: NAV: Flows (src/dst)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Client/Server](#/dashboard/d7124e80-5625-11e8-b711-83a5f93b17f3) | [**Src/Dst**](#/dashboard/4b86b4c0-5628-11e8-b711-83a5f93b17f3) | [AS](#/dashboard/757d59f0-5628-11e8-b711-83a5f93b17f3)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "c0e6b360-336c-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Geo IP (client/server)", + "visState": "{\"title\":\"ElastiFlow: NAV: Geo IP (client/server)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[**Client/Server**](#/dashboard/a932b600-2fd2-11e7-99ed-49759aed30f5) | [Src/Dst](#/dashboard/AWFhE8NZugC1WJLdzYri)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "279aff10-336a-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Threats", + "visState": "{\"title\":\"ElastiFlow: NAV: Threats\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Overview](#/dashboard/653cf1e0-2fd2-11e7-99ed-49759aed30f5) | [Top-N](#/dashboard/AWFgr4DaugC1WJLdy9iE) | [**Threats**](#/dashboard/8e383000-3309-11e9-aec0-c1d93190f676) | [Flows](#/dashboard/d7124e80-5625-11e8-b711-83a5f93b17f3) | [Geo IP](#/dashboard/a932b600-2fd2-11e7-99ed-49759aed30f5) | [AS Traffic](#/dashboard/d7e31d40-6589-11e7-bfc3-d74b7bb89482) | [Exporters](#/dashboard/04157d70-6591-11e7-bfc3-d74b7bb89482) | [Traffic Details](#/dashboard/10584050-6234-11e7-8236-19b4b4941e22) | [Flow Records](#/dashboard/ca480720-2fdf-11e7-9d02-3f49bde5c1d5)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "4bdddfe0-336b-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Traffic Details", + "visState": "{\"title\":\"ElastiFlow: NAV: Traffic Details\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Overview](#/dashboard/653cf1e0-2fd2-11e7-99ed-49759aed30f5) | [Top-N](#/dashboard/AWFgr4DaugC1WJLdy9iE) | [Threats](#/dashboard/8e383000-3309-11e9-aec0-c1d93190f676) | [Flows](#/dashboard/d7124e80-5625-11e8-b711-83a5f93b17f3) | [Geo IP](#/dashboard/a932b600-2fd2-11e7-99ed-49759aed30f5) | [AS Traffic](#/dashboard/d7e31d40-6589-11e7-bfc3-d74b7bb89482) | [Exporters](#/dashboard/04157d70-6591-11e7-bfc3-d74b7bb89482) | [**Traffic Details**](#/dashboard/10584050-6234-11e7-8236-19b4b4941e22) | [Flow Records](#/dashboard/ca480720-2fdf-11e7-9d02-3f49bde5c1d5)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "f16133a0-336a-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Geo IP", + "visState": "{\"title\":\"ElastiFlow: NAV: Geo IP\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Overview](#/dashboard/653cf1e0-2fd2-11e7-99ed-49759aed30f5) | [Top-N](#/dashboard/AWFgr4DaugC1WJLdy9iE) | [Threats](#/dashboard/8e383000-3309-11e9-aec0-c1d93190f676) | [Flows](#/dashboard/d7124e80-5625-11e8-b711-83a5f93b17f3) | [**Geo IP**](#/dashboard/a932b600-2fd2-11e7-99ed-49759aed30f5) | [AS Traffic](#/dashboard/d7e31d40-6589-11e7-bfc3-d74b7bb89482) | [Exporters](#/dashboard/04157d70-6591-11e7-bfc3-d74b7bb89482) | [Traffic Details](#/dashboard/10584050-6234-11e7-8236-19b4b4941e22) | [Flow Records](#/dashboard/ca480720-2fdf-11e7-9d02-3f49bde5c1d5)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "e0216400-336c-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Flow Records (src/dst)", + "visState": "{\"title\":\"ElastiFlow: NAV: Flow Records (src/dst)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Client/Server](#/dashboard/ca480720-2fdf-11e7-9d02-3f49bde5c1d5) | [**Src/Dst**](#/dashboard/58858cb0-55e1-11e8-b711-83a5f93b17f3)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "dc7a8e00-336a-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Flow Records", + "visState": "{\"title\":\"ElastiFlow: NAV: Flow Records\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Overview](#/dashboard/653cf1e0-2fd2-11e7-99ed-49759aed30f5) | [Top-N](#/dashboard/AWFgr4DaugC1WJLdy9iE) | [Threats](#/dashboard/8e383000-3309-11e9-aec0-c1d93190f676) | [Flows](#/dashboard/d7124e80-5625-11e8-b711-83a5f93b17f3) | [Geo IP](#/dashboard/a932b600-2fd2-11e7-99ed-49759aed30f5) | [AS Traffic](#/dashboard/d7e31d40-6589-11e7-bfc3-d74b7bb89482) | [Exporters](#/dashboard/04157d70-6591-11e7-bfc3-d74b7bb89482) | [Traffic Details](#/dashboard/10584050-6234-11e7-8236-19b4b4941e22) | [**Flow Records**](#/dashboard/ca480720-2fdf-11e7-9d02-3f49bde5c1d5)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "1094b850-336b-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Flows", + "visState": "{\"title\":\"ElastiFlow: NAV: Flows\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Overview](#/dashboard/653cf1e0-2fd2-11e7-99ed-49759aed30f5) | [Top-N](#/dashboard/AWFgr4DaugC1WJLdy9iE) | [Threats](#/dashboard/8e383000-3309-11e9-aec0-c1d93190f676) | [**Flows**](#/dashboard/d7124e80-5625-11e8-b711-83a5f93b17f3) | [Geo IP](#/dashboard/a932b600-2fd2-11e7-99ed-49759aed30f5) | [AS Traffic](#/dashboard/d7e31d40-6589-11e7-bfc3-d74b7bb89482) | [Exporters](#/dashboard/04157d70-6591-11e7-bfc3-d74b7bb89482) | [Traffic Details](#/dashboard/10584050-6234-11e7-8236-19b4b4941e22) | [Flow Records](#/dashboard/ca480720-2fdf-11e7-9d02-3f49bde5c1d5)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "c7534460-55d8-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Exporters (bytes) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Flow Exporters (bytes) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Bytes\",\"terms_field\":\"node.hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "39a495d0-55d6-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Egress Interfaces (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Egress Interfaces (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.output_snmp\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "deb4d510-55d8-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Exporters (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Flow Exporters (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"node.hostname\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "cdb8b440-55d1-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Traffic Locality (packets) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Traffic Locality (packets) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.packets\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.traffic_locality\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}} packets\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "28ddcaf0-55d1-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Types of Service (bits/s) - TSVB (stacked area)", + "visState": "{\"title\":\"ElastiFlow: Types of Service (bits/s) - TSVB (stacked area)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"rgba(144,201,227,1)\",\"split_mode\":\"terms\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"sum\",\"field\":\"flow.bytes\"},{\"script\":\"(params.bytes * 8) / (params._interval / 1000)\",\"id\":\"708a47c0-55cc-11e8-a850-cf92cd717894\",\"type\":\"calculation\",\"variables\":[{\"id\":\"74efc4c0-55cc-11e8-a850-cf92cd717894\",\"field\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"name\":\"bytes\"}]}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"bytes\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":\"0\",\"fill\":\"0.6\",\"stacked\":\"stacked\",\"split_color_mode\":\"rainbow\",\"label\":\"Packets\",\"terms_field\":\"flow.tos\",\"terms_size\":\"100\",\"terms_order_by\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"value_template\":\"{{value}}its/s\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\">=1m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":1,\"axis_min\":\"0\",\"filter\":\"\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "a44cb030-336a-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Autonomous Systems", + "visState": "{\"title\":\"ElastiFlow: NAV: Autonomous Systems\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Overview](#/dashboard/653cf1e0-2fd2-11e7-99ed-49759aed30f5) | [Top-N](#/dashboard/AWFgr4DaugC1WJLdy9iE) | [Threats](#/dashboard/8e383000-3309-11e9-aec0-c1d93190f676) | [Flows](#/dashboard/d7124e80-5625-11e8-b711-83a5f93b17f3) | [Geo IP](#/dashboard/a932b600-2fd2-11e7-99ed-49759aed30f5) | [**AS Traffic**](#/dashboard/d7e31d40-6589-11e7-bfc3-d74b7bb89482) | [Exporters](#/dashboard/04157d70-6591-11e7-bfc3-d74b7bb89482) | [Traffic Details](#/dashboard/10584050-6234-11e7-8236-19b4b4941e22) | [Flow Records](#/dashboard/ca480720-2fdf-11e7-9d02-3f49bde5c1d5)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "c2506770-336a-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Exporters", + "visState": "{\"title\":\"ElastiFlow: NAV: Exporters\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Overview](#/dashboard/653cf1e0-2fd2-11e7-99ed-49759aed30f5) | [Top-N](#/dashboard/AWFgr4DaugC1WJLdy9iE) | [Threats](#/dashboard/8e383000-3309-11e9-aec0-c1d93190f676) | [Flows](#/dashboard/d7124e80-5625-11e8-b711-83a5f93b17f3) | [Geo IP](#/dashboard/a932b600-2fd2-11e7-99ed-49759aed30f5) | [AS Traffic](#/dashboard/d7e31d40-6589-11e7-bfc3-d74b7bb89482) | [**Exporters**](#/dashboard/04157d70-6591-11e7-bfc3-d74b7bb89482) | [Traffic Details](#/dashboard/10584050-6234-11e7-8236-19b4b4941e22) | [Flow Records](#/dashboard/ca480720-2fdf-11e7-9d02-3f49bde5c1d5)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "f06e8450-336c-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Flow Records (client/server)", + "visState": "{\"title\":\"ElastiFlow: NAV: Flow Records (client/server)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[**Client/Server**](#/dashboard/ca480720-2fdf-11e7-9d02-3f49bde5c1d5) | [Src/Dst](#/dashboard/58858cb0-55e1-11e8-b711-83a5f93b17f3)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "9b135210-336c-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Flows (AS)", + "visState": "{\"title\":\"ElastiFlow: NAV: Flows (AS)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Client/Server](#/dashboard/d7124e80-5625-11e8-b711-83a5f93b17f3) | [Src/Dst](#/dashboard/4b86b4c0-5628-11e8-b711-83a5f93b17f3) | [**AS**](#/dashboard/757d59f0-5628-11e8-b711-83a5f93b17f3)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "30ff5d70-336b-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Top-N", + "visState": "{\"title\":\"ElastiFlow: NAV: Top-N\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Overview](#/dashboard/653cf1e0-2fd2-11e7-99ed-49759aed30f5) | [**Top-N**](#/dashboard/AWFgr4DaugC1WJLdy9iE) | [Threats](#/dashboard/8e383000-3309-11e9-aec0-c1d93190f676) | [Flows](#/dashboard/d7124e80-5625-11e8-b711-83a5f93b17f3) | [Geo IP](#/dashboard/a932b600-2fd2-11e7-99ed-49759aed30f5) | [AS Traffic](#/dashboard/d7e31d40-6589-11e7-bfc3-d74b7bb89482) | [Exporters](#/dashboard/04157d70-6591-11e7-bfc3-d74b7bb89482) | [Traffic Details](#/dashboard/10584050-6234-11e7-8236-19b4b4941e22) | [Flow Records](#/dashboard/ca480720-2fdf-11e7-9d02-3f49bde5c1d5)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "1d9c7c30-336c-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Top-N (talkers)", + "visState": "{\"title\":\"ElastiFlow: NAV: Top-N (talkers)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[**Talkers**](#/dashboard/AWFgr4DaugC1WJLdy9iE) | [Services](#/dashboard/0809c1f0-6719-11e7-b5b8-29fbded8e37c)\\n | [Conversations](#/dashboard/AWFgw02HugC1WJLdzCFZ) | [Apps](#/dashboard/44d6d8c0-560b-11e8-b711-83a5f93b17f3)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "fadebf50-336b-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Traffic Details (attributes)", + "visState": "{\"title\":\"ElastiFlow: NAV: Traffic Details (attributes)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Types](#/dashboard/10584050-6234-11e7-8236-19b4b4941e22)\\n | [**Attributes**](#/dashboard/64c19720-5619-11e8-b711-83a5f93b17f3) | [Locality](#/dashboard/95ccacb0-5619-11e8-b711-83a5f93b17f3)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "8500a670-6579-11e7-8471-e5432f50acbd", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Port Count", + "visState": "{\"title\":\"ElastiFlow: Destination Port Count\",\"type\":\"metric\",\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"32\",\"handleNoResults\":true,\"type\":\"metric\",\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":36,\"labelColor\":false,\"subText\":\"\"},\"useRange\":false,\"metricColorMode\":\"None\"}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.dst_port_name\",\"customLabel\":\"Destination Ports\"}}]}", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "9f113d80-6719-11e7-b5b8-29fbded8e37c", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Top Destinations - table", + "visState": "{\"title\":\"ElastiFlow: Top Destinations - table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":true,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.dst_hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":499,\"order\":\"desc\",\"orderBy\":\"2\",\"customLabel\":\"Destination\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "b13956f0-657a-11e7-8471-e5432f50acbd", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: VLAN Count", + "visState": "{\"title\":\"ElastiFlow: VLAN Count\",\"type\":\"metric\",\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"32\",\"handleNoResults\":true,\"type\":\"metric\",\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":36,\"labelColor\":false,\"subText\":\"\"},\"useRange\":false,\"metricColorMode\":\"None\"}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.vlan\",\"customLabel\":\"VLANs\"}}]}", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "ef7699a0-6719-11e7-b5b8-29fbded8e37c", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Top Destination Ports - table", + "visState": "{\"title\":\"ElastiFlow: Top Destination Ports - table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":true,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.dst_port_name\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":499,\"order\":\"desc\",\"orderBy\":\"2\",\"customLabel\":\"Destination\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "b577fd40-55c8-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Protocols (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: IP Protocols (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.ip_protocol\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"IP Protocol\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "4c2019f0-55f9-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Reputations (flow records) - tag cloud", + "visState": "{\"title\":\"ElastiFlow: IP Reputations (flow records) - tag cloud\",\"type\":\"tagcloud\",\"params\":{\"scale\":\"linear\",\"orientation\":\"single\",\"minFontSize\":16,\"maxFontSize\":48,\"showLabel\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.rep_tags\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":30,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"IP Reputation\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "4b025da0-55e8-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: TCP Flags (flow records) - tag cloud", + "visState": "{\"title\":\"ElastiFlow: TCP Flags (flow records) - tag cloud\",\"type\":\"tagcloud\",\"params\":{\"scale\":\"linear\",\"orientation\":\"single\",\"minFontSize\":16,\"maxFontSize\":48,\"showLabel\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.tcp_flags\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"TCP Flag\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "e79ec4d0-336b-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Traffic Details (locality)", + "visState": "{\"title\":\"ElastiFlow: NAV: Traffic Details (locality)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Types](#/dashboard/10584050-6234-11e7-8236-19b4b4941e22)\\n | [Attributes](#/dashboard/64c19720-5619-11e8-b711-83a5f93b17f3) | [**Locality**](#/dashboard/95ccacb0-5619-11e8-b711-83a5f93b17f3)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "70567480-335d-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Overview", + "visState": "{\"title\":\"ElastiFlow: NAV: Overview\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[**Overview**](#/dashboard/653cf1e0-2fd2-11e7-99ed-49759aed30f5) | [Top-N](#/dashboard/AWFgr4DaugC1WJLdy9iE) | [Threats](#/dashboard/8e383000-3309-11e9-aec0-c1d93190f676) | [Flows](#/dashboard/d7124e80-5625-11e8-b711-83a5f93b17f3) | [Geo IP](#/dashboard/a932b600-2fd2-11e7-99ed-49759aed30f5) | [AS Traffic](#/dashboard/d7e31d40-6589-11e7-bfc3-d74b7bb89482) | [Exporters](#/dashboard/04157d70-6591-11e7-bfc3-d74b7bb89482) | [Traffic Details](#/dashboard/10584050-6234-11e7-8236-19b4b4941e22) | [Flow Records](#/dashboard/ca480720-2fdf-11e7-9d02-3f49bde5c1d5)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "1fa2c100-6592-11e7-bfc3-d74b7bb89482", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Egress Interfaces (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Egress Interfaces (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"legendPosition\":\"right\",\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.output_snmp\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Egress Interface\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "178b0af0-6230-11e7-9a50-efc26ded795d", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Traffic Locality (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Traffic Locality (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.traffic_locality\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Locality\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "5fd2fe30-2fc7-11e7-8936-6f5fd5520124", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destinations (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Destinations (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Destination\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "21671b80-55bf-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Countries (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Countries (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.country\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Country\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "36e56dc0-801a-11e7-8b60-018ea0aa61a0", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Services (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Services (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.service_name\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Service\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "97885520-55c6-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Autonomous Systems (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Destination Autonomous Systems (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_autonomous_system\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Destination AS\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":true,\"disabled\":false,\"alias\":\"Private\",\"type\":\"phrase\",\"key\":\"flow.dst_autonomous_system\",\"value\":\"private\",\"params\":{\"query\":\"private\",\"type\":\"phrase\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"flow.dst_autonomous_system\":{\"query\":\"private\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"globalState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "1b6b9b90-55c7-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Client Autonomous Systems (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Client Autonomous Systems (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.client_autonomous_system\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Client AS\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":true,\"disabled\":false,\"alias\":\"Private\",\"type\":\"phrase\",\"key\":\"flow.client_autonomous_system\",\"value\":\"private\",\"params\":{\"query\":\"private\",\"type\":\"phrase\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"flow.client_autonomous_system\":{\"query\":\"private\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"globalState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "8be71430-55c7-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Server Autonomous Systems (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Server Autonomous Systems (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.server_autonomous_system\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Server AS\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":true,\"disabled\":false,\"alias\":\"Private\",\"type\":\"phrase\",\"key\":\"flow.server_autonomous_system\",\"value\":\"private\",\"params\":{\"query\":\"private\",\"type\":\"phrase\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"flow.server_autonomous_system\":{\"query\":\"private\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"globalState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "02e25f10-671a-11e7-b5b8-29fbded8e37c", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Top Source Ports - table", + "visState": "{\"title\":\"ElastiFlow: Top Source Ports - table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":true,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.src_port_name\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":499,\"order\":\"desc\",\"orderBy\":\"2\",\"customLabel\":\"Source\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "b58e1380-6719-11e7-b5b8-29fbded8e37c", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Top Sources - table", + "visState": "{\"title\":\"ElastiFlow: Top Sources - table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":true,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.src_hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":499,\"order\":\"desc\",\"orderBy\":\"2\",\"customLabel\":\"Source\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "c1bbc780-560e-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Application Count", + "visState": "{\"title\":\"ElastiFlow: Application Count\",\"type\":\"metric\",\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"32\",\"handleNoResults\":true,\"type\":\"metric\",\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":36,\"labelColor\":false,\"subText\":\"\"},\"useRange\":false,\"metricColorMode\":\"None\"}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.application\",\"customLabel\":\"Applications\"}}]}", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "47ee87d0-336c-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Top-N (conversations)", + "visState": "{\"title\":\"ElastiFlow: NAV: Top-N (conversations)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Talkers](#/dashboard/AWFgr4DaugC1WJLdy9iE) | [Services](#/dashboard/0809c1f0-6719-11e7-b5b8-29fbded8e37c)\\n | [**Conversations**](#/dashboard/AWFgw02HugC1WJLdzCFZ) | [Apps](#/dashboard/44d6d8c0-560b-11e8-b711-83a5f93b17f3)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "610605e0-336c-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Top-N (apps)", + "visState": "{\"title\":\"ElastiFlow: NAV: Top-N (apps)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Talkers](#/dashboard/AWFgr4DaugC1WJLdy9iE) | [Services](#/dashboard/0809c1f0-6719-11e7-b5b8-29fbded8e37c)\\n | [Conversations](#/dashboard/AWFgw02HugC1WJLdzCFZ) | [**Apps**](#/dashboard/44d6d8c0-560b-11e8-b711-83a5f93b17f3)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "1e7d8770-2fc7-11e7-8936-6f5fd5520124", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sources (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Sources (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "33f660e0-336c-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Top-N (services)", + "visState": "{\"title\":\"ElastiFlow: NAV: Top-N (services)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Talkers](#/dashboard/AWFgr4DaugC1WJLdy9iE) | [**Services**](#/dashboard/0809c1f0-6719-11e7-b5b8-29fbded8e37c)\\n | [Conversations](#/dashboard/AWFgw02HugC1WJLdzCFZ) | [Apps](#/dashboard/44d6d8c0-560b-11e8-b711-83a5f93b17f3)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "af914ad0-336c-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Geo IP (src/dst)", + "visState": "{\"title\":\"ElastiFlow: NAV: Geo IP (src/dst)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[Client/Server](#/dashboard/a932b600-2fd2-11e7-99ed-49759aed30f5) | [**Src/Dst**](#/dashboard/AWFhE8NZugC1WJLdzYri)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "1e6fb550-8017-11e7-9e6a-575834c68c0e", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Client Count", + "visState": "{\"title\":\"ElastiFlow: Client Count\",\"type\":\"metric\",\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"32\",\"handleNoResults\":true,\"type\":\"metric\",\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":36,\"labelColor\":false,\"subText\":\"\"},\"useRange\":false,\"metricColorMode\":\"None\"}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.client_hostname\",\"customLabel\":\"Clients\"}}]}", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "afa2d1c0-5617-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Country Count", + "visState": "{\"title\":\"ElastiFlow: Country Count\",\"type\":\"metric\",\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"32\",\"handleNoResults\":true,\"type\":\"metric\",\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":36,\"labelColor\":false,\"subText\":\"\"},\"useRange\":false,\"metricColorMode\":\"None\"}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.country\",\"customLabel\":\"Countries\"}}]}", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "066b9700-55c6-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Autonomous Systems (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Source Autonomous Systems (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_autonomous_system\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source AS\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":true,\"disabled\":false,\"alias\":\"Private\",\"type\":\"phrase\",\"key\":\"flow.src_autonomous_system\",\"value\":\"private\",\"params\":{\"query\":\"private\",\"type\":\"phrase\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"flow.src_autonomous_system\":{\"query\":\"private\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"globalState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "d5e94030-5617-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Autonomous System Count", + "visState": "{\"title\":\"ElastiFlow: Autonomous System Count\",\"type\":\"metric\",\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"32\",\"handleNoResults\":true,\"type\":\"metric\",\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":36,\"labelColor\":false,\"subText\":\"\"},\"useRange\":false,\"metricColorMode\":\"None\"}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.autonomous_system\",\"customLabel\":\"Autonomous Systems\"}}]}", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "e607f720-560f-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Protocol Count", + "visState": "{\"title\":\"ElastiFlow: IP Protocol Count\",\"type\":\"metric\",\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"32\",\"handleNoResults\":true,\"type\":\"metric\",\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":36,\"labelColor\":false,\"subText\":\"\"},\"useRange\":false,\"metricColorMode\":\"None\"}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.ip_protocol\",\"customLabel\":\"IP Protocols\"}}]}", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "be939000-560f-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: TCP Flag Count", + "visState": "{\"title\":\"ElastiFlow: TCP Flag Count\",\"type\":\"metric\",\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"32\",\"handleNoResults\":true,\"type\":\"metric\",\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":36,\"labelColor\":false,\"subText\":\"\"},\"useRange\":false,\"metricColorMode\":\"None\"}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.tcp_flags\",\"customLabel\":\"TCP Flags\"}}]}", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "2f7d7110-8018-11e7-9e6a-575834c68c0e", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Service Count", + "visState": "{\"title\":\"ElastiFlow: Service Count\",\"type\":\"metric\",\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"32\",\"handleNoResults\":true,\"type\":\"metric\",\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":36,\"labelColor\":false,\"subText\":\"\"},\"useRange\":false,\"metricColorMode\":\"None\"}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.service_name\",\"customLabel\":\"Services\"}}]}", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "c01e5510-5617-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: City Count", + "visState": "{\"title\":\"ElastiFlow: City Count\",\"type\":\"metric\",\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"32\",\"handleNoResults\":true,\"type\":\"metric\",\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":36,\"labelColor\":false,\"subText\":\"\"},\"useRange\":false,\"metricColorMode\":\"None\"}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.city\",\"customLabel\":\"Cities\"}}]}", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "cc28fff0-801f-11e7-8a72-651c4183643b", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Servers and Clients (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Servers and Clients (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.server_hostname\",\"size\":25,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Server\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.client_hostname\",\"size\":25,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Client\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "f11380e0-6591-11e7-bfc3-d74b7bb89482", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Ingress Interfaces (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Ingress Interfaces (packets) - donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"legendPosition\":\"right\",\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.input_snmp\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Ingress Interface\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "3026fe40-658f-11e7-bfc3-d74b7bb89482", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Types (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Flow Types (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"event.type\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Flow Type\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "a4ade270-658e-11e7-bfc3-d74b7bb89482", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Direction (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Direction (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.direction\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Direction\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "d2c71350-336b-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: NAV: Traffic Details (types)", + "visState": "{\"title\":\"ElastiFlow: NAV: Traffic Details (types)\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"markdown\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"elastiflow-*\",\"interval\":\"auto\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"markdown_less\":\"p {\\n color: #cccccc;\\n margin-top: 0px;\\n margin-bottom: 8px;\\n}\\np a {\\n color: #00bfb3;\\n\\tfont-size: 14px;\\n\\tfont-weight: bold;\\n\\ttext-decoration: none;\\n}\\np a strong {\\n color: #f04e98;\\n\\tfont-weight: bold;\\n}\\nhr {\\n background-color: #cccccc;\\n margin: 0px;\\n height: 1px;\\n}\",\"markdown_css\":\"#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p{color:#cccccc;margin-top:0;margin-bottom:8px}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a{color:#00bfb3;font-size:14px;font-weight:bold;text-decoration:none}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 p a strong{color:#f04e98;font-weight:bold}#markdown-61ca57f0-469d-11e7-af02-69e470af7417 hr{background-color:#cccccc;margin:0;height:1px}\",\"markdown_vertical_align\":\"top\",\"markdown\":\"[**Types**](#/dashboard/10584050-6234-11e7-8236-19b4b4941e22)\\n | [Attributes](#/dashboard/64c19720-5619-11e8-b711-83a5f93b17f3) | [Locality](#/dashboard/95ccacb0-5619-11e8-b711-83a5f93b17f3)\\n![](http://www.koiossian.com/public/elastiflow.gif)\\n***\",\"default_index_pattern\":\"elastiflow-*\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [] + }, + { + "_id": "b02faaf0-2fcb-11e7-8df8-b363df28ab61", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Version (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: IP Version (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.ip_version\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"IP Version\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "3277ea90-6578-11e7-8471-e5432f50acbd", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Count", + "visState": "{\"title\":\"ElastiFlow: Source Count\",\"type\":\"metric\",\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"32\",\"handleNoResults\":true,\"type\":\"metric\",\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":36,\"labelColor\":false,\"subText\":\"\"},\"useRange\":false,\"metricColorMode\":\"None\"}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.src_hostname\",\"customLabel\":\"Sources\"}}]}", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "2e450d90-8017-11e7-9e6a-575834c68c0e", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Server Count", + "visState": "{\"title\":\"ElastiFlow: Server Count\",\"type\":\"metric\",\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"32\",\"handleNoResults\":true,\"type\":\"metric\",\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":36,\"labelColor\":false,\"subText\":\"\"},\"useRange\":false,\"metricColorMode\":\"None\"}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.server_hostname\",\"customLabel\":\"Servers\"}}]}", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "003b4bd0-5618-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Traffic Locality Count", + "visState": "{\"title\":\"ElastiFlow: Traffic Locality Count\",\"type\":\"metric\",\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"32\",\"handleNoResults\":true,\"type\":\"metric\",\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":36,\"labelColor\":false,\"subText\":\"\"},\"useRange\":false,\"metricColorMode\":\"None\"}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.traffic_locality\",\"customLabel\":\"Traffic Localities\"}}]}", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "c4f8cce0-55c8-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Protocols (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: IP Protocols (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.ip_protocol\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"IP Protocol\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "41a7e3a0-658f-11e7-bfc3-d74b7bb89482", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Types (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Flow Types (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"event.type\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Flow Type\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "71272b10-6579-11e7-8471-e5432f50acbd", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Port Count", + "visState": "{\"title\":\"ElastiFlow: Source Port Count\",\"type\":\"metric\",\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"32\",\"handleNoResults\":true,\"type\":\"metric\",\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":36,\"labelColor\":false,\"subText\":\"\"},\"useRange\":false,\"metricColorMode\":\"None\"}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.src_port_name\",\"customLabel\":\"Source Ports\"}}]}", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "9accd4a0-657a-11e7-8471-e5432f50acbd", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: ToS Count", + "visState": "{\"title\":\"ElastiFlow: ToS Count\",\"type\":\"metric\",\"params\":{\"addLegend\":false,\"addTooltip\":true,\"fontSize\":\"32\",\"handleNoResults\":true,\"type\":\"metric\",\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":36,\"labelColor\":false,\"subText\":\"\"},\"useRange\":false,\"metricColorMode\":\"None\"}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.tos\",\"customLabel\":\"Types of Service\"}}]}", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "16438600-2fcb-11e7-befb-31e033c79e4e", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Direction (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Direction (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.direction\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Direction\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "47bf0c10-8019-11e7-af24-27fa1061e1bd", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Clients (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Clients (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.client_hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Client\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "55be8550-655e-11e7-9dda-9f993e2ba58b", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Count", + "visState": "{\"title\":\"ElastiFlow: Destination Count\",\"type\":\"metric\",\"params\":{\"handleNoResults\":true,\"fontSize\":\"32\",\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":36}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.dst_hostname\",\"customLabel\":\"Destinations\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "04990fe0-6592-11e7-bfc3-d74b7bb89482", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Egress Interfaces (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Egress Interfaces (packets) - donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"legendPosition\":\"right\",\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.output_snmp\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Egress Interface\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "4ea0a8d0-658f-11e7-bfc3-d74b7bb89482", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Types (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Flow Types (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"event.type\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Flow Type\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "de9b3dd0-2fc8-11e7-844c-67b9b101127b", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Ports (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Source Ports (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_port_name\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "46a5ed10-5603-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Locations (flow records) - tilemap", + "visState": "{\"title\":\"ElastiFlow: Source Locations (flow records) - tilemap\",\"type\":\"tile_map\",\"params\":{\"mapType\":\"Heatmap\",\"isDesaturated\":true,\"addTooltip\":true,\"heatClusterSize\":2,\"legendPosition\":\"bottomright\",\"mapZoom\":2,\"mapCenter\":[0,0],\"wms\":{\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"baseLayersAreLoaded\":{},\"tmsLayers\":[{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}],\"selectedTmsLayer\":{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_geo_location\",\"autoPrecision\":true,\"isFilteredByCollar\":true,\"useGeocentroid\":true,\"precision\":2,\"customLabel\":\"Source\"}}]}", + "uiStateJSON": "{\"mapZoom\":2,\"mapCenter\":[-13.923403897723347,43.94531250000001]}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "4c52f1f0-55c6-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Autonomous Systems (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Source Autonomous Systems (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_autonomous_system\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source AS\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":true,\"disabled\":false,\"alias\":\"Private\",\"type\":\"phrase\",\"key\":\"flow.src_autonomous_system\",\"value\":\"private\",\"params\":{\"query\":\"private\",\"type\":\"phrase\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"flow.src_autonomous_system\":{\"query\":\"private\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"globalState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "ef98f6b0-5603-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Locations (packets) - tilemap", + "visState": "{\"title\":\"ElastiFlow: Destination Locations (packets) - tilemap\",\"type\":\"tile_map\",\"params\":{\"mapType\":\"Heatmap\",\"isDesaturated\":true,\"addTooltip\":true,\"heatClusterSize\":2,\"legendPosition\":\"bottomright\",\"mapZoom\":2,\"mapCenter\":[0,0],\"wms\":{\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"baseLayersAreLoaded\":{},\"tmsLayers\":[{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}],\"selectedTmsLayer\":{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_geo_location\",\"autoPrecision\":true,\"isFilteredByCollar\":true,\"useGeocentroid\":true,\"precision\":2,\"customLabel\":\"Destination\"}}]}", + "uiStateJSON": "{\"mapZoom\":2,\"mapCenter\":[-13.923403897723347,43.94531250000001]}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "ffd219d0-5603-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Server Locations (packets) - tilemap", + "visState": "{\"title\":\"ElastiFlow: Server Locations (packets) - tilemap\",\"type\":\"tile_map\",\"params\":{\"mapType\":\"Heatmap\",\"isDesaturated\":true,\"addTooltip\":true,\"heatClusterSize\":2,\"legendPosition\":\"bottomright\",\"mapZoom\":2,\"mapCenter\":[0,0],\"wms\":{\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"baseLayersAreLoaded\":{},\"tmsLayers\":[{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}],\"selectedTmsLayer\":{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.server_geo_location\",\"autoPrecision\":true,\"isFilteredByCollar\":true,\"useGeocentroid\":true,\"precision\":2,\"customLabel\":\"Server\"}}]}", + "uiStateJSON": "{\"mapZoom\":2,\"mapCenter\":[-13.923403897723347,43.94531250000001]}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "e46dc590-5603-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Client Locations (packets) - tilemap", + "visState": "{\"title\":\"ElastiFlow: Client Locations (packets) - tilemap\",\"type\":\"tile_map\",\"params\":{\"mapType\":\"Heatmap\",\"isDesaturated\":true,\"addTooltip\":true,\"heatClusterSize\":2,\"legendPosition\":\"bottomright\",\"mapZoom\":2,\"mapCenter\":[0,0],\"wms\":{\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"baseLayersAreLoaded\":{},\"tmsLayers\":[{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}],\"selectedTmsLayer\":{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.client_geo_location\",\"autoPrecision\":true,\"isFilteredByCollar\":true,\"useGeocentroid\":true,\"precision\":2,\"customLabel\":\"Client\"}}]}", + "uiStateJSON": "{\"mapZoom\":2,\"mapCenter\":[-13.923403897723347,43.94531250000001]}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "203cdb70-5603-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Server Locations (flow records) - tilemap", + "visState": "{\"title\":\"ElastiFlow: Server Locations (flow records) - tilemap\",\"type\":\"tile_map\",\"params\":{\"mapType\":\"Heatmap\",\"isDesaturated\":true,\"addTooltip\":true,\"heatClusterSize\":2,\"legendPosition\":\"bottomright\",\"mapZoom\":2,\"mapCenter\":[0,0],\"wms\":{\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"baseLayersAreLoaded\":{},\"tmsLayers\":[{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}],\"selectedTmsLayer\":{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.server_geo_location\",\"autoPrecision\":true,\"isFilteredByCollar\":true,\"useGeocentroid\":true,\"precision\":2,\"customLabel\":\"Server\"}}]}", + "uiStateJSON": "{\"mapZoom\":2,\"mapCenter\":[-13.923403897723347,43.94531250000001]}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "0be16960-5604-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Locations (packets) - tilemap", + "visState": "{\"title\":\"ElastiFlow: Source Locations (packets) - tilemap\",\"type\":\"tile_map\",\"params\":{\"mapType\":\"Heatmap\",\"isDesaturated\":true,\"addTooltip\":true,\"heatClusterSize\":2,\"legendPosition\":\"bottomright\",\"mapZoom\":2,\"mapCenter\":[0,0],\"wms\":{\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"baseLayersAreLoaded\":{},\"tmsLayers\":[{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}],\"selectedTmsLayer\":{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_geo_location\",\"autoPrecision\":true,\"isFilteredByCollar\":true,\"useGeocentroid\":true,\"precision\":2,\"customLabel\":\"Source\"}}]}", + "uiStateJSON": "{\"mapZoom\":2,\"mapCenter\":[-13.923403897723347,43.94531250000001]}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "d7942120-5603-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Locations (bytes) - tilemap", + "visState": "{\"title\":\"ElastiFlow: Source Locations (bytes) - tilemap\",\"type\":\"tile_map\",\"params\":{\"mapType\":\"Heatmap\",\"isDesaturated\":true,\"addTooltip\":true,\"heatClusterSize\":2,\"legendPosition\":\"bottomright\",\"mapZoom\":2,\"mapCenter\":[0,0],\"wms\":{\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"baseLayersAreLoaded\":{},\"tmsLayers\":[{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}],\"selectedTmsLayer\":{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_geo_location\",\"autoPrecision\":true,\"isFilteredByCollar\":true,\"useGeocentroid\":true,\"precision\":2,\"customLabel\":\"Source\"}}]}", + "uiStateJSON": "{\"mapZoom\":2,\"mapCenter\":[-13.923403897723347,43.94531250000001]}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "a7a47e70-2fde-11e7-9d02-3f49bde5c1d5", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Conversation Partners", + "visState": "{\"title\":\"ElastiFlow: Conversation Partners\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.src_hostname\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.dst_hostname\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Destination\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}}],\"listeners\":{}}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"}}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "4abad150-55bc-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Autonomous Systems (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Autonomous Systems (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.autonomous_system\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"AS\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "55234750-55bf-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Countries (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Countries (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.country\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Country\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "b6a092e0-2fcc-11e7-9bae-a35d2fe38fc2", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Version (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: IP Version (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.ip_version\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"IP Version\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "0edebc40-801b-11e7-b4bd-5b3ceedd298a", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Services (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Services (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.service_name\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Service\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "d8ab4a30-55c6-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Client Autonomous Systems (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Client Autonomous Systems (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.client_autonomous_system\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Client AS\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":true,\"disabled\":false,\"alias\":\"Private\",\"type\":\"phrase\",\"key\":\"flow.client_autonomous_system\",\"value\":\"private\",\"params\":{\"query\":\"private\",\"type\":\"phrase\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"flow.client_autonomous_system\":{\"query\":\"private\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"globalState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "d297fe60-2fd7-11e7-af27-99e728e71e91", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: VLANs (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: VLANs (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.vlan\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"VLAN\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "AWFgzeMpugC1WJLdzEfQ", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Exporters", + "visState": "{\"title\":\"ElastiFlow: Flow Exporters\",\"type\":\"table\",\"params\":{\"perPage\":4,\"showMeticsAtAllLevels\":false,\"showPartialRows\":false,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\",\"type\":\"table\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"node.hostname\",\"size\":500,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Flow Exporter\"}}],\"listeners\":{}}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":0,\"direction\":\"asc\"}}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"match_all\":{}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "c0997620-55e3-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Versions and Protocols (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: IP Versions and Protocols (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.ip_version\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"IP Version\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.ip_protocol\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"IP Protocol\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "37a8b330-8019-11e7-af24-27fa1061e1bd", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Clients (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Clients (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.client_hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Client\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "98519990-55bb-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Autonomous Systems (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Autonomous Systems (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.autonomous_system\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"AS\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "d0e385d0-55ba-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Applications (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Applications (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.application\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Application\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "69f864d0-2fd7-11e7-97a8-85d8d5a99269", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Types of Service (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Types of Service (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.tos\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Type of Service\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "a76ff350-55ba-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Applications (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Applications (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.application\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Application\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "fa3371f0-801a-11e7-b4bd-5b3ceedd298a", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Servers (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Servers (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.server_hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Server\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "88a5e860-55c6-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Autonomous Systems (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Destination Autonomous Systems (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_autonomous_system\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Destination AS\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":true,\"disabled\":false,\"alias\":\"Private\",\"type\":\"phrase\",\"key\":\"flow.dst_autonomous_system\",\"value\":\"private\",\"params\":{\"query\":\"private\",\"type\":\"phrase\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"flow.dst_autonomous_system\":{\"query\":\"private\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"globalState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "72ff0a90-55c7-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Server Autonomous Systems (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Server Autonomous Systems (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.server_autonomous_system\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Server AS\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":true,\"disabled\":false,\"alias\":\"Private\",\"type\":\"phrase\",\"key\":\"flow.server_autonomous_system\",\"value\":\"private\",\"params\":{\"query\":\"private\",\"type\":\"phrase\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"flow.server_autonomous_system\":{\"query\":\"private\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"globalState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "f6be96c0-622f-11e7-abbc-93bb293f5057", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Traffic Locality (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Traffic Locality (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.traffic_locality\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Locality\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "4dc994a0-2fd7-11e7-97a8-85d8d5a99269", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Types of Service (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Types of Service (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.tos\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Type of Service\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "1418ce10-6592-11e7-bfc3-d74b7bb89482", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Egress Interfaces (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Egress Interfaces (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"legendPosition\":\"right\",\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.output_snmp\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Egress Interface\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "4f3525d0-2fc7-11e7-8936-6f5fd5520124", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destinations (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Destinations (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Destination\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "c6b36620-2fc8-11e7-87d6-cdce05879baf", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Ports (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Source Ports (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_port_name\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "14fb54b0-556a-11e8-a695-171fb712da36", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Applications (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Applications (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.application\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Application\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "64d75bf0-55bf-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Countries (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Countries (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.country\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Country\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "74cc8db0-55be-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Cities (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Cities (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.city\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"City\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "b88a8790-2fd7-11e7-bd03-932d3e38a4ff", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: VLANs (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: VLANs (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"legendPosition\":\"right\",\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.vlan\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"VLAN\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "77255120-55c6-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Autonomous Systems (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Destination Autonomous Systems (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_autonomous_system\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Destination AS\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":true,\"disabled\":false,\"alias\":\"Private\",\"type\":\"phrase\",\"key\":\"flow.dst_autonomous_system\",\"value\":\"private\",\"params\":{\"query\":\"private\",\"type\":\"phrase\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"flow.dst_autonomous_system\":{\"query\":\"private\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"globalState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "0e130320-55c7-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Client Autonomous Systems (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Client Autonomous Systems (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.client_autonomous_system\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Client AS\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":true,\"disabled\":false,\"alias\":\"Private\",\"type\":\"phrase\",\"key\":\"flow.client_autonomous_system\",\"value\":\"private\",\"params\":{\"query\":\"private\",\"type\":\"phrase\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"flow.client_autonomous_system\":{\"query\":\"private\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"globalState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "1a9184b0-55c6-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Autonomous Systems (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Source Autonomous Systems (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_autonomous_system\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source AS\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":true,\"disabled\":false,\"alias\":\"Private\",\"type\":\"phrase\",\"key\":\"flow.src_autonomous_system\",\"value\":\"private\",\"params\":{\"query\":\"private\",\"type\":\"phrase\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"flow.src_autonomous_system\":{\"query\":\"private\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"globalState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "b3ed2340-55e3-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Versions and Protocols (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: IP Versions and Protocols (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.ip_version\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"IP Version\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.ip_protocol\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"IP Protocol\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "be065300-801a-11e7-a69e-1db8cf608fe4", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Services (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Services (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.service_name\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Service\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "1c1f5550-801a-11e7-8b60-018ea0aa61a0", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Servers (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Servers (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.server_hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Server\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "24530d50-55be-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Cities (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Cities (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.city\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"City\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "5a0b1a10-55c7-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Server Autonomous Systems (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Server Autonomous Systems (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.server_autonomous_system\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Server AS\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":true,\"disabled\":false,\"alias\":\"Private\",\"type\":\"phrase\",\"key\":\"flow.server_autonomous_system\",\"value\":\"private\",\"params\":{\"query\":\"private\",\"type\":\"phrase\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"flow.server_autonomous_system\":{\"query\":\"private\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"globalState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "31db9c00-3310-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: At-Risk Servers (flows) - table", + "visState": "{\"title\":\"ElastiFlow: At-Risk Servers (flows) - table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flows\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.server_hostname\",\"size\":99,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"At-Risk Servers\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.server_addr\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"IP Address\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"query\":{\"bool\":{\"must\":[{\"query_string\":{\"query\":\"_exists_: flow.client_rep_tags AND flow.server_autonomous_system: private\"}}],\"filter\":[{\"script\":{\"script\":\"doc['flow.server_addr'].value == doc['flow.dst_addr'].value\"}}]}},\"meta\":{\"negate\":false,\"disabled\":false,\"alias\":\"At-Risk Servers\",\"type\":\"custom\",\"key\":\"query\",\"value\":\"{\\\"bool\\\":{\\\"must\\\":[{\\\"query_string\\\":{\\\"query\\\":\\\"_exists_: flow.client_rep_tags AND flow.server_autonomous_system: private\\\"}}],\\\"filter\\\":[{\\\"script\\\":{\\\"script\\\":\\\"doc['flow.server_addr'].value == doc['flow.dst_addr'].value\\\"}}]}}\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "de602310-330b-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: High-Risk Clients (flows) - table", + "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Flows\"},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"High-Risk Clients\",\"field\":\"flow.client_hostname\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"size\":99},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"IP Address\",\"field\":\"flow.client_addr\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"perPage\":10,\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\"},\"title\":\"ElastiFlow: High-Risk Clients (flows) - table\",\"type\":\"table\"}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[{\"$state\":{\"store\":\"appState\"},\"exists\":{\"field\":\"flow.server_rep_tags\"},\"meta\":{\"alias\":\"Bad Server Reputation\",\"disabled\":false,\"key\":\"flow.server_rep_tags\",\"negate\":false,\"type\":\"exists\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "af1425a0-2fc7-11e7-8936-6f5fd5520124", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destinations (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Destinations (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Destination\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "33c10ae0-5603-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Locations (flow records) - tilemap", + "visState": "{\"title\":\"ElastiFlow: Destination Locations (flow records) - tilemap\",\"type\":\"tile_map\",\"params\":{\"mapType\":\"Heatmap\",\"isDesaturated\":true,\"addTooltip\":true,\"heatClusterSize\":2,\"legendPosition\":\"bottomright\",\"mapZoom\":2,\"mapCenter\":[0,0],\"wms\":{\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"baseLayersAreLoaded\":{},\"tmsLayers\":[{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}],\"selectedTmsLayer\":{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_geo_location\",\"autoPrecision\":true,\"isFilteredByCollar\":true,\"useGeocentroid\":true,\"precision\":2,\"customLabel\":\"Destination\"}}]}", + "uiStateJSON": "{\"mapZoom\":2,\"mapCenter\":[-13.923403897723347,43.94531250000001]}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "35464390-55bc-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Autonomous Systems (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Autonomous Systems (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.autonomous_system\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"AS\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "ee65abb0-330e-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Public Threats (flows) - table", + "visState": "{\"title\":\"ElastiFlow: Public Threats (flows) - table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flows\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.client_hostname\",\"size\":99,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Public Threats\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.client_addr\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"IP Address\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":false,\"disabled\":false,\"alias\":\"Public Threats\",\"type\":\"exists\",\"key\":\"flow.client_rep_tags\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"exists\":{\"field\":\"flow.client_rep_tags\"},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "a04e4ba0-55fe-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Top IP Protocols - table", + "visState": "{\"title\":\"ElastiFlow: Top IP Protocols - table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":true,\"totalFunc\":\"sum\",\"showMetricsAtAllLevels\":false},\"aggs\":[{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.ip_protocol\",\"size\":499,\"order\":\"desc\",\"orderBy\":\"2\",\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Top IP Protocols\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "ce9157f0-8020-11e7-bcae-4bd056c878e8", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Top Servers - table", + "visState": "{\"title\":\"ElastiFlow: Top Servers - table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":true,\"totalFunc\":\"sum\",\"showMetricsAtAllLevels\":false},\"aggs\":[{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.server_hostname\",\"size\":499,\"order\":\"desc\",\"orderBy\":\"2\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Top Servers\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "f41316d0-8020-11e7-bcae-4bd056c878e8", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Top Services - table", + "visState": "{\"title\":\"ElastiFlow: Top Services - table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":true,\"totalFunc\":\"sum\",\"showMetricsAtAllLevels\":false},\"aggs\":[{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.service_name\",\"size\":499,\"order\":\"desc\",\"orderBy\":\"2\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Top Services\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "7b10dd00-55e3-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Versions and Protocols (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: IP Versions and Protocols (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.ip_version\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"IP Version\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.ip_protocol\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"IP Protocol\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "793a6f00-2fdd-11e7-afd7-595689f3f18c", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destinations and Sources (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Destinations and Sources (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_hostname\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Destination\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_hostname\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Source\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "elastiflow-*", + "_type": "index-pattern", + "_source": { + "title": "elastiflow-*", + "timeFieldName": "@timestamp", + "fields": "[{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"@version\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"event.host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"event.type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.application\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.autonomous_system\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.bgp_next_hop\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.bgp_valid_state\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.city\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.client_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.client_asn\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.client_autonomous_system\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.client_city\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.client_country\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.client_country_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.client_geo_location\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.client_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.client_rep_tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.country\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.country_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.direction\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_addr_trans\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_asn\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_autonomous_system\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_city\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_country\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_country_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_geo_location\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_mac\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_mask_len\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_port_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_port_trans\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_rep_tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.input_ifname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.input_snmp\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.ip_protocol\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.ip_version\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.next_hop\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.output_ifname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.output_snmp\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.rep_tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.sampling_interval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.server_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.server_asn\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.server_autonomous_system\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.server_city\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.server_country\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.server_country_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.server_geo_location\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.server_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.server_rep_tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.service_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.service_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_addr_trans\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_asn\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_autonomous_system\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_city\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_country\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_country_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_geo_location\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_mac\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_mask_len\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_port_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_port_trans\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_rep_tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.tcp_flags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.tos\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.traffic_direction\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.traffic_locality\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.vlan\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.IPSecSPI\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.VRFname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.absoluteError\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.addressPoolHighThreshold\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.addressPoolLowThreshold\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.addressPortMappingHighThreshold\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.addressPortMappingLowThreshold\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.addressPortMappingPerUserHighThreshold\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.alu_nat_inside_svcid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.alu_nat_outside_svcid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.alu_nat_sub_string\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.anonymizationFlags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.anonymizationTechnique\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.applicationCategoryName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.applicationDescription\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.applicationGroupName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.applicationId\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.applicationName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.applicationSubCategoryName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.applicationVendor\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.applicationVersion\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.applicationVersionName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.barracuda_audit_counter\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.barracuda_bind_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.barracuda_bind_l4_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.barracuda_conn_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.barracuda_conn_l4_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.barracuda_fw_rule\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.barracuda_log_op\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.barracuda_reason\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.barracuda_reason_text\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.barracuda_service\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.barracuda_timestamp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.barracuda_traffic_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.bgpDestinationAsNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.bgpNextAdjacentAsNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.bgpNextHopIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.bgpNextHopIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.bgpPrevAdjacentAsNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.bgpSourceAsNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.bgpValidityState\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.biflowDirection\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cace_local_icmp_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cace_local_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cace_local_ipv4_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cace_local_ipv6_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cace_local_l4_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cace_local_proc_command\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cace_local_proc_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cace_local_proc_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cace_local_proc_user_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cace_remote_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cace_remote_ipv6_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cace_remote_l4_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_assembled_frags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_avg_interarrival_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_data_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dhcp_fingerprint\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dhcp_option\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dhcp_vendor_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dnp3_dst_addr\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dnp3_func\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dnp3_object_data\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dnp3_src_addr\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_a_record\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_aaaa_record\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_algorithm\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_authoritative\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_cname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_digest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_digest_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_hash_data\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_hits\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_iterations\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_key_proto_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_key_tag\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_labels\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_mxexch\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_mxpref\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_ns_dname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_nxdomain\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_ptr_dname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_public_key\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_qname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_qrtype\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_query_resp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_rname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_rrsection\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_salt\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_sig\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_sig_expire\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_sig_inception\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_signer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_soa_expire\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_soa_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_soa_mname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_soa_refresh\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_soa_retry\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_soa_rname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_soa_serial\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_srv_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_srv_pri\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_srv_target\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_srv_weight\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_ttl\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_txtdata\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_dns_type_covered\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ethernet_ip_data\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_expired_frags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_exporter_config_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_exporter_unique_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_first_eight_nonempty_packet_dir\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_first_nonempty_packet_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_first_packet_banner\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_flow_attr\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_flow_table_flushes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_flow_table_peak\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ftp_pass\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ftp_resp_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ftp_return\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ftp_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ftp_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_accept\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_accept_charset\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_accept_encoding\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_accept_lang\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_age\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_allow\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_auth\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_conn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_content_encoding\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_content_language\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_content_len\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_content_location\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_content_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_cookie\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_date\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_dnt\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_expect\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_expires\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_from\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_get\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_imei\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_imsi\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_last_modified\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_location\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_msisdn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_proxy_auth\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_referrer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_refresh\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_resp\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_server_string\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_set_cookie\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_subscriber\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_upgrade\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_user_agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_ver\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_via\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_warning\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_x_device_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_x_forwarded_for\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_x_forwarded_host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_x_forwarded_proto\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_x_forwarded_server\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_x_profile\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_http_xua_compatible\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_imap_auth\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_imap_capability\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_imap_command\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_imap_exists\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_imap_login\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_imap_recent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_imap_start_tls\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_init_tcp_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_irc_text_msg\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_large_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_max_packet_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_mean_flow_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_mean_packet_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_modbus_data\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_mptcp_addr_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_mptcp_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_mptcp_init_data_seq_num\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_mptcp_max_seg_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_mptcp_rcvr_token\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_mysql_command_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_mysql_command_text\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_mysql_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ndpi_l7_proto\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ndpi_l7_sub_proto\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_nntp_command\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_nntp_resp\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_nonempty_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_observed_data\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_observed_data_total\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_obsolete_rev_bytes_total\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_obsolete_rev_init_tcp_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_obsolete_rev_packets_total\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_obsolete_rev_payload\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_obsolete_rev_tcp_seq_num\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_obsolete_rev_union_tcp_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_obsolete_rev_vlan_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_os_fingerprint\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_os_ver\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_payload\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_payload_entropy\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_pop3_text_msg\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_avg_interarrival_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_data_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_dhcp_fingerprint\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_dhcp_vendor_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_first_eight_nonempty_packet_dir\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_first_nonempty_packet_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_first_packet_banner\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_flow_attr\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_flow_delta_millis\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_init_tcp_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_large_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_max_packet_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_nonempty_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_os_fingerprint\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_os_ver\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_payload\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_payload_entropy\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_rtp_payload_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_second_packet_banner\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_small_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_std_dev_interarrival_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_std_dev_payload_len\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_tcp_urgent_count\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rev_union_tcp_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rr_ipv4\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rr_ipv6\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rtp_payload_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rtsp_command\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rtsp_content_len\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rtsp_content_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rtsp_cseq\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rtsp_jitter\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rtsp_location\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rtsp_packets_rcv\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rtsp_return_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rtsp_transport\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rtsp_url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rtsp_user_agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_rtsp_ver\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_second_packet_banner\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_silk_app_label\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_silk_flow_sensor\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_silk_flow_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_silk_tcp_state\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_sip_address\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_sip_command\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_sip_content_len\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_sip_invite\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_sip_max_forwards\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_sip_user_agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_sip_via\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_slp_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_slp_string\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_slp_ver\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_small_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_smtp_content_disposition\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_smtp_content_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_smtp_date\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_smtp_enhanced\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_smtp_filename\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_smtp_from\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_smtp_hello\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_smtp_resp\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_smtp_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_smtp_subject\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_smtp_to\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssh_ver\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_hash\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_issuer_common\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_issuer_country\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_issuer_locality\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_issuer_org\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_issuer_org_unit\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_issuer_state\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_issuer_street\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_issuer_zipcode\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_md5\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_serial_num\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_sha1\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_sig\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_sub_common\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_sub_country\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_sub_locality\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_sub_org\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_sub_org_unit\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_sub_state\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_sub_street\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_sub_zipcode\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_valid_not_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_valid_not_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cert_ver\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_cipher\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_client_ver\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_compress_method\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_object_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_object_value\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_public_key_alg\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_public_key_len\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_record_ver\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_server\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_ssl_server_cipher\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_std_dev_interarrival_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_std_dev_payload_len\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_tcp_urgent_count\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_template\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_template_descr\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_tftp_filename\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_tftp_mode\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_tombstone_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_union_tcp_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cert_yaf_flow_keyhash\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_business_relevance\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_category\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_delay_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_delay_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_delay_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_group\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_http_host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_http_uri_stats\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_media_byte_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_media_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_media_event\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_media_packet_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_media_packet_rate_variation\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_media_packet_rate_variation_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_media_packet_rate_variation_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_media_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_monitor_event\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_sub_category\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_app_traffic_class\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_bgp_community\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_bgp_prepend\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_client_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_client_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_client_ipv6_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_client_l4_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_client_long_lived_network_delay_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_client_long_lived_network_delay_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_client_long_lived_network_delay_samples\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_client_long_lived_network_delay_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_client_network_delay_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_client_network_delay_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_client_network_delay_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_client_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_client_retrans_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_client_retrans_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_concurrent_sessions\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_conn_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_controlled_tc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_cost_discard_rollup_count\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_dst_port_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_dst_port_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_egress_bw\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_egress_bw_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_egress_rollup_bw\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_encrypt_tech\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_in_policy_tc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_ingress_bw\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_ingress_bw_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_ingress_rollup_bw\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_kth_bw_fee\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_kth_rollup_bw\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_kth_tier_percent\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_link_capacity\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_link_group_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_long_term_rtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_metadata_clock_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_metadata_global_session_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_metadata_multi_party_session_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_mos_below_counts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_network_delay_avg\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_one_way_delay\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_p2p_tech\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_policy_qos_queue_drops\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_policy_qos_queue_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_resp_histogram1\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_resp_histogram2\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_resp_histogram3\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_resp_histogram4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_resp_histogram5\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_resp_histogram6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_resp_histogram7\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_rollup_counter\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_rsvp_bandwidth_pool\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_rtp_jitter_interarrival_avg\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_rtp_mos\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_rtp_mos_total\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_rtp_short_term_mos\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_ipv6_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_l4_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_late_resps\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_long_lived_network_delay_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_long_lived_network_delay_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_long_lived_network_delay_samples\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_long_lived_network_delay_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_network_delay_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_network_delay_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_network_delay_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_resp_time_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_resp_time_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_resp_time_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_resps\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_retrans_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_server_retrans_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_src_port_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_src_port_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_tcp_max_segment_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_tcp_window_size_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_tcp_window_size_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_tcp_window_size_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_total_delay_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_total_delay_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_total_delay_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_total_long_lived_network_delay_samples\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_total_long_lived_network_delay_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_total_network_delay_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_total_network_delay_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_total_network_delay_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transact_time_delta\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transact_time_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transact_time_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transact_time_total\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_byte_loss_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_long_term_packets_drop\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_long_term_packets_lost\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_packet_loss_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_packet_loss_rate_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_packet_loss_rate_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_packet_sets_lost\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_packets_expected\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_rtp_flows\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_rtp_jitter_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_rtp_jitter_mean\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_rtp_jitter_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_rtp_payload_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_rtp_ssrc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_rtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_rtt_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_rtt_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_rtt_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_short_term_packets_drop\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_transport_short_term_packets_lost\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_avc_tunnel_tech\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_endpoint_process_hash\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_endpoint_process_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_endpoint_process_parent_hash\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_endpoint_process_parent_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_endpoint_process_parent_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_endpoint_process_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_eta_idp_old\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_eta_slpt_old\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_blackout_secs\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_config_value\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_drop_pass_summary_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_egress_acl_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_erm_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_erm_descr\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_event\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_event_level\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_event_level_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_ext_event\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_ext_event_descr\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_half_open_sessions\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_half_open_sessions_rate_1min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_half_open_sessions_rate_1min_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_ingress_acl_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_sessions_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_xlate_dst_addr_ipv4\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_xlate_dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_xlate_src_addr_ipv4\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_xlate_src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_zonepair\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_fw_zonepair_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_ipt_call_duration\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_ipt_call_end_reason\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_ipt_calls_connected\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_ipt_calls_dialed\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_ipt_calls_failed\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_ipt_dialed_phone\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_ipt_dialed_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_ipt_dialing_phone\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_ipt_dialing_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nexus_fastpath_dst_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nexus_fastpath_dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nexus_fastpath_src_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nexus_fastpath_src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_coord_list\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_dns_suffix\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_dst_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_hash_list\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_iface_details_list\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_iface_index\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_iface_info_uid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_iface_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_iface_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_l4_bytes_in\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_l4_bytes_out\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_module_list\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_os_edition\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_os_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_os_ver\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_parent_proc\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_parent_proc_acct\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_parent_proc_hash\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_proc\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_proc_acct\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_proc_hash\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_sys_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_sys_vendor\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_udid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_nvzflow_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_pfr_br_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_pfr_dst_site_id\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_pfr_dst_site_prefix\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_pfr_dst_site_prefix_mask\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_pfr_event_tc_nomitigation_err_bw_count\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_pfr_event_tc_nomitigation_err_perf_count\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_pfr_label_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_pfr_map_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_pfr_policy_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_pfr_priority\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_pfr_reason\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_pfr_reason_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_pfr_src_site_id\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_pfr_state\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_pfr_threshold\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_policy_qos_class_hierarchy\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_timestamp_abs_monitor_interval_end\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_timestamp_abs_monitor_interval_start\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_trustsec_dst_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_trustsec_dst_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_trustsec_src_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_trustsec_src_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_trustsec_switch_derived_sgt\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_waas_conn_mode\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_waas_dre_input\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_waas_dre_output\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_waas_input_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_waas_lz_input\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_waas_lz_output\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_waas_output_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_waas_passthru_reason\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_waas_segment\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.cisco_wlan_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.classId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.className\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.classificationEngineId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.collectionTimeMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.collectorCertificate\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.collectorIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.collectorIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.collectorTransportPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.commonPropertiesId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.confidenceLevel\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.connectionSumDurationSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.connectionTransactionId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.dataLinkFrameSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.dataLinkFrameSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.dataLinkFrameType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.dataRecordsReliability\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.deltaFlowCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.destinationIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.destinationIPv4Prefix\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.destinationIPv4PrefixLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.destinationIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.destinationIPv6Prefix\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.destinationIPv6PrefixLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.destinationMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.destinationTransportPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.digestHashValue\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.distinctCountOfDestinationIPAddress\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.distinctCountOfDestinationIPv4Address\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.distinctCountOfDestinationIPv6Address\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.distinctCountOfSourceIPAddress\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.distinctCountOfSourceIPv4Address\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.distinctCountOfSourceIPv6Address\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.dot1qCustomerDEI\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.dot1qCustomerDestinationMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.dot1qCustomerPriority\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.dot1qCustomerSourceMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.dot1qCustomerVlanId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.dot1qDEI\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.dot1qPriority\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.dot1qServiceInstanceId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.dot1qServiceInstancePriority\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.dot1qServiceInstanceTag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.dot1qVlanId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.droppedLayer2OctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.droppedLayer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.droppedOctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.droppedOctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.droppedPacketDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.droppedPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.dstTrafficIndex\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.egressBroadcastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.egressInterface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.egressInterfaceType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.egressPhysicalInterface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.egressUnicastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.egressVRFID\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.encryptedTechnology\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.engineId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.engineType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ethernetHeaderLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ethernetPayloadLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ethernetTotalLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ethernetType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.exportInterface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.exportProtocolVersion\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.exportSctpStreamId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.exportTransportProtocol\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.exportedFlowRecordTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.exportedMessageTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.exportedOctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.exporterCertificate\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.exporterIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.exporterIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.exporterTransportPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.exportingProcessId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.externalAddressRealm\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_3gpp_params\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_acl_policy\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_acl_policy_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_acl_rule\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_action\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_app_category\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_attack\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_attack_event\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_attack_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_attack_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_bigip_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_bigip_mgmt_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_bigip_mgmt_ipv6_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_classification\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_concurrent_flows\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_context_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_context_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_destination_geo\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_device_product\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_device_vendor\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_device_ver\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_dns_query_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_downlink_volume\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_drop_reason\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_dst_fqdn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_duration_secs\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_err_defs_msg_num\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_flow_start_millis\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_flow_start_secs\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_flow_stop_millis\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_flow_stop_secs\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_http_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_http_hostname_trunc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_http_resp_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_http_url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_http_url_trunc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_http_user_agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_http_user_agent_trunc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_ip_intel_policy_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_ip_intel_threat_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_ipfix_msg_no\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_last_record_sent\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_log_msg_drops\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_log_msg_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_log_profile\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_msg\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_msg_sev\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_new_flows\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_observation_time_secs\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_packets_drop\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_packets_rcvd\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_partition\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_query_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_record_reason\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_record_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_report_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_report_ver\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_sa_trans_pool\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_sa_trans_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_skipped_transacts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_source_geo\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_source_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_src_fqdn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_subscriber_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_subscriber_id_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_success_transacts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_terminated_flows\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_timestamp_millis\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_total_transacts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_trans_dst_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_trans_dst_ipv6_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_trans_dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_trans_ip_proto\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_trans_route_domain\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_trans_src_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_trans_src_ipv6_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_trans_src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_trans_vlan\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_transact_start_millis\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_transact_start_secs\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_transact_stop_millis\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_transact_stop_secs\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_transacts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_uplink_volume\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_url_category\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_vlan\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.f5_vlan_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.firewallEvent\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flagsAndSamplerId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowActiveTimeout\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowDirection\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowDurationMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowDurationMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowEndDeltaMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowEndMicroseconds\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowEndMilliseconds\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowEndNanoseconds\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowEndReason\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowEndSeconds\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowEndSysUpTime\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowIdleTimeout\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowKeyIndicator\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowLabelIPv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowSamplingTimeInterval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowSamplingTimeSpacing\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowSelectedFlowDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowSelectedOctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowSelectedPacketDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowSelectorAlgorithm\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowStartDeltaMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowStartMicroseconds\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowStartMilliseconds\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowStartNanoseconds\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowStartSeconds\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowStartSysUpTime\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowmon_http_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.flowset_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.forwardingStatus\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.fragmentFlags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.fragmentIdentification\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.fragmentOffset\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_addl_class\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_addl_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_addl_rd_len\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_addl_rdata\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_addl_ttl\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_addl_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_an_count\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_ar_count\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_auth_class\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_auth_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_auth_rd_len\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_auth_ttl\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_auth_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_authority_rdata\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_bits\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_ns_count\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_op_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_qd_count\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_query\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_query_class\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_query_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_resp\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_resp_class\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_resp_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_resp_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_resp_ipv6_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_resp_rd_len\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_resp_rdata\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_resp_ttl\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_dns_resp_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_http_req_url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_http_resp_status\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_ssl_cert_issuer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_ssl_cert_issuer_common\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_ssl_cert_serial_num\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_ssl_cert_sig_algo\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_ssl_cert_subj\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_ssl_cert_subj_alt_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_ssl_cert_subj_common\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_ssl_cert_subj_pub_algo\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_ssl_cert_subj_pubkey_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_ssl_cert_valid_not_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_ssl_cert_valid_not_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_ssl_server_cipher\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_ssl_server_compress_method\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_ssl_server_name_ind\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_ssl_server_sess_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.gigamon_ssl_server_ver\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.globalAddressMappingHighThreshold\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.greKey\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.hashDigestOutput\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.hashFlowDomain\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.hashIPPayloadOffset\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.hashIPPayloadSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.hashInitialiserValue\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.hashOutputRangeMax\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.hashOutputRangeMin\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.hashSelectedRangeMax\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.hashSelectedRangeMin\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.httpContentType\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.httpMessageVersion\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.httpReasonPhrase\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.httpRequestHost\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.httpRequestMethod\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.httpRequestTarget\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.httpStatusCode\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.httpUserAgent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.icmpCodeIPv4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.icmpCodeIPv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.icmpTypeCodeIPv4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.icmpTypeCodeIPv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.icmpTypeIPv4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.icmpTypeIPv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.igmpType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ignoredDataRecordTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ignoredLayer2FrameTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ignoredLayer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ignoredOctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ignoredPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.informationElementDataType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.informationElementDescription\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.informationElementId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.informationElementIndex\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.informationElementName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.informationElementRangeBegin\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.informationElementRangeEnd\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.informationElementSemantics\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.informationElementUnits\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ingressBroadcastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ingressInterface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ingressInterfaceType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ingressMulticastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ingressPhysicalInterface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ingressUnicastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ingressVRFID\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.initiatorOctets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.initiatorPackets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.interfaceDescription\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.interfaceName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.intermediateProcessId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.internalAddressRealm\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipClassOfService\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipDiffServCodePoint\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipHeaderLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipHeaderPacketSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipNextHopIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipNextHopIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipPayloadLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipPayloadPacketSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipPrecedence\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipTTL\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipTotalLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipVersion\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipt_conntrack_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipt_mark\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipv4IHL\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipv4Options\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipv4RouterSc\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ipv6ExtensionHeaders\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.isMulticast\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_browser\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_browser_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_device\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_device_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_dns_answer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_dns_classes\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_dns_query\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_dns_record_txt\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_dst_as\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_dst_city\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_dst_country\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_dst_country_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_dst_latitude\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_dst_longitude\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_dst_region\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_dst_region_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_encrypt_cipher\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_encrypt_key_len\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_encrypt_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_http_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_http_uri\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_http_user_agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_imsi_subscriber\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_l7_app\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_l7_app_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_latency\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_rev_bytes_delta\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_rev_packets_delta\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_src_as\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_src_city\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_src_country\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_src_country_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_src_latitude\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_src_longitude\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_src_region\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_src_region_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_threat_ipv4\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_threat_ipv6\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ixia_threat_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.layer2FrameDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.layer2FrameTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.layer2OctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.layer2OctetDeltaSumOfSquares\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.layer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.layer2OctetTotalSumOfSquares\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.layer2SegmentId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.layer2packetSectionData\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.layer2packetSectionOffset\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.layer2packetSectionSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.lineCardId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.lowerCILimit\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.maxBIBEntries\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.maxEntriesPerUser\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.maxExportSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.maxFlowEndMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.maxFlowEndMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.maxFlowEndNanoseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.maxFlowEndSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.maxFragmentsPendingReassembly\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.maxSessionEntries\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.maxSubscribers\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.maximumIpTotalLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.maximumLayer2TotalLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.maximumTTL\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.messageMD5Checksum\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.messageScope\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.meteringProcessId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.metroEvcId\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.metroEvcType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibCaptureTimeSemantics\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibContextEngineID\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibContextName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibIndexIndicator\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibModuleName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibObjectDescription\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibObjectIdentifier\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibObjectName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibObjectSyntax\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibObjectValueBits\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibObjectValueCounter\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibObjectValueGauge\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibObjectValueIPAddress\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibObjectValueInteger\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibObjectValueOID\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibObjectValueOctetString\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibObjectValueRow\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibObjectValueTable\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibObjectValueTimeTicks\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibObjectValueUnsigned\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mibSubIdentifier\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.minExportSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.minFlowStartMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.minFlowStartMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.minFlowStartNanoseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.minFlowStartSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.minimumIpTotalLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.minimumLayer2TotalLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.minimumTTL\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mobileIMSI\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mobileMSISDN\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.monitoringIntervalEndMilliSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.monitoringIntervalStartMilliSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsLabelStackDepth\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsLabelStackLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsLabelStackSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsLabelStackSection10\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsLabelStackSection2\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsLabelStackSection3\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsLabelStackSection4\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsLabelStackSection5\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsLabelStackSection6\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsLabelStackSection7\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsLabelStackSection8\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsLabelStackSection9\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsPayloadLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsPayloadPacketSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsTopLabelExp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsTopLabelIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsTopLabelIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsTopLabelPrefixLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsTopLabelStackSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsTopLabelTTL\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsTopLabelType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.mplsVpnRouteDistinguisher\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.multicastReplicationFactor\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.natEvent\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.natInstanceID\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.natOriginatingAddressRealm\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.natPoolId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.natPoolName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.natQuotaExceededEvent\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.natThresholdEvent\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.natType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_aaa_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_app\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_app_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_app_incarnations\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_app_start_duration\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_app_start_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_app_template\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_app_unit_app_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_cache_redir_client_conn_core_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_cache_redir_client_conn_trans_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_client_rtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_conn_chain_hop_count\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_conn_chain_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_conn_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_db_client_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_db_database\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_db_login_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_db_proto\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_db_req_string\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_db_req_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_db_resp_len\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_db_resp_status\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_db_resp_status_string\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_db_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_flow_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_client_interact_end_time\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_client_interact_start_time\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_client_render_end_time\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_client_render_start_time\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_content_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_domain\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_req_auth\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_req_cookie\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_req_forw_fb\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_req_forw_lb\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_req_host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_req_method\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_req_rcv_fb\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_req_rcv_lb\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_req_referrer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_req_url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_req_user_agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_req_via\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_req_x_forwarded_for\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_res_forw_fb\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_res_forw_lb\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_res_location\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_res_rcv_fb\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_res_rcv_lb\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_res_set_cookie\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_res_set_cookie2\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_resp_len\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_http_resp_status\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_app\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_app_module_path\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_app_pid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_app_term_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_app_term_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_channel_id1\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_channel_id1_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_channel_id2\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_channel_id2_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_channel_id3\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_channel_id3_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_channel_id4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_channel_id4_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_channel_id5\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_channel_id5_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_client_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_client_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_client_launcher\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_client_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_client_ver\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_clientside_delay\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_clientside_jitter\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_clientside_packets_retrans\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_clientside_rto_count\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_clientside_rtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_clientside_rx_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_clientside_srtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_clientside_tx_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_clientside_window_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_conn_pri\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_device_serial_no\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_domain\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_host_delay\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_l7_client_latency\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_l7_server_latency\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_launch_mechanism\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_network_update_end_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_network_update_start_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_rtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_server\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_serverside_delay\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_serverside_jitter\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_serverside_packets_retrans\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_serverside_rto_count\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_serverside_rtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_serverside_srtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_serverside_window_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_sess_end_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_sess_guid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_sess_reconnects\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_sess_setup_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_sess_update_begin_sec\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_sess_update_end_sec\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_ica_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_license_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_licenses_used\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_main_page_core_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_main_page_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_max_licenses\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_msi_client_cookie\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_rtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_server_ttfb\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_server_ttlb\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_syslog_msg\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_syslog_pri\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_syslog_timestamp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_trans_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_270\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_271\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_272\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_273\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_274\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_275\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_276\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_277\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_278\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_279\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_280\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_281\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_282\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_283\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_284\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_285\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_286\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_287\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_288\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_289\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_290\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_291\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_292\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_293\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_294\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_295\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_296\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_297\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_298\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_299\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_300\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_301\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_302\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_303\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_304\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_305\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_306\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_307\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_308\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_309\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_310\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_311\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_312\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_313\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_314\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_315\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_316\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_317\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_318\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_319\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_320\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_321\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_322\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_323\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_324\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_325\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_326\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_327\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_328\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_329\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_330\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_331\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_332\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_333\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_334\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_335\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_336\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_337\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_338\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_339\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_340\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_341\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_342\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_343\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_344\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_345\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_346\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_347\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_348\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_349\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_350\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_351\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_352\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_353\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_354\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_355\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_356\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_357\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_358\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_359\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_360\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_361\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_362\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_363\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_364\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_365\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_366\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_367\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_377\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_380\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_383\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_384\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_385\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_386\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_387\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_388\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_389\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_391\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_392\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_393\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_394\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_398\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_399\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_400\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_401\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_402\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_403\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_404\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_405\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_408\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_427\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_429\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_432\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_433\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_434\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_435\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_447\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_448\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_451\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_452\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_453\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_455\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_458\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_459\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_460\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_461\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_463\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_464\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_465\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_466\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_467\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_468\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_475\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_476\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_477\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_478\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_479\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_480\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_481\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_487\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_488\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_489\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_491\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_492\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_493\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_494\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_507\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_508\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_509\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_510\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_511\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_512\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_513\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_514\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_518\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_519\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_520\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_521\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_522\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_523\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_532\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_533\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_534\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_535\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_536\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_537\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_538\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.netscaler_unk_541\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.newConnectionDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.nextHeaderIPv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.notSentFlowTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.notSentLayer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.notSentOctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.notSentPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_appl_latency_ms\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_application\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_bittorrent_hash\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_client_nw_latency_ms\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_cumulative_icmp_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dhcp_client\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dhcp_client_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dhcp_client_mac\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dhcp_message_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dhcp_remote_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dhcp_subscriber_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_diameter_clr_cancel_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_diameter_clr_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_diameter_exp_res_result_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_diameter_exp_res_vendor_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_diameter_hop_by_hop_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_diameter_req_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_diameter_req_origin_host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_diameter_req_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_diameter_resp_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_diameter_resp_origin_host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_diameter_resp_result_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dns_answers\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dns_query\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dns_query_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dns_query_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dns_resp\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dns_ret_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dns_ttl_answer\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_downstram_tunnel_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_downstream_sess_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_as_map\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_as_path_1\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_as_path_10\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_as_path_2\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_as_path_3\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_as_path_4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_as_path_5\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_as_path_6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_as_path_7\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_as_path_8\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_as_path_9\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_city\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_country\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_father_proc\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_father_proc_pid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_frags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_lat\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_long\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_proc\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_proc_actual_memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_proc_avg_cpu_load\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_proc_page_faults\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_proc_pctg_iowait\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_proc_peak_memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_proc_pid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_proc_uid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_proc_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_to_src_avg_throughput\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_to_src_max_throughput\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_dst_to_src_min_throughput\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_duration_in\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_duration_out\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_flow_proto_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_flow_server\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_flow_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_ftp_command\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_ftp_command_ret_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_ftp_login\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_ftp_password\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gptv2_s5_s8_gtpc_teid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv0_apn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv0_end_user_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv0_end_user_msisdn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv0_rai_cell_lac\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv0_rai_cell_rac\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv0_rai_mcc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv0_rai_mnc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv0_req_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv0_resp_cause\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv0_resp_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv0_tid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_apn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_c2s_teid_ctrl\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_c2s_teid_data\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_end_user_imei\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_end_user_imsi\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_end_user_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_end_user_msisdn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_rai_lac\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_rai_mcc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_rai_mnc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_rai_rac\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_rai_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_req_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_resp_cause\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_resp_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_s2c_teid_ctrl\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_s2c_teid_data\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_uli_cell_ci\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_uli_cell_lac\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_uli_mcc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_uli_mnc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv1_uli_sac\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_and_user_msisdn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_apn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_c2s_s1u_gtpu_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_c2s_s1u_gtpu_teid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_c2s_s5_s8_gtpc_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_teid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_end_user_imei\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_end_user_imsi\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_pdn_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_rat_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_req_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_resp_cause\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_resp_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_s2c_s1u_gtpu_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_s2c_s1u_gtpu_teid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_s2c_s5_s8_gtpc_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_teid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_uli_cell_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_uli_cell_tac\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_uli_mcc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_gtpv2_uli_mnc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_http_host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_http_method\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_http_mime\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_http_referrer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_http_ret_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_http_site\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_http_url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_http_user_agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_http_via\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_http_x_forwarded_for\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_imap_login\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_in_src_osi_sap\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_l7_proto\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_l7_proto_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_longest_flow_packet\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_mysql_appl_latency_usec\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_mysql_db\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_mysql_query\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_mysql_resp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_mysql_server_ver\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_mysql_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_netbios_query\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_netbios_query_os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_netbios_query_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_netbios_resp\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_nprobe_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_ooorder_in_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_ooorder_out_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_oracle_query\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_oracle_query_duration\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_oracle_resp_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_oracle_resp_string\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_oracle_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_out_dst_osi_sap\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_packets_1024_to_1514_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_packets_128_to_256_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_packets_256_to_512_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_packets_512_to_1024_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_packets_over_1514_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_packets_ttl_128_160\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_packets_ttl_160_192\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_packets_ttl_192_224\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_packets_ttl_224_225\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_packets_ttl_2_5\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_packets_ttl_32_64\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_packets_ttl_5_32\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_packets_ttl_64_96\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_packets_ttl_96_128\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_packets_ttl_eq_1\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_packets_upto_128_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_payload_hash\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_plugin\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_pop_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_radius_acct_in_octets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_radius_acct_in_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_radius_acct_out_octets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_radius_acct_out_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_radius_acct_sess_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_radius_acct_status_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_radius_called_station_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_radius_calling_station_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_radius_framed_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_radius_nas_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_radius_nas_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_radius_req_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_radius_resp_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_radius_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_radius_user_imei\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_radius_user_imsi\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_retrans_in_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_retrans_in_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_retrans_out_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_retrans_out_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_dtmf_tones\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_first_seq\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_first_ts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_in_jitter\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_in_max_delta\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_in_mos\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_in_packets_drop\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_in_packets_lost\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_in_payload_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_in_r_factor\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_in_transit\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_last_seq\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_last_ts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_mos\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_out_jitter\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_out_max_delta\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_out_mos\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_out_packets_drop\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_out_packets_lost\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_out_payload_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_out_r_factor\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_out_transit\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_r_factor\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_rtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_sip_call_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_rtp_ssrc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_s1ap_cause_enb_to_mme\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_s1ap_detailed_cause_enb_to_mme\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_s1ap_enb_ue_s1ap_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_s1ap_mme_ue_s1ap_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_s1ap_msg_emm_type_enb_to_mme\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_s1ap_msg_emm_type_mme_to_enb\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_s1ap_msg_esm_type_enb_to_mme\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_s1ap_msg_esm_type_mme_to_enb\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_server_nw_latency_ms\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_shortest_flow_packet\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_bye_ok_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_bye_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_c_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_call_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_call_state\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_called_party\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_calling_party\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_cancel_ok_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_cancel_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_invite_failure_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_invite_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_ok_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_reason_cause\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_resp_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_ringing_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_rtp_codecs\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_rtp_ipv4_dst_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_rtp_ipv4_src_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_rtp_l4_dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_rtp_l4_src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_sip_trying_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_smtp_mail_from\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_smtp_rcpt_to\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_as_map\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_as_path_1\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_as_path_10\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_as_path_2\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_as_path_3\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_as_path_4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_as_path_5\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_as_path_6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_as_path_7\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_as_path_8\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_as_path_9\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_city\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_country\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_father_proc\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_father_proc_pid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_frags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_lat\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_long\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_proc\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_proc_actual_memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_proc_avg_cpu_load\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_proc_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_proc_page_faults\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_proc_pctg_iowait\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_proc_peak_memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_proc_uid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_proc_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_to_dst_avg_throughput\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_to_dst_max_throughput\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_src_to_dst_min_throughput\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_ssdp_host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_ssdp_method\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_ssdp_server\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_ssdp_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_ssdp_usn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_ssl_server\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_tcp_win_max_in\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_tcp_win_max_out\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_tcp_win_min_in\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_tcp_win_min_out\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_tcp_win_mss_in\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_tcp_win_mss_out\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_tcp_win_scale_in\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_tcp_win_scale_out\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_tunnel_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_untunneled_ipv4_dst_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_untunneled_ipv4_src_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_untunneled_ipv6_dst_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_untunneled_ipv6_src_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_untunneled_l4_dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_untunneled_l4_src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_untunneled_protocol\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_upstream_sess_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ntop_whois_das_domain\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.observationDomainId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.observationDomainName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.observationPointId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.observationPointType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.observationTimeMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.observationTimeMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.observationTimeNanoseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.observationTimeSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.observedFlowTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.octetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.octetDeltaSumOfSquares\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.octetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.octetTotalSumOfSquares\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.opaqueOctets\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.originalExporterIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.originalExporterIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.originalFlowsCompleted\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.originalFlowsInitiated\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.originalFlowsPresent\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.originalObservationDomainId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.p2pTechnology\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.packetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.packetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.pan_app\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.pan_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.payloadLengthIPv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_client_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_client_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_date_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_encryption\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_event_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_linked_msg_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_msg_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_msg_subject\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_origination_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_partner\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_priority\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_recipient_addr\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_recipient_report_status\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_recipients\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_sender_addr\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_server_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_server_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.plixer_service_ver\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.pluribus_latency_usec\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.portId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.portRangeEnd\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.portRangeNumPorts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.portRangeStart\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.portRangeStepSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postDestinationMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postDot1qCustomerVlanId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postDot1qVlanId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postIpClassOfService\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postIpDiffServCodePoint\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postIpPrecedence\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postLayer2OctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postLayer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postMCastLayer2OctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postMCastLayer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postMCastOctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postMCastOctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postMCastPacketDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postMCastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postMplsTopLabelExp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postNAPTDestinationTransportPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postNAPTSourceTransportPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postNATDestinationIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postNATDestinationIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postNATSourceIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postNATSourceIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postOctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postOctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postPacketDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postSourceMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.postVlanId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.privateEnterpriseNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_apn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_base_service\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_content_cat\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_device\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_ext_rtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_flow_behavior\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_ggsn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_http_content_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_http_file_len\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_http_lang\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_http_location\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_http_referrer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_http_req_method\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_http_req_ver\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_http_resp_status\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_http_url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_http_user_agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_imsi\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_in_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_in_dot1q_priority_level_1\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_in_dot1q_priority_level_2\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_in_dot1q_priority_level_3\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_in_dot1q_priority_level_4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_in_dot1q_vlanid_level_1\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_in_dot1q_vlanid_level_2\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_in_dot1q_vlanid_level_3\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_in_dot1q_vlanid_level_4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_in_dscp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_in_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_in_shaping_drops\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_in_shaping_latency\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_int_rtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_internal_jitter\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_local_ipv4_host\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_local_ipv6_host\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_msisdn\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_out_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_out_dot1q_priority_level_1\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_out_dot1q_priority_level_2\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_out_dot1q_priority_level_3\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_out_dot1q_priority_level_4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_out_dot1q_vlanid_level_1\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_out_dot1q_vlanid_level_2\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_out_dot1q_vlanid_level_3\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_out_dot1q_vlanid_level_4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_out_dscp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_out_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_out_shaping_drops\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_out_shaping_latency\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_property\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_qoe_in_ext\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_qoe_in_int\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_qoe_out_ext\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_qoe_out_int\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_rat\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_remote_geoip\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_remote_ipv4_host\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_remote_ipv6_host\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_rnc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_server_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_service\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_service_object\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_sgsn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_subscriber\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_template\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.procera_user_location_info\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.protocolIdentifier\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.pseudoWireControlWord\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.pseudoWireDestinationIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.pseudoWireId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.pseudoWireType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.redsocks_http_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.relativeError\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.responderOctets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.responderPackets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseAbsoluteError\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseAnonymizationFlags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseAnonymizationTechnique\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseApplicationCategoryName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseApplicationDescription\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseApplicationGroupName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseApplicationId\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseApplicationName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseApplicationSubCategoryName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseBgpDestinationAsNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseBgpNextAdjacentAsNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseBgpNextHopIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseBgpNextHopIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseBgpPrevAdjacentAsNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseBgpSourceAsNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseBgpValidityState\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseClassId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseClassName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseClassificationEngineId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseCollectionTimeMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseCollectorCertificate\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseConfidenceLevel\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseConnectionSumDurationSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseConnectionTransactionId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDataLinkFrameSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDataLinkFrameSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDataLinkFrameType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDataRecordsReliability\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDeltaFlowCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDestinationIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDestinationIPv4Prefix\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDestinationIPv4PrefixLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDestinationIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDestinationIPv6Prefix\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDestinationIPv6PrefixLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDestinationMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDestinationTransportPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDigestHashValue\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDistinctCountOfDestinationIPAddress\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDistinctCountOfDestinationIPv4Address\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDistinctCountOfDestinationIPv6Address\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDistinctCountOfSourceIPAddress\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDistinctCountOfSourceIPv4Address\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDistinctCountOfSourceIPv6Address\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDot1qCustomerDEI\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDot1qCustomerDestinationMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDot1qCustomerPriority\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDot1qCustomerSourceMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDot1qCustomerVlanId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDot1qDEI\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDot1qPriority\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDot1qServiceInstanceId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDot1qServiceInstancePriority\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDot1qServiceInstanceTag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDot1qVlanId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDroppedLayer2OctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDroppedLayer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDroppedOctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDroppedOctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDroppedPacketDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDroppedPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseDstTrafficIndex\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseEgressBroadcastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseEgressInterface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseEgressInterfaceType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseEgressPhysicalInterface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseEgressUnicastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseEgressVRFID\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseEncryptedTechnology\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseEngineId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseEngineType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseEthernetHeaderLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseEthernetPayloadLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseEthernetTotalLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseEthernetType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseExportSctpStreamId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseExporterCertificate\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseExportingProcessId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFirewallEvent\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlagsAndSamplerId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowActiveTimeout\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowDirection\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowDurationMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowDurationMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowEndDeltaMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowEndMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowEndMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowEndNanoseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowEndReason\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowEndSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowEndSysUpTime\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowIdleTimeout\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowLabelIPv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowSamplingTimeInterval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowSamplingTimeSpacing\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowSelectedFlowDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowSelectedOctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowSelectedPacketDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowSelectorAlgorithm\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowStartDeltaMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowStartMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowStartMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowStartNanoseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowStartSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFlowStartSysUpTime\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseForwardingStatus\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFragmentFlags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFragmentIdentification\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseFragmentOffset\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseGreKey\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseHashDigestOutput\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseHashFlowDomain\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseHashIPPayloadOffset\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseHashIPPayloadSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseHashInitialiserValue\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseHashOutputRangeMax\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseHashOutputRangeMin\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseHashSelectedRangeMax\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseHashSelectedRangeMin\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIPSecSPI\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIcmpCodeIPv4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIcmpCodeIPv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIcmpTypeCodeIPv4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIcmpTypeCodeIPv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIcmpTypeIPv4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIcmpTypeIPv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIgmpType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIgnoredDataRecordTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIgnoredLayer2FrameTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIgnoredLayer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseInformationElementDataType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseInformationElementDescription\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseInformationElementId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseInformationElementIndex\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseInformationElementName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseInformationElementRangeBegin\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseInformationElementRangeEnd\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseInformationElementSemantics\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseInformationElementUnits\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIngressBroadcastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIngressInterface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIngressInterfaceType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIngressMulticastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIngressPhysicalInterface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIngressUnicastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIngressVRFID\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseInitiatorOctets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseInitiatorPackets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseInterfaceDescription\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseInterfaceName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIntermediateProcessId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIpClassOfService\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIpDiffServCodePoint\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIpHeaderLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIpHeaderPacketSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIpNextHopIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIpNextHopIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIpPayloadLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIpPayloadPacketSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIpPrecedence\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIpTTL\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIpTotalLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIpVersion\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIpv4IHL\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIpv4Options\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIpv4RouterSc\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIpv6ExtensionHeaders\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseIsMulticast\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseLayer2FrameDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseLayer2FrameTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseLayer2OctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseLayer2OctetDeltaSumOfSquares\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseLayer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseLayer2OctetTotalSumOfSquares\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseLayer2SegmentId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseLayer2packetSectionData\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseLayer2packetSectionOffset\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseLayer2packetSectionSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseLineCardId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseLowerCILimit\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMaxExportSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMaxFlowEndMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMaxFlowEndMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMaxFlowEndNanoseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMaxFlowEndSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMaximumIpTotalLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMaximumLayer2TotalLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMaximumTTL\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMessageMD5Checksum\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMessageScope\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMeteringProcessId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMetroEvcId\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMetroEvcType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMinExportSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMinFlowStartMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMinFlowStartMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMinFlowStartNanoseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMinFlowStartSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMinimumIpTotalLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMinimumLayer2TotalLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMinimumTTL\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMonitoringIntervalEndMilliSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMonitoringIntervalStartMilliSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsLabelStackDepth\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsLabelStackLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsLabelStackSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsLabelStackSection10\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsLabelStackSection2\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsLabelStackSection3\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsLabelStackSection4\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsLabelStackSection5\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsLabelStackSection6\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsLabelStackSection7\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsLabelStackSection8\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsLabelStackSection9\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsPayloadLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsPayloadPacketSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsTopLabelExp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsTopLabelIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsTopLabelIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsTopLabelPrefixLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsTopLabelStackSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsTopLabelTTL\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsTopLabelType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMplsVpnRouteDistinguisher\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseMulticastReplicationFactor\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseNatEvent\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseNatOriginatingAddressRealm\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseNatPoolId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseNatPoolName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseNatType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseNewConnectionDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseNextHeaderIPv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseNotSentLayer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseObservationDomainName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseObservationPointId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseObservationPointType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseObservationTimeMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseObservationTimeMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseObservationTimeNanoseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseObservationTimeSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseOctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseOctetDeltaSumOfSquares\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseOctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseOctetTotalSumOfSquares\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseOpaqueOctets\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseOriginalExporterIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseOriginalExporterIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseOriginalFlowsCompleted\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseOriginalFlowsInitiated\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseOriginalFlowsPresent\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseOriginalObservationDomainId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseP2pTechnology\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePacketDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePayloadLengthIPv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePortId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePortRangeEnd\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePortRangeNumPorts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePortRangeStart\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePortRangeStepSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostDestinationMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostDot1qCustomerVlanId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostDot1qVlanId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostIpClassOfService\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostIpDiffServCodePoint\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostIpPrecedence\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostLayer2OctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostLayer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostMCastLayer2OctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostMCastLayer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostMCastOctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostMCastOctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostMCastPacketDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostMCastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostMplsTopLabelExp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostNAPTDestinationTransportPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostNAPTSourceTransportPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostNATDestinationIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostNATDestinationIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostNATSourceIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostNATSourceIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostOctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostOctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostPacketDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostSourceMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePostVlanId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePrivateEnterpriseNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseProtocolIdentifier\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePseudoWireControlWord\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePseudoWireDestinationIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePseudoWireId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reversePseudoWireType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseRelativeError\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseResponderOctets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseResponderPackets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseRfc3550JitterMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseRfc3550JitterMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseRfc3550JitterNanoseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseRtpSequenceNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSamplerId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSamplerMode\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSamplerName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSamplerRandomInterval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSamplingAlgorithm\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSamplingFlowInterval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSamplingFlowSpacing\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSamplingInterval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSamplingPacketInterval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSamplingPacketSpace\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSamplingPopulation\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSamplingProbability\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSamplingSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSamplingTimeInterval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSamplingTimeSpace\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSectionExportedOctets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSectionOffset\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSelectionSequenceId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSelectorAlgorithm\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSelectorIDTotalFlowsObserved\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSelectorIDTotalFlowsSelected\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSelectorId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSelectorIdTotalPktsObserved\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSelectorIdTotalPktsSelected\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSelectorName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSessionScope\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSourceIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSourceIPv4Prefix\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSourceIPv4PrefixLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSourceIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSourceIPv6Prefix\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSourceIPv6PrefixLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSourceMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSourceTransportPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSrcTrafficIndex\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseStaIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseStaMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseSystemInitTimeMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTcpAckTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTcpAcknowledgementNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTcpControlBits\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTcpDestinationPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTcpFinTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTcpHeaderLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTcpOptions\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTcpPshTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTcpRstTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTcpSequenceNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTcpSourcePort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTcpSynTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTcpUrgTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTcpUrgentPointer\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTcpWindowScale\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTcpWindowSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTotalLengthIPv4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTransportOctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTransportPacketDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseTunnelTechnology\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseUdpDestinationPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseUdpMessageLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseUdpSourcePort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseUpperCILimit\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseUserName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseVRFname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseValueDistributionMethod\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseVirtualStationInterfaceId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseVirtualStationInterfaceName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseVirtualStationName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseVirtualStationUUID\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseVlanId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseWlanChannelId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseWlanSSID\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.reverseWtpMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.rfc3550JitterMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.rfc3550JitterMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.rfc3550JitterNanoseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.rtpSequenceNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.samplerId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.samplerMode\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.samplerName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.samplerRandomInterval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.samplingAlgorithm\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.samplingFlowInterval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.samplingFlowSpacing\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.samplingInterval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.samplingPacketInterval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.samplingPacketSpace\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.samplingPopulation\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.samplingProbability\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.samplingSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.samplingTimeInterval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.samplingTimeSpace\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sectionExportedOctets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sectionOffset\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.selectionSequenceId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.selectorAlgorithm\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.selectorIDTotalFlowsObserved\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.selectorIDTotalFlowsSelected\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.selectorId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.selectorIdTotalPktsObserved\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.selectorIdTotalPktsSelected\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.selectorName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sessionScope\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_app\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_app_attr_bit_mask\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_app_bwm_attr\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_app_cat\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_app_cat_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_app_content_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_app_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_app_index\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_app_risk_attr\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_app_sig_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_app_tech_attr\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_application_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_aspy\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_aspy_index\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_aspy_prod\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_aspy_prod_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_aspy_sig_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_column\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_column_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_column_standard_ipfix_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_column_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_core_stat_core_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_core_stat_core_util\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_country\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_country_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_dev_iface_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_dev_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_dev_mac\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_dev_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_flow_block_reason\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_flow_end_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_flow_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_flow_init_bytes_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_flow_init_packet_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_flow_init_packet_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_flow_resp_bytes_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_flow_resp_packet_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_flow_resp_packet_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_flow_start_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_gav\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_gav_index\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_gav_sig_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_conn_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_if_mode\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_if_mtu\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_if_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_if_speed\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_if_state\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_if_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_iface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_in_bytes_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_in_packet_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_in_packets_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_mac\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_out_bytes_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_out_packet_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_out_packets_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_security_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_if_stat_zone\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_init_to_resp_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_init_to_resp_delta_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_init_to_resp_delta_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_init_to_resp_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_init_vpn_spi_out\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_initiator_gw_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_initiator_gw_mac\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_initiator_iface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_initiator_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_initiator_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_internal_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_ips\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_ips_cat\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_ips_cat_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_ips_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_ips_index\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_ips_sig_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_location_domain\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_location_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_location_region_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_media_protocol\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_media_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_mem_avail_ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_mem_db_ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_mem_flows\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_mem_per_flow\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_mem_total_ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_mem_used_ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_protocol_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_rating\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_rating_index\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_region\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_region_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_resp_to_init_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_resp_to_init_delta_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_resp_to_init_delta_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_resp_to_init_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_resp_vpn_spi_out\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_responder_gw_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_responder_gw_mac\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_responder_iface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_responder_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_responder_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_service\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_service_ip_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_service_port_begin\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_service_port_end\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_snwl_option\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_spam_flow_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_spam_from_email\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_spam_sess_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_spam_spammer\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_spam_time_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_spam_to_email\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_spam_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_spyware_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_table\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_template_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_timestamp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_top_apps_appname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_top_apps_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_top_apps_sigid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_url_flow_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_url_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_url_rating_val1\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_url_rating_val2\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_url_rating_val3\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_url_rating_val4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_url_time_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_user_auth_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_user_domain\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_user_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_user_index\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_user_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_virus_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_voip_flow_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_voip_init_call_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_voip_init_to_resp_avg_latency\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_voip_init_to_resp_lost_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_voip_init_to_resp_max_latency\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_voip_resp_call_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_voip_resp_to_init_avg_latency\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_voip_resp_to_init_lost_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_voip_resp_to_init_max_latency\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_voip_time_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_vpn_auth_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_vpn_encrypt_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_vpn_end_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_vpn_in_spi_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_vpn_local_gw\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_vpn_out_spi_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_vpn_policy_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_vpn_protocol_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_vpn_remote_gw\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_vpn_start_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_vpn_tunnel\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sonic_vpn_tunnel_iface_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sophos_afc_proto\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sophos_afc_proto_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sophos_flow_direction\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sourceIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sourceIPv4Prefix\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sourceIPv4PrefixLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sourceIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sourceIPv6Prefix\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sourceIPv6PrefixLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sourceMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sourceTransportPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.sourceTransportPortsLimit\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.srcTrafficIndex\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.staIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.staMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.subApplicationDescription\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.subApplicationName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.subApplicationTag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.systemInitTimeMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tcpAckTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tcpAcknowledgementNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tcpControlBits\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tcpDestinationPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tcpFinTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tcpHeaderLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tcpOptions\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tcpPshTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tcpRstTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tcpSequenceNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tcpSourcePort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tcpSynTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tcpUrgTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tcpUrgentPointer\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tcpWindowScale\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tcpWindowSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.templateId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.templateParameterRangeEnd\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.totalLengthIPv4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.transportLatency\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.transportOctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.transportPacketDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.transportPacketLoss\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.transportUnreachability\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.tunnelTechnology\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.udpDestinationPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.udpMessageLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.udpSourcePort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.upperCILimit\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.userName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.valueDistributionMethod\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.version\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.viptela_vpn_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.virtualStationInterfaceId\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.virtualStationInterfaceName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.virtualStationName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.virtualStationUUID\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vlanId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_egress_iface_attr\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_ingress_iface_attr\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_tenant_dst_ipv4\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_tenant_dst_ipv6\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_tenant_dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_tenant_proto\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_tenant_src_ipv4\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_tenant_src_ipv6\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_tenant_src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_tunnel_dst_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_tunnel_dst_transport_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_tunnel_key\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_tunnel_protocol_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_tunnel_src_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_tunnel_src_transport_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_tunnel_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_virt_observation_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vmware_vxlan_export_role\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.vpnIdentifier\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.wlanChannelId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.wlanSSID\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.wtpMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_acct_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_agent_guid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_command\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_file_sig\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_file_sig_algo\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_file_sig_algo_char\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_filename\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_image_path\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_inbound\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_mod_time_secs\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_parent_file_sig\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_parent_image_path\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_parent_pid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_pid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_platform\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_unk_269\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ipfix.ziften_user_sid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.IPSecSPI\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.VRFname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.absoluteError\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.anonymizationFlags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.anonymizationTechnique\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.app_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.applicationCategoryName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.applicationGroupName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.applicationSubCategoryName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.application_description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.application_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.application_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.bgpNextAdjacentAsNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.bgpPrevAdjacentAsNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.bgpValidityState\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.bgp_ipv4_next_hop\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.bgp_ipv6_next_hop\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.biflowDirection\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_business_relevance\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_category\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_delay_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_delay_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_delay_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_group\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_http_host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_http_uri_stats\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_media_byte_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_media_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_media_event\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_media_packet_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_media_packet_rate_variation\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_media_packet_rate_variation_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_media_packet_rate_variation_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_media_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_monitor_event\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_sub_category\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_app_traffic_class\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_bgp_community\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_bgp_prepend\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_client_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_client_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_client_ipv6_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_client_l4_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_client_long_lived_network_delay_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_client_long_lived_network_delay_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_client_long_lived_network_delay_samples\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_client_long_lived_network_delay_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_client_network_delay_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_client_network_delay_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_client_network_delay_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_client_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_client_retrans_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_client_retrans_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_concurrent_sessions\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_conn_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_controlled_tc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_cost_discard_rollup_count\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_cost_target_bw\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_dst_port_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_dst_port_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_egress_bw\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_egress_bw_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_egress_rollup_bw\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_encrypt_tech\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_in_policy_tc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_ingress_bw\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_ingress_bw_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_ingress_rollup_bw\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_kth_bw_fee\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_kth_rollup_bw\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_kth_tier_percent\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_link_capacity\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_link_group_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_long_term_rtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_metadata_clock_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_metadata_global_session_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_metadata_multi_party_session_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_mos_below_counts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_network_delay_avg\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_one_way_delay\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_p2p_tech\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_policy_qos_queue_drops\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_policy_qos_queue_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_resp_histogram1\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_resp_histogram2\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_resp_histogram3\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_resp_histogram4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_resp_histogram5\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_resp_histogram6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_resp_histogram7\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_rollup_counter\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_rsvp_bandwidth_pool\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_rtp_jitter_interarrival_avg\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_rtp_mos\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_rtp_mos_total\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_rtp_short_term_mos\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_ipv6_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_l4_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_late_resps\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_long_lived_network_delay_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_long_lived_network_delay_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_long_lived_network_delay_samples\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_long_lived_network_delay_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_network_delay_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_network_delay_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_network_delay_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_resp_time_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_resp_time_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_resp_time_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_resps\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_retrans_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_server_retrans_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_src_port_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_src_port_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_tcp_max_segment_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_tcp_window_size_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_tcp_window_size_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_tcp_window_size_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_total_delay_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_total_delay_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_total_delay_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_total_long_lived_network_delay_samples\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_total_long_lived_network_delay_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_total_network_delay_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_total_network_delay_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_total_network_delay_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transact_time_delta\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transact_time_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transact_time_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transact_time_total\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_byte_loss_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_long_term_packets_drop\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_long_term_packets_lost\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_packet_loss_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_packet_loss_rate_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_packet_loss_rate_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_packet_sets_lost\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_packets_expected\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_rtp_flows\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_rtp_jitter_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_rtp_jitter_mean\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_rtp_jitter_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_rtp_payload_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_rtp_ssrc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_rtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_rtt_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_rtt_min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_rtt_sum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_short_term_packets_drop\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_transport_short_term_packets_lost\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_avc_tunnel_tech\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_endpoint_process_hash\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_endpoint_process_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_endpoint_process_parent_hash\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_endpoint_process_parent_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_endpoint_process_parent_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_endpoint_process_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_eta_idp_old\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_eta_slpt_old\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_blackout_secs\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_config_value\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_drop_pass_summary_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_egress_acl_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_erm_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_erm_descr\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_event\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_event_level\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_event_level_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_ext_event\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_ext_event_descr\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_half_open_sessions\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_half_open_sessions_rate_1min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_half_open_sessions_rate_1min_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_ingress_acl_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_sessions_max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_xlate_dst_addr_ipv4\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_xlate_dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_xlate_src_addr_ipv4\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_xlate_src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_zonepair\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_fw_zonepair_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_ipt_call_duration\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_ipt_call_end_reason\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_ipt_calls_connected\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_ipt_calls_dialed\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_ipt_calls_failed\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_ipt_dialed_phone\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_ipt_dialed_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_ipt_dialing_phone\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_ipt_dialing_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nexus_fastpath_dst_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nexus_fastpath_dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nexus_fastpath_src_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nexus_fastpath_src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_coord_list\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_dns_suffix\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_dst_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_hash_list\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_iface_details_list\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_iface_index\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_iface_info_uid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_iface_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_iface_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_l4_bytes_in\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_l4_bytes_out\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_module_list\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_os_edition\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_os_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_os_ver\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_parent_proc\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_parent_proc_acct\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_parent_proc_hash\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_proc\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_proc_acct\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_proc_hash\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_sys_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_sys_vendor\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_udid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_nvzflow_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_pfr_br_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_pfr_dst_site_id\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_pfr_dst_site_prefix\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_pfr_dst_site_prefix_mask\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_pfr_event_tc_nomitigation_err_bw_count\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_pfr_event_tc_nomitigation_err_perf_count\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_pfr_label_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_pfr_map_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_pfr_policy_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_pfr_priority\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_pfr_reason\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_pfr_reason_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_pfr_src_site_id\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_pfr_state\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_pfr_threshold\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_policy_qos_class_hierarchy\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_timestamp_abs_monitor_interval_end\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_timestamp_abs_monitor_interval_start\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_trustsec_dst_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_trustsec_dst_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_trustsec_src_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_trustsec_src_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_trustsec_switch_derived_sgt\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_waas_conn_mode\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_waas_dre_input\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_waas_dre_output\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_waas_input_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_waas_lz_input\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_waas_lz_output\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_waas_output_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_waas_passthru_reason\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_waas_segment\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.cisco_wlan_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.collectionTimeMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.collectorCertificate\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.collectorIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.collectorIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.collectorTransportPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.commonPropertiesId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.confidenceLevel\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.conn_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.connectionSumDurationSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.connectionTransactionId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dataLinkFrameSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dataLinkFrameSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dataLinkFrameType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dataRecordsReliability\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.destinationIPv6Prefix\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.digestHashValue\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.direction\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.distinctCountOfDestinationIPAddress\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.distinctCountOfDestinationIPv4Address\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.distinctCountOfDestinationIPv6Address\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.distinctCountOfSourceIPAddress\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.distinctCountOfSourceIPv4Address\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.distinctCountOfSourceIPv6Address\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dot1qCustomerDEI\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dot1qCustomerDestinationMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dot1qCustomerPriority\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dot1qCustomerSourceMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dot1qCustomerVlanId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dot1qDEI\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dot1qPriority\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dot1qServiceInstanceId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dot1qServiceInstancePriority\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dot1qServiceInstanceTag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dot1qVlanId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.droppedLayer2OctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.droppedLayer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.droppedOctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.droppedOctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.droppedPacketDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.droppedPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dst_as\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dst_mask\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dst_tos\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.dst_vlan\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.egressBroadcastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.egressInterfaceType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.egressPhysicalInterface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.egressUnicastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.egressVRFID\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.encryptedTechnology\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.engine_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.engine_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ericsson_nat_assign_ts_secs\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ericsson_nat_context_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ericsson_nat_context_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ericsson_nat_external_ipv4\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ericsson_nat_external_port_end\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ericsson_nat_external_port_start\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ericsson_nat_internal_ipv4\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ericsson_nat_unassign_ts_secs\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ethernetHeaderLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ethernetPayloadLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ethernetTotalLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ethernetType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.event_time_msec\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.exportInterface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.exportProtocolVersion\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.exportSctpStreamId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.exportTransportProtocol\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.exporterCertificate\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.exporterIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.exporterIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.exporterTransportPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.exportingProcessId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.first_switched\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowDurationMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowDurationMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowEndDeltaMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowEndMicroseconds\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowEndNanoseconds\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowEndSeconds\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowKeyIndicator\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowSamplingTimeInterval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowSamplingTimeSpacing\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowSelectedFlowDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowSelectedOctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowSelectedPacketDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowSelectorAlgorithm\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowStartDeltaMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowStartMicroseconds\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowStartNanoseconds\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowStartSeconds\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flow_active_timeout\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flow_end_msec\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flow_end_reason\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flow_inactive_timeout\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flow_records\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flow_sampler_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flow_sampler_mode\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flow_sampler_random_interval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flow_seq_num\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flow_start_msec\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flows\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.flowset_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.forwarding_status.reason\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.forwarding_status.status\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.fragmentFlags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.fw_event\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.fw_ext_event\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.fwd_flow_delta_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.greKey\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.hashDigestOutput\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.hashFlowDomain\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.hashIPPayloadOffset\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.hashIPPayloadSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.hashInitialiserValue\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.hashOutputRangeMax\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.hashOutputRangeMin\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.hashSelectedRangeMax\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.hashSelectedRangeMin\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.icmpTypeCodeIPv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.icmp_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.icmp_code_ipv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.icmp_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.icmp_type_ipv4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.icmp_type_ipv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.if_desc\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.if_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ignoredDataRecordTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ignoredLayer2FrameTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ignoredLayer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ignoredOctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ignoredPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.in_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.in_dst_mac\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.in_permanent_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.in_permanent_pkts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.in_pkts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.in_src_mac\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.informationElementDataType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.informationElementDescription\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.informationElementId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.informationElementIndex\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.informationElementName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.informationElementRangeBegin\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.informationElementRangeEnd\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.informationElementSemantics\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.informationElementUnits\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ingressBroadcastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ingressInterfaceType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ingressMulticastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ingressPhysicalInterface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ingressUnicastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ingressVRFID\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.initiatorPackets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.input_snmp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.intermediateProcessId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipHeaderLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipHeaderPacketSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipPayloadLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipPayloadPacketSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipPrecedence\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipTTL\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipTotalLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ip_dscp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ip_protocol_version\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ip_tos\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipv4IHL\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipv4Options\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipv4_dst_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipv4_dst_prefix\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipv4_ident\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipv4_next_hop\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipv4_src_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipv4_src_prefix\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipv6_dst_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipv6_dst_mask\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipv6_flow_label\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipv6_next_hop\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipv6_option_headers\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipv6_src_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ipv6_src_mask\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.isMulticast\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.l4_dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.l4_src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.last_switched\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.layer2FrameDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.layer2FrameTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.layer2OctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.layer2OctetDeltaSumOfSquares\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.layer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.layer2OctetTotalSumOfSquares\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.layer2SegmentId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.lineCardId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.lowerCILimit\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.maxExportSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.maxFlowEndMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.maxFlowEndMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.maxFlowEndNanoseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.maxFlowEndSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.max_pkt_length\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.max_ttl\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.maximumLayer2TotalLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.messageMD5Checksum\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.messageScope\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.meteringProcessId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.metroEvcId\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.metroEvcType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.minExportSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.minFlowStartMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.minFlowStartMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.minFlowStartNanoseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.minFlowStartSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.min_pkt_length\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.min_ttl\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.minimumLayer2TotalLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.monitoringIntervalEndMilliSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.monitoringIntervalStartMilliSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.mplsLabelStackDepth\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.mplsLabelStackSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.mplsPayloadPacketSection\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.mplsTopLabelExp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.mplsTopLabelIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.mplsTopLabelTTL\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.mpls_label_stack_octets.bottom_of_stack\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.mpls_label_stack_octets.experimental\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.mpls_label_stack_octets.label\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.mpls_label_stack_octets.ttl\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.mpls_top_label_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.mpls_top_label_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.mul_dst_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.mul_dst_pkts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.mul_igmp_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.natEvent\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.natOriginatingAddressRealm\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.natPoolId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.natPoolName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.natType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.newConnectionDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.nextHeaderIPv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.notSentFlowTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.notSentLayer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.notSentOctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.notSentPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.nprobe_proto\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.nprobe_proto_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_appl_latency_ms\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_application\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_bittorrent_hash\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_client_nw_latency_ms\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_cumulative_icmp_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dhcp_client\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dhcp_client_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dhcp_client_mac\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dhcp_message_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dhcp_remote_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dhcp_subscriber_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_diameter_clr_cancel_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_diameter_clr_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_diameter_exp_res_result_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_diameter_exp_res_vendor_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_diameter_hop_by_hop_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_diameter_req_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_diameter_req_origin_host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_diameter_req_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_diameter_resp_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_diameter_resp_origin_host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_diameter_resp_result_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dns_answers\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dns_query\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dns_query_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dns_query_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dns_resp\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dns_ret_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dns_ttl_answer\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_downstram_tunnel_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_downstream_sess_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_as_map\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_as_path_1\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_as_path_10\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_as_path_2\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_as_path_3\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_as_path_4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_as_path_5\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_as_path_6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_as_path_7\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_as_path_8\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_as_path_9\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_city\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_country\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_father_proc\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_father_proc_pid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_frags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_lat\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_long\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_proc\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_proc_actual_memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_proc_avg_cpu_load\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_proc_page_faults\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_proc_pctg_iowait\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_proc_peak_memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_proc_pid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_proc_uid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_proc_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_to_src_avg_throughput\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_to_src_max_throughput\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_dst_to_src_min_throughput\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_duration_in\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_duration_out\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_flow_proto_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_flow_server\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_flow_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_ftp_command\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_ftp_command_ret_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_ftp_login\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_ftp_password\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gptv2_s5_s8_gtpc_teid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv0_apn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv0_end_user_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv0_end_user_msisdn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv0_rai_cell_lac\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv0_rai_cell_rac\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv0_rai_mcc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv0_rai_mnc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv0_req_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv0_resp_cause\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv0_resp_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv0_tid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_apn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_c2s_teid_ctrl\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_c2s_teid_data\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_end_user_imei\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_end_user_imsi\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_end_user_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_end_user_msisdn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_rai_lac\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_rai_mcc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_rai_mnc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_rai_rac\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_rai_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_req_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_resp_cause\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_resp_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_s2c_teid_ctrl\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_s2c_teid_data\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_uli_cell_ci\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_uli_cell_lac\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_uli_mcc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_uli_mnc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv1_uli_sac\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_and_user_msisdn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_apn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_c2s_s1u_gtpu_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_c2s_s1u_gtpu_teid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_c2s_s5_s8_gtpc_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_c2s_s5_s8_gtpu_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_c2s_s5_s8_gtpu_teid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_end_user_imei\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_end_user_imsi\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_pdn_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_rat_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_req_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_resp_cause\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_resp_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_s2c_s1u_gtpu_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_s2c_s1u_gtpu_teid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_s2c_s5_s8_gtpc_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_s2c_s5_s8_gtpu_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_s2c_s5_s8_gtpu_teid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_uli_cell_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_uli_cell_tac\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_uli_mcc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_gtpv2_uli_mnc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_http_host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_http_method\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_http_mime\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_http_referrer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_http_ret_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_http_site\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_http_url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_http_user_agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_http_via\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_http_x_forwarded_for\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_imap_login\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_in_src_osi_sap\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_l7_proto\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_l7_proto_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_longest_flow_packet\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_mysql_appl_latency_usec\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_mysql_db\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_mysql_query\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_mysql_resp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_mysql_server_ver\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_mysql_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_netbios_query\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_netbios_query_os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_netbios_query_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_netbios_resp\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_nprobe_ipv4_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_ooorder_in_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_ooorder_out_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_oracle_query\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_oracle_query_duration\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_oracle_resp_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_oracle_resp_string\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_oracle_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_out_dst_osi_sap\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_packets_1024_to_1514_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_packets_128_to_256_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_packets_256_to_512_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_packets_512_to_1024_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_packets_over_1514_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_packets_ttl_128_160\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_packets_ttl_160_192\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_packets_ttl_192_224\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_packets_ttl_224_225\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_packets_ttl_2_5\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_packets_ttl_32_64\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_packets_ttl_5_32\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_packets_ttl_64_96\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_packets_ttl_96_128\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_packets_ttl_eq_1\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_packets_upto_128_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_payload_hash\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_plugin\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_pop_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_radius_acct_in_octets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_radius_acct_in_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_radius_acct_out_octets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_radius_acct_out_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_radius_acct_sess_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_radius_acct_status_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_radius_called_station_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_radius_calling_station_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_radius_framed_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_radius_nas_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_radius_nas_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_radius_req_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_radius_resp_msg_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_radius_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_radius_user_imei\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_radius_user_imsi\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_retrans_in_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_retrans_in_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_retrans_out_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_retrans_out_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_dtmf_tones\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_first_seq\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_first_ts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_in_jitter\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_in_max_delta\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_in_mos\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_in_packets_drop\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_in_packets_lost\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_in_payload_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_in_r_factor\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_in_transit\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_last_seq\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_last_ts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_mos\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_out_jitter\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_out_max_delta\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_out_mos\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_out_packets_drop\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_out_packets_lost\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_out_payload_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_out_r_factor\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_out_transit\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_r_factor\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_rtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_sip_call_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_rtp_ssrc\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_s1ap_cause_enb_to_mme\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_s1ap_detailed_cause_enb_to_mme\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_s1ap_enb_ue_s1ap_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_s1ap_mme_ue_s1ap_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_s1ap_msg_emm_type_enb_to_mme\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_s1ap_msg_emm_type_mme_to_enb\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_s1ap_msg_esm_type_enb_to_mme\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_s1ap_msg_esm_type_mme_to_enb\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_server_nw_latency_ms\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_shortest_flow_packet\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_bye_ok_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_bye_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_c_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_call_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_call_state\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_called_party\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_calling_party\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_cancel_ok_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_cancel_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_invite_failure_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_invite_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_ok_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_reason_cause\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_resp_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_ringing_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_rtp_codecs\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_rtp_ipv4_dst_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_rtp_ipv4_src_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_rtp_l4_dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_rtp_l4_src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_sip_trying_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_smtp_mail_from\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_smtp_rcpt_to\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_as_map\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_as_path_1\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_as_path_10\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_as_path_2\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_as_path_3\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_as_path_4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_as_path_5\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_as_path_6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_as_path_7\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_as_path_8\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_as_path_9\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_city\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_country\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_father_proc\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_father_proc_pid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_frags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_lat\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_long\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_proc\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_proc_actual_memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_proc_avg_cpu_load\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_proc_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_proc_page_faults\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_proc_pctg_iowait\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_proc_peak_memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_proc_uid\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_proc_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_to_dst_avg_throughput\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_to_dst_max_throughput\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_src_to_dst_min_throughput\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_ssdp_host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_ssdp_method\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_ssdp_server\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_ssdp_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_ssdp_usn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_ssl_server\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_tcp_win_max_in\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_tcp_win_max_out\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_tcp_win_min_in\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_tcp_win_min_out\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_tcp_win_mss_in\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_tcp_win_mss_out\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_tcp_win_scale_in\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_tcp_win_scale_out\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_tunnel_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_untunneled_ipv4_dst_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_untunneled_ipv4_src_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_untunneled_ipv6_dst_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_untunneled_ipv6_src_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_untunneled_l4_dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_untunneled_l4_src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_untunneled_protocol\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_upstream_sess_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.ntop_whois_das_domain\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.observationDomainId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.observationDomainName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.observationPointId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.observationPointType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.observationTimeMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.observationTimeNanoseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.observationTimeSeconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.observedFlowTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.octetDeltaSumOfSquares\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.octetTotalSumOfSquares\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.opaqueOctets\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.originalExporterIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.originalExporterIPv6Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.originalFlowsCompleted\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.originalFlowsInitiated\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.originalFlowsPresent\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.originalObservationDomainId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.out_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.out_dst_mac\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.out_pkts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.out_src_mac\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.output_snmp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.p2pTechnology\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.pan_app\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.pan_user\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.payloadLengthIPv6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.portId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.portRangeNumPorts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.portRangeStepSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.postDot1qCustomerVlanId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.postDot1qVlanId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.postIpDiffServCodePoint\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.postIpPrecedence\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.postLayer2OctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.postLayer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.postMCastLayer2OctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.postMCastLayer2OctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.postMCastOctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.postMCastPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.postMplsTopLabelExp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.postNATPortBlockEnd\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.postNATPortBlockStart\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.postOctetTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.postPacketTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.privateEnterpriseNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.protocol\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.pseudoWireControlWord\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.pseudoWireDestinationIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.pseudoWireId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.pseudoWireType\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.relativeError\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.responderPackets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.rev_flow_delta_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.rfc3550JitterMicroseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.rfc3550JitterMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.rfc3550JitterNanoseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.riverbed_cfe_inpath_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.riverbed_cfe_tcp_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.riverbed_cfe_tcp_port_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.riverbed_fe_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.riverbed_outer_inpath_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.riverbed_outer_tcp_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.riverbed_outer_tcp_port_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.riverbed_passthru_reason\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.riverbed_retrans_bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.riverbed_retrans_packets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.riverbed_sfe_inpath_addr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.riverbed_sfe_tcp_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.riverbed_sfe_tcp_port_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.riverbed_tcp_conn_rtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.riverbed_unk_51130\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.riverbed_wan_visibility\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.rtpSequenceNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.sampler_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.samplingFlowInterval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.samplingFlowSpacing\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.samplingPacketInterval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.samplingPacketSpace\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.samplingPopulation\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.samplingProbability\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.samplingSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.samplingTimeInterval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.samplingTimeSpace\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.sampling_algorithm\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.sampling_interval\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.scope_system\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.sectionExportedOctets\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.sectionOffset\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.selectionSequenceId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.selectorAlgorithm\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.selectorIDTotalFlowsObserved\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.selectorIDTotalFlowsSelected\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.selectorId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.selectorIdTotalPktsObserved\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.selectorIdTotalPktsSelected\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.selectorName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.sessionScope\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.sourceIPv6Prefix\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.src_as\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.src_mask\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.src_tos\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.src_vlan\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.staIPv4Address\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.staMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_call_direction\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_codec_in\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_codec_out\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_id_rule_1\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_id_rule_10\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_id_rule_2\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_id_rule_3\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_id_rule_4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_id_rule_5\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_id_rule_6\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_id_rule_7\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_id_rule_8\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_id_rule_9\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_mos_lq\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_net_app_resp_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_net_delay\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_net_discard\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_net_jitter\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_net_loss\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_rtp_clockrate_in\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_rtp_clockrate_out\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_ssl_cn\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_ssl_org\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_tcp_retrans_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_total_app_resp_time\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.streamcore_wan_rtt\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.systemInitTimeMilliseconds\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcpAckTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcpAcknowledgementNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcpDestinationPort\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcpFinTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcpHeaderLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcpOptions\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcpPshTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcpRstTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcpSequenceNumber\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcpSynTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcpUrgTotalCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcpUrgentPointer\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcpWindowScale\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcpWindowSize\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcp_dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcp_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tcp_src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.templateId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.totalLengthIPv4\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.total_bytes_exp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.total_flows_exp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.total_pkts_exp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.transportOctetDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.transportPacketDeltaCount\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.tunnelTechnology\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.udpMessageLength\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.udp_dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.udp_src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.upperCILimit\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.userName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.user_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.username\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.valueDistributionMethod\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.version\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.virtualStationInterfaceId\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.virtualStationInterfaceName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.virtualStationName\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.virtualStationUUID\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.wlanChannelId\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.wlanSSID\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.wlan_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.wtpMacAddress\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.xlate_dst_addr_ipv4\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.xlate_dst_addr_ipv6\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.xlate_dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.xlate_src_addr_ipv4\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.xlate_src_addr_ipv6\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"netflow.xlate_src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"node.hostname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"node.ipaddr\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.agent_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.drops\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.dst_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.dst_mac\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.dst_mask_len\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.dst_priority\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.dst_vlan\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.eth_dst\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.eth_src\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.eth_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.flow_sequence_number\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.frame_length\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.frame_length_times_sampling_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.header_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.input_interface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.input_interface_format\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.input_interface_value\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_address_next_hop_router\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_checksum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_dscp\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_ecn\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_fragment_offset\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_header_length\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_identification\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_next_header\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_options\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_packet_length\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_priority\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_protocol\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_total_length\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_ttl\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.ip_version\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.output_interface\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.output_interface_format\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.output_interface_value\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.packet_length\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.padded\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.protocol\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.protocol_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.sample_length\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.sample_pool\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.sample_seq_number\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.sampling_rate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.sequence_number\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.sflow_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.sflow_version\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.size_header\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.source_id_index\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.source_id_index_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.source_id_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.src_ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.src_mac\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.src_mask_len\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.src_priority\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.src_vlan\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.stripped\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.sub_agent_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_ack_number\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_checksum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_flags\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_header_length\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_is_ack\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_is_cwr\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_is_ecn_echo\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_is_fin\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_is_nonce\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_is_push\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_is_reset\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_is_syn\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_is_urgent\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_options\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_reserved\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_seq_number\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_urgent_pointer\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.tcp_window_size\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.udp_checksum\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.udp_length\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.uptime_in_ms\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.vlan_cfi\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.vlan_id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.vlan_priority\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"sflow.vlan_type\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]", + "fieldFormatMap": "{\"flow.bytes\":{\"id\":\"bytes\"},\"flow.dst_port\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"http://www.adminsub.net/tcp-udp-port-finder/{{value}}\",\"labelTemplate\":\"{{value}}\"}},\"flow.dst_port_trans\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"http://www.adminsub.net/tcp-udp-port-finder/{{value}}\",\"labelTemplate\":\"{{value}}\"}},\"flow.service_port\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"http://www.adminsub.net/tcp-udp-port-finder/{{value}}\",\"labelTemplate\":\"{{value}}\"}},\"flow.src_port\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"http://www.adminsub.net/tcp-udp-port-finder/{{value}}\",\"labelTemplate\":\"{{value}}\"}},\"flow.src_port_trans\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"http://www.adminsub.net/tcp-udp-port-finder/{{value}}\",\"labelTemplate\":\"{{value}}\"}},\"flow.client_asn\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"http://viewdns.info/asnlookup/?asn={{value}}\",\"labelTemplate\":\"{{value}}\"}},\"flow.dst_asn\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"http://viewdns.info/asnlookup/?asn={{value}}\",\"labelTemplate\":\"{{value}}\"}},\"flow.server_asn\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"http://viewdns.info/asnlookup/?asn={{value}}\",\"labelTemplate\":\"{{value}}\"}},\"flow.src_asn\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"http://viewdns.info/asnlookup/?asn={{value}}\",\"labelTemplate\":\"{{value}}\"}},\"flow.vlan\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"flow.client_addr\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"https://www.talosintelligence.com/reputation_center/lookup?search={{value}}\",\"labelTemplate\":\"{{value}}\"}},\"flow.dst_addr\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"https://www.talosintelligence.com/reputation_center/lookup?search={{value}}\",\"labelTemplate\":\"{{value}}\"}},\"flow.server_addr\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"https://www.talosintelligence.com/reputation_center/lookup?search={{value}}\",\"labelTemplate\":\"{{value}}\"}},\"flow.src_addr\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"https://www.talosintelligence.com/reputation_center/lookup?search={{value}}\",\"labelTemplate\":\"{{value}}\"}},\"flow.dst_addr_trans\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"https://www.talosintelligence.com/reputation_center/lookup?search={{value}}\",\"labelTemplate\":\"{{value}}\"}},\"flow.src_addr_trans\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"https://www.talosintelligence.com/reputation_center/lookup?search={{value}}\",\"labelTemplate\":\"{{value}}\"}},\"ipfix.cert_data_bytes\":{\"id\":\"bytes\"},\"netflow.total_bytes_exp\":{\"id\":\"bytes\"},\"netflow.riverbed_retrans_bytes\":{\"id\":\"bytes\"},\"netflow.rev_flow_delta_bytes\":{\"id\":\"bytes\"},\"netflow.out_bytes\":{\"id\":\"bytes\"},\"netflow.ntop_retrans_out_bytes\":{\"id\":\"bytes\"},\"netflow.ntop_retrans_in_bytes\":{\"id\":\"bytes\"},\"netflow.mul_dst_bytes\":{\"id\":\"bytes\"},\"netflow.in_permanent_bytes\":{\"id\":\"bytes\"},\"netflow.in_bytes\":{\"id\":\"bytes\"},\"netflow.fwd_flow_delta_bytes\":{\"id\":\"bytes\"},\"netflow.cisco_waas_output_bytes\":{\"id\":\"bytes\"},\"netflow.cisco_waas_input_bytes\":{\"id\":\"bytes\"},\"netflow.cisco_nvzflow_l4_bytes_out\":{\"id\":\"bytes\"},\"netflow.cisco_nvzflow_l4_bytes_in\":{\"id\":\"bytes\"},\"netflow.cisco_avc_server_retrans_bytes\":{\"id\":\"bytes\"},\"netflow.cisco_avc_server_bytes\":{\"id\":\"bytes\"},\"netflow.cisco_avc_client_retrans_bytes\":{\"id\":\"bytes\"},\"netflow.cisco_avc_client_bytes\":{\"id\":\"bytes\"},\"netflow.cisco_avc_app_media_bytes\":{\"id\":\"bytes\"},\"ipfix.sonic_resp_to_init_delta_bytes\":{\"id\":\"bytes\"},\"ipfix.sonic_resp_to_init_bytes\":{\"id\":\"bytes\"},\"ipfix.sonic_init_to_resp_delta_bytes\":{\"id\":\"bytes\"},\"ipfix.sonic_init_to_resp_bytes\":{\"id\":\"bytes\"},\"ipfix.sonic_if_stat_out_bytes_rate\":{\"id\":\"bytes\"},\"ipfix.sonic_if_stat_in_bytes_rate\":{\"id\":\"bytes\"},\"ipfix.sonic_flow_resp_bytes_rate\":{\"id\":\"bytes\"},\"ipfix.sonic_flow_init_bytes_rate\":{\"id\":\"bytes\"},\"ipfix.procera_out_bytes\":{\"id\":\"bytes\"},\"ipfix.procera_in_bytes\":{\"id\":\"bytes\"},\"ipfix.ntop_retrans_out_bytes\":{\"id\":\"bytes\"},\"ipfix.ntop_retrans_in_bytes\":{\"id\":\"bytes\"},\"ipfix.netscaler_ica_clientside_tx_bytes\":{\"id\":\"bytes\"},\"ipfix.netscaler_ica_clientside_rx_bytes\":{\"id\":\"bytes\"},\"ipfix.netscaler_ica_channel_id5_bytes\":{\"id\":\"bytes\"},\"ipfix.netscaler_ica_channel_id4_bytes\":{\"id\":\"bytes\"},\"ipfix.netscaler_ica_channel_id3_bytes\":{\"id\":\"bytes\"},\"ipfix.netscaler_ica_channel_id2_bytes\":{\"id\":\"bytes\"},\"ipfix.netscaler_ica_channel_id1_bytes\":{\"id\":\"bytes\"},\"ipfix.ixia_rev_bytes_delta\":{\"id\":\"bytes\"},\"ipfix.cisco_waas_output_bytes\":{\"id\":\"bytes\"},\"ipfix.cisco_waas_input_bytes\":{\"id\":\"bytes\"},\"ipfix.cisco_nvzflow_l4_bytes_out\":{\"id\":\"bytes\"},\"ipfix.cisco_nvzflow_l4_bytes_in\":{\"id\":\"bytes\"},\"ipfix.cisco_avc_server_retrans_bytes\":{\"id\":\"bytes\"},\"ipfix.cisco_avc_server_bytes\":{\"id\":\"bytes\"},\"ipfix.cisco_avc_client_retrans_bytes\":{\"id\":\"bytes\"},\"ipfix.cisco_avc_client_bytes\":{\"id\":\"bytes\"},\"ipfix.cisco_avc_app_media_bytes\":{\"id\":\"bytes\"},\"ipfix.cert_rev_data_bytes\":{\"id\":\"bytes\"},\"ipfix.cert_obsolete_rev_bytes_total\":{\"id\":\"bytes\"},\"sflow.dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"sflow.src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.xlate_src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.xlate_dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.udp_src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.udp_dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.sectionExportedOctets\":{\"id\":\"bytes\"},\"netflow.transportOctetDeltaCount\":{\"id\":\"bytes\"},\"netflow.postOctetTotalCount\":{\"id\":\"bytes\"},\"netflow.postMCastOctetTotalCount\":{\"id\":\"bytes\"},\"netflow.postMCastLayer2OctetTotalCount\":{\"id\":\"bytes\"},\"netflow.postMCastLayer2OctetDeltaCount\":{\"id\":\"bytes\"},\"netflow.postLayer2OctetTotalCount\":{\"id\":\"bytes\"},\"netflow.postLayer2OctetDeltaCount\":{\"id\":\"bytes\"},\"netflow.octetTotalSumOfSquares\":{\"id\":\"bytes\"},\"netflow.octetDeltaSumOfSquares\":{\"id\":\"bytes\"},\"netflow.ntop_radius_acct_out_octets\":{\"id\":\"bytes\"},\"netflow.ntop_radius_acct_in_octets\":{\"id\":\"bytes\"},\"netflow.notSentOctetTotalCount\":{\"id\":\"bytes\"},\"netflow.notSentLayer2OctetTotalCount\":{\"id\":\"bytes\"},\"netflow.layer2OctetTotalSumOfSquares\":{\"id\":\"bytes\"},\"netflow.layer2OctetTotalCount\":{\"id\":\"bytes\"},\"netflow.layer2OctetDeltaSumOfSquares\":{\"id\":\"bytes\"},\"netflow.layer2OctetDeltaCount\":{\"id\":\"bytes\"},\"netflow.ignoredOctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.sectionExportedOctets\":{\"id\":\"bytes\"},\"ipfix.transportOctetDeltaCount\":{\"id\":\"bytes\"},\"netflow.droppedLayer2OctetDeltaCount\":{\"id\":\"bytes\"},\"netflow.droppedLayer2OctetTotalCount\":{\"id\":\"bytes\"},\"netflow.droppedOctetDeltaCount\":{\"id\":\"bytes\"},\"netflow.droppedOctetTotalCount\":{\"id\":\"bytes\"},\"netflow.flowSelectedOctetDeltaCount\":{\"id\":\"bytes\"},\"netflow.ignoredLayer2OctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.reversePostLayer2OctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.reversePostMCastLayer2OctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.reversePostMCastLayer2OctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.reversePostMCastOctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.reversePostMCastOctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.reversePostOctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.reversePostOctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.reverseResponderOctets\":{\"id\":\"bytes\"},\"ipfix.reverseSectionExportedOctets\":{\"id\":\"bytes\"},\"ipfix.reverseTransportOctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.reversePostLayer2OctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.reverseOctetTotalSumOfSquares\":{\"id\":\"bytes\"},\"ipfix.reverseOctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.reverseOctetDeltaSumOfSquares\":{\"id\":\"bytes\"},\"ipfix.reverseOctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.reverseNotSentLayer2OctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.reverseLayer2OctetTotalSumOfSquares\":{\"id\":\"bytes\"},\"ipfix.reverseLayer2OctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.reverseLayer2OctetDeltaSumOfSquares\":{\"id\":\"bytes\"},\"ipfix.reverseLayer2OctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.reverseInitiatorOctets\":{\"id\":\"bytes\"},\"ipfix.reverseIgnoredLayer2OctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.reverseFlowSelectedOctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.reverseDroppedOctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.reverseDroppedOctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.reverseDroppedLayer2OctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.reverseDroppedLayer2OctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.responderOctets\":{\"id\":\"bytes\"},\"ipfix.postOctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.postOctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.postMCastOctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.postMCastOctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.postMCastLayer2OctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.postMCastLayer2OctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.postLayer2OctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.postLayer2OctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.octetTotalSumOfSquares\":{\"id\":\"bytes\"},\"ipfix.octetTotalCount\":{\"id\":\"bytes\"},\"ipfix.octetDeltaSumOfSquares\":{\"id\":\"bytes\"},\"ipfix.octetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.ntop_radius_acct_out_octets\":{\"id\":\"bytes\"},\"ipfix.ntop_radius_acct_in_octets\":{\"id\":\"bytes\"},\"ipfix.notSentOctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.notSentLayer2OctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.layer2OctetTotalSumOfSquares\":{\"id\":\"bytes\"},\"ipfix.layer2OctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.layer2OctetDeltaSumOfSquares\":{\"id\":\"bytes\"},\"ipfix.layer2OctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.initiatorOctets\":{\"id\":\"bytes\"},\"ipfix.ignoredOctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.ignoredLayer2OctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.flowSelectedOctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.exportedOctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.droppedOctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.droppedOctetDeltaCount\":{\"id\":\"bytes\"},\"ipfix.droppedLayer2OctetTotalCount\":{\"id\":\"bytes\"},\"ipfix.droppedLayer2OctetDeltaCount\":{\"id\":\"bytes\"},\"netflow.tcp_src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.tcp_dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.tcpDestinationPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.riverbed_sfe_tcp_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.riverbed_outer_tcp_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.riverbed_cfe_tcp_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.postNATPortBlockStart\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.postNATPortBlockEnd\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_untunneled_l4_src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_untunneled_l4_dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_sip_rtp_l4_src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_sip_rtp_l4_dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_flow_proto_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.l4_src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.l4_dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.exporterTransportPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ericsson_nat_external_port_start\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ericsson_nat_external_port_end\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.collectorTransportPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.cisco_nexus_fastpath_src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.cisco_nexus_fastpath_dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.cisco_fw_xlate_src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.cisco_fw_xlate_dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.cisco_avc_transport_byte_loss_rate\":{\"id\":\"bytes\"},\"netflow.cisco_avc_src_port_min\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.cisco_avc_src_port_max\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.cisco_avc_server_l4_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.cisco_avc_dst_port_min\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.cisco_avc_dst_port_max\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.cisco_avc_client_l4_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.vmware_tunnel_src_transport_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.vmware_tunnel_dst_transport_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.vmware_tenant_src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.vmware_tenant_dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.udpSourcePort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.udpDestinationPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.tcpSourcePort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.tcpDestinationPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.sourceTransportPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.sonic_service_port_end\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.sonic_service_port_begin\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.sonic_responder_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.sonic_initiator_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.reverseUdpSourcePort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.reverseUdpDestinationPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.reverseTcpSourcePort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.reverseTcpDestinationPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.reverseSourceTransportPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.reversePostNAPTSourceTransportPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.reversePostNAPTDestinationTransportPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.reversePortRangeStart\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.reversePortRangeEnd\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.reverseDestinationTransportPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.postNAPTSourceTransportPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.postNAPTDestinationTransportPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.portRangeStart\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.portRangeEnd\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_untunneled_l4_src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_untunneled_l4_dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_sip_rtp_l4_src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_sip_rtp_l4_dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_flow_proto_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.f5_trans_src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.f5_trans_dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.exporterTransportPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.exportTransportProtocol\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.destinationTransportPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.collectorTransportPort\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.cisco_nexus_fastpath_src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.cisco_nexus_fastpath_dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.cisco_fw_xlate_src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.cisco_fw_xlate_dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.cisco_avc_transport_byte_loss_rate\":{\"id\":\"bytes\"},\"ipfix.cisco_avc_src_port_min\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.cisco_avc_src_port_max\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.cisco_avc_server_l4_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.cisco_avc_dst_port_min\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.cisco_avc_dst_port_max\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.cisco_avc_client_l4_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.cert_dns_srv_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.cace_remote_l4_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.cace_local_l4_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.barracuda_conn_l4_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.barracuda_bind_l4_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.cisco_avc_app_media_byte_rate\":{\"id\":\"bytes\"},\"netflow.cisco_avc_app_media_byte_rate\":{\"id\":\"bytes\"},\"ipfix.bgpDestinationAsNumber\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.src_as\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_src_as_path_9\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_src_as_path_8\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_src_as_path_7\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_src_as_path_6\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_src_as_path_5\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_src_as_path_4\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_src_as_path_3\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_src_as_path_2\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_src_as_path_10\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_src_as_path_1\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_dst_as_path_9\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_dst_as_path_7\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_dst_as_path_6\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_dst_as_path_5\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_dst_as_path_4\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_dst_as_path_3\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_dst_as_path_2\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_dst_as_path_10\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_dst_as_path_1\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.dst_as\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.reverseBgpSourceAsNumber\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.reverseBgpPrevAdjacentAsNumber\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.reverseBgpNextAdjacentAsNumber\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.reverseBgpDestinationAsNumber\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_src_as_path_9\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_src_as_path_8\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_src_as_path_7\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_src_as_path_6\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_src_as_path_5\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_src_as_path_4\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_src_as_path_3\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_src_as_path_2\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_src_as_path_10\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_src_as_path_1\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_dst_as_path_9\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_dst_as_path_7\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_dst_as_path_6\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_dst_as_path_5\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_dst_as_path_4\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_dst_as_path_3\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_dst_as_path_2\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_dst_as_path_10\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_dst_as_path_1\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.bgpSourceAsNumber\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.bgpPrevAdjacentAsNumber\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.bgpNextAdjacentAsNumber\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"ipfix.ntop_dst_as_path_8\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"netflow.ntop_dst_as_path_8\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}}}" + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_references": [] + }, + { + "_id": "b0451c50-5603-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Server Locations (bytes) - tilemap", + "visState": "{\"title\":\"ElastiFlow: Server Locations (bytes) - tilemap\",\"type\":\"tile_map\",\"params\":{\"mapType\":\"Heatmap\",\"isDesaturated\":true,\"addTooltip\":true,\"heatClusterSize\":2,\"legendPosition\":\"bottomright\",\"mapZoom\":2,\"mapCenter\":[0,0],\"wms\":{\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"baseLayersAreLoaded\":{},\"tmsLayers\":[{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}],\"selectedTmsLayer\":{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.server_geo_location\",\"autoPrecision\":true,\"isFilteredByCollar\":true,\"useGeocentroid\":true,\"precision\":2,\"customLabel\":\"Server\"}}]}", + "uiStateJSON": "{\"mapZoom\":2,\"mapCenter\":[-13.923403897723347,43.94531250000001]}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "b2c9a3d0-658e-11e7-bfc3-d74b7bb89482", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Direction (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Direction (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.direction\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Direction\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "64b144f0-658e-11e7-bfc3-d74b7bb89482", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Exporters (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Flow Exporters (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"node.hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Flow Exporter\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "7ffb5af0-5603-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Client Locations (bytes) - tilemap", + "visState": "{\"title\":\"ElastiFlow: Client Locations (bytes) - tilemap\",\"type\":\"tile_map\",\"params\":{\"mapType\":\"Heatmap\",\"isDesaturated\":true,\"addTooltip\":true,\"heatClusterSize\":2,\"legendPosition\":\"bottomright\",\"mapZoom\":2,\"mapCenter\":[0,0],\"wms\":{\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"baseLayersAreLoaded\":{},\"tmsLayers\":[{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}],\"selectedTmsLayer\":{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.client_geo_location\",\"autoPrecision\":true,\"isFilteredByCollar\":true,\"useGeocentroid\":true,\"precision\":2,\"customLabel\":\"Client\"}}]}", + "uiStateJSON": "{\"mapZoom\":2,\"mapCenter\":[-13.923403897723347,43.94531250000001]}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "6d0c50a0-801d-11e7-bcae-4bd056c878e8", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Top Conversations - table", + "visState": "{\"title\":\"ElastiFlow: Top Conversations - table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showMeticsAtAllLevels\":false,\"showPartialRows\":false,\"showTotal\":true,\"sort\":{\"columnIndex\":3,\"direction\":\"desc\"},\"totalFunc\":\"sum\",\"type\":\"table\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.client_hostname\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Client\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.server_hostname\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":25,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Server\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.service_name\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Service\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":3,\"direction\":\"desc\"}}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "4440e130-2fdd-11e7-afd7-595689f3f18c", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destinations and Sources (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Destinations and Sources (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_hostname\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Destination\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_hostname\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Source\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "df88de80-801f-11e7-8a72-651c4183643b", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Servers and Clients (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Servers and Clients (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.server_hostname\",\"size\":25,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Server\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.client_hostname\",\"size\":25,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Client\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "b74bbb70-2fd6-11e7-a82c-3146dd695923", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sources and Ports (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Sources and Ports (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_hostname\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Source\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_port_name\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "9f9e54b0-2fd6-11e7-a82c-3146dd695923", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sources and Ports (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Sources and Ports (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_hostname\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Source\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_port_name\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "d23a33d0-55c8-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Protocols (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: IP Protocols (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.ip_protocol\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"IP Protocol\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "f8731d50-2fd6-11e7-97a8-85d8d5a99269", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Exporters (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Flow Exporters (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"legendPosition\":\"right\",\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"node.hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Flow Exporter\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "91653f10-55c5-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: TCP Flags (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: TCP Flags (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.tcp_flags\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":12,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"TCP Flag\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "1fdbf870-330a-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Reputations (flows) - table", + "visState": "{\"title\":\"ElastiFlow: IP Reputations (flows) - table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flows\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.rep_tags\",\"size\":99,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"IP Reputations\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":false,\"disabled\":false,\"alias\":\"IP Reputation\",\"type\":\"exists\",\"key\":\"flow.rep_tags\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"exists\":{\"field\":\"flow.rep_tags\"},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "bb92fa50-8020-11e7-bcae-4bd056c878e8", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Top Clients - table", + "visState": "{\"title\":\"ElastiFlow: Top Clients - table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":true,\"totalFunc\":\"sum\",\"showMetricsAtAllLevels\":false},\"aggs\":[{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.client_hostname\",\"size\":499,\"order\":\"desc\",\"orderBy\":\"2\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Top Clients\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "8dcbcce0-2fd6-11e7-a82c-3146dd695923", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sources and Ports (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Sources and Ports (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_hostname\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Source\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_port_name\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "7f7aac00-2fc8-11e7-8bc1-177080983dbf", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Ports (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Destination Ports (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_port_name\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Destination Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "e2f43d10-6591-11e7-bfc3-d74b7bb89482", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Ingress Interfaces (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Ingress Interfaces (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"legendPosition\":\"right\",\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.input_snmp\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Ingress Interface\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "caea3760-6591-11e7-bfc3-d74b7bb89482", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Ingress Interfaces (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Ingress Interfaces (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"legendPosition\":\"right\",\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.input_snmp\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Ingress Interface\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "73c37440-658e-11e7-bfc3-d74b7bb89482", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Flow Exporters (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Flow Exporters (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"node.hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Flow Exporter\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "1026edb0-2fcc-11e7-842d-39925ea8ac40", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: IP Version (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: IP Version (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.ip_version\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"IP Version\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "849562d0-55be-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Cities (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Cities (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.city\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"City\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "5c5d6f60-2fdb-11e7-84e6-333bd21ad9fd", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination and Source Ports (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Destination and Source Ports (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_port_name\",\"size\":25,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Destination Port\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_port_name\",\"size\":15,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Source Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "0b71ad10-5603-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Client Locations (flow records) - tilemap", + "visState": "{\"title\":\"ElastiFlow: Client Locations (flow records) - tilemap\",\"type\":\"tile_map\",\"params\":{\"mapType\":\"Heatmap\",\"isDesaturated\":true,\"addTooltip\":true,\"heatClusterSize\":2,\"legendPosition\":\"bottomright\",\"mapZoom\":2,\"mapCenter\":[0,0],\"wms\":{\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"baseLayersAreLoaded\":{},\"tmsLayers\":[{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}],\"selectedTmsLayer\":{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.client_geo_location\",\"autoPrecision\":true,\"isFilteredByCollar\":true,\"useGeocentroid\":true,\"precision\":2,\"customLabel\":\"Client\"}}]}", + "uiStateJSON": "{\"mapZoom\":2,\"mapCenter\":[-13.923403897723347,43.94531250000001]}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "264fb270-2fdb-11e7-84e6-333bd21ad9fd", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination and Source Ports (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Destination and Source Ports (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_port_name\",\"size\":25,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Destination Port\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_port_name\",\"size\":15,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Source Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "98248160-5603-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Locations (bytes) - tilemap", + "visState": "{\"title\":\"ElastiFlow: Destination Locations (bytes) - tilemap\",\"type\":\"tile_map\",\"params\":{\"mapType\":\"Heatmap\",\"isDesaturated\":true,\"addTooltip\":true,\"heatClusterSize\":2,\"legendPosition\":\"bottomright\",\"mapZoom\":2,\"mapCenter\":[0,0],\"wms\":{\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"baseLayersAreLoaded\":{},\"tmsLayers\":[{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}],\"selectedTmsLayer\":{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.4&license=000430f9-33fb-430b-989a-f0cb8414cca4\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_geo_location\",\"autoPrecision\":true,\"isFilteredByCollar\":true,\"useGeocentroid\":true,\"precision\":2,\"customLabel\":\"Destination\"}}]}", + "uiStateJSON": "{\"mapZoom\":2,\"mapCenter\":[-13.923403897723347,43.94531250000001]}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "40904c50-33b0-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: ZFlow - Platforms (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: ZFlow - Platforms (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"ipfix.ziften_platform\",\"size\":49,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Platform\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "4ce6de10-33b0-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: ZFlow - Commands (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: ZFlow - Commands (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.application\",\"size\":49,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Command\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":false,\"disabled\":false,\"alias\":\"ZFlow\",\"type\":\"exists\",\"key\":\"ipfix.ziften_agent_guid\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"exists\":{\"field\":\"ipfix.ziften_agent_guid\"},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "19873c10-33ae-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: ZFlow - Users (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: ZFlow - Users (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"ipfix.userName\",\"size\":49,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"User\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}},\"filter\":[{\"$state\":{\"store\":\"appState\"},\"exists\":{\"field\":\"ipfix.ziften_agent_guid\"},\"meta\":{\"alias\":\"ZFlow\",\"disabled\":false,\"key\":\"ipfix.ziften_agent_guid\",\"negate\":false,\"type\":\"exists\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "ef3b6010-33af-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: ZFlow - Platforms (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: ZFlow - Platforms (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"ipfix.ziften_platform\",\"size\":49,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Platform\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "601e5470-33ad-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: ZFlow - Platforms (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: ZFlow - Platforms (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"ipfix.ziften_platform\",\"size\":49,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Platform\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "69f4d440-8019-11e7-af24-27fa1061e1bd", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Clients (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Clients (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.client_hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Client\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "7c2cfd10-2fc7-11e7-8936-6f5fd5520124", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sources (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Sources (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "ff6edde0-33af-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: ZFlow - Users (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: ZFlow - Users (packets) - donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"ipfix.userName\",\"size\":49,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"User\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}},\"filter\":[{\"$state\":{\"store\":\"appState\"},\"exists\":{\"field\":\"ipfix.ziften_agent_guid\"},\"meta\":{\"alias\":\"ZFlow\",\"disabled\":false,\"key\":\"ipfix.ziften_agent_guid\",\"negate\":false,\"type\":\"exists\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "aefd37a0-33ad-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: ZFlow - Commands (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: ZFlow - Commands (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.application\",\"size\":49,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Command\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":false,\"disabled\":false,\"alias\":\"ZFlow\",\"type\":\"exists\",\"key\":\"ipfix.ziften_agent_guid\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"exists\":{\"field\":\"ipfix.ziften_agent_guid\"},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "4898db90-2fdb-11e7-84e6-333bd21ad9fd", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination and Source Ports (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Destination and Source Ports (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_port_name\",\"size\":25,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Destination Port\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_port_name\",\"size\":15,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Source Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "44b3cb70-2fd6-11e7-bc99-41245d9394f2", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destinations and Ports (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Destinations and Ports (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_hostname\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Destination\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_port_name\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "55f66b20-2fdd-11e7-afd7-595689f3f18c", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destinations and Sources (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Destinations and Sources (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_hostname\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Destination\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_hostname\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Source\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "313a9880-2fd6-11e7-bc99-41245d9394f2", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destinations and Ports (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Destinations and Ports (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_hostname\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Destination\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_port_name\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "23d6dc80-2fd6-11e7-bc99-41245d9394f2", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destinations and Ports (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Destinations and Ports (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_hostname\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Destination\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_port_name\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "6f6d05b0-2fc8-11e7-bf24-57efade8fd83", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Ports (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Destination Ports (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_port_name\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Destination Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "a8b68cb0-2fc8-11e7-8d8b-45ec51795dad", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Source Ports (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Source Ports (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_port_name\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "9f5fe3e0-55c5-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: TCP Flags (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: TCP Flags (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.tcp_flags\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":12,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"TCP Flag\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "2aeac270-6230-11e7-84f1-9728c106b1b6", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Traffic Locality (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Traffic Locality (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.traffic_locality\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Locality\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "eada0e30-801f-11e7-8a72-651c4183643b", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Servers and Clients (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Servers and Clients (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.server_hostname\",\"size\":25,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Server\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.client_hostname\",\"size\":25,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Client\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "de88ee40-33af-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: ZFlow - Commands (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: ZFlow - Commands (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.application\",\"size\":49,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Command\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":false,\"disabled\":false,\"alias\":\"ZFlow\",\"type\":\"exists\",\"key\":\"ipfix.ziften_agent_guid\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"exists\":{\"field\":\"ipfix.ziften_agent_guid\"},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "30214c20-33b0-11e9-aec0-c1d93190f676", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: ZFlow - Users (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: ZFlow - Users (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"ipfix.userName\",\"size\":49,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"User\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}},\"filter\":[{\"$state\":{\"store\":\"appState\"},\"exists\":{\"field\":\"ipfix.ziften_agent_guid\"},\"meta\":{\"alias\":\"ZFlow\",\"disabled\":false,\"key\":\"ipfix.ziften_agent_guid\",\"negate\":false,\"type\":\"exists\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "47d426a0-2fc8-11e7-8b06-97426538fddd", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Destination Ports (bytes) - donut", + "visState": "{\"title\":\"ElastiFlow: Destination Ports (bytes) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.dst_port_name\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Destination Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "84e4c9f0-2fd7-11e7-97a8-85d8d5a99269", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Types of Service (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Types of Service (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.tos\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Type of Service\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "aa56f4e0-801a-11e7-a69e-1db8cf608fe4", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Servers (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: Servers (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.server_hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Server\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "661ff9d0-55c5-11e8-a1f3-452446793d46", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: TCP Flags (flow records) - donut", + "visState": "{\"title\":\"ElastiFlow: TCP Flags (flow records) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.tcp_flags\",\"otherBucket\":false,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":12,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"TCP Flags\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "8a52f7a0-2fc7-11e7-8936-6f5fd5520124", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Sources (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: Sources (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.src_hostname\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "e8251d30-2fd7-11e7-a4f6-dbb93cfb4a10", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: VLANs (packets) - donut", + "visState": "{\"title\":\"ElastiFlow: VLANs (packets) - donut\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"flow.vlan\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"VLAN\"}}]}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + }, + { + "_id": "757d59f0-5628-11e8-b711-83a5f93b17f3", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Flows (AS)", + "hits": 0, + "description": "", + "panelsJSON": "[{\"panelIndex\":\"35\",\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"35\"},\"title\":\"\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_0\"},{\"panelIndex\":\"43\",\"gridData\":{\"x\":40,\"y\":3,\"w\":8,\"h\":5,\"i\":\"43\"},\"title\":\"\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_1\"},{\"panelIndex\":\"45\",\"gridData\":{\"x\":0,\"y\":3,\"w\":40,\"h\":5,\"i\":\"45\"},\"title\":\"\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_2\"},{\"panelIndex\":\"46\",\"gridData\":{\"x\":37,\"y\":30,\"w\":11,\"h\":11,\"i\":\"46\"},\"title\":\"Destination Autonomous Systems (flow records)\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_3\"},{\"panelIndex\":\"47\",\"gridData\":{\"x\":0,\"y\":30,\"w\":11,\"h\":11,\"i\":\"47\"},\"title\":\"Source Autonomous Systems (flow records)\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_4\"},{\"gridData\":{\"x\":0,\"y\":0,\"w\":29,\"h\":3,\"i\":\"51\"},\"version\":\"6.6.0\",\"panelIndex\":\"51\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_5\"},{\"gridData\":{\"x\":29,\"y\":0,\"w\":14,\"h\":3,\"i\":\"52\"},\"version\":\"6.6.0\",\"panelIndex\":\"52\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_6\"},{\"gridData\":{\"x\":0,\"y\":19,\"w\":11,\"h\":11,\"i\":\"53\"},\"version\":\"7.0.1\",\"panelIndex\":\"53\",\"embeddableConfig\":{},\"title\":\"Source Autonomous Systems (packets)\",\"panelRefName\":\"panel_7\"},{\"gridData\":{\"x\":0,\"y\":8,\"w\":11,\"h\":11,\"i\":\"54\"},\"version\":\"7.0.1\",\"panelIndex\":\"54\",\"embeddableConfig\":{},\"title\":\"Source Autonomous Systems (bytes)\",\"panelRefName\":\"panel_8\"},{\"gridData\":{\"x\":37,\"y\":8,\"w\":11,\"h\":11,\"i\":\"55\"},\"version\":\"7.0.1\",\"panelIndex\":\"55\",\"embeddableConfig\":{},\"title\":\"Destination Autonomous Systems (bytes)\",\"panelRefName\":\"panel_9\"},{\"gridData\":{\"x\":37,\"y\":19,\"w\":11,\"h\":11,\"i\":\"56\"},\"version\":\"7.0.1\",\"panelIndex\":\"56\",\"embeddableConfig\":{},\"title\":\"Destination Autonomous Systems (packets)\",\"panelRefName\":\"panel_10\"},{\"gridData\":{\"x\":11,\"y\":8,\"w\":26,\"h\":33,\"i\":\"57\"},\"version\":\"7.0.1\",\"panelIndex\":\"57\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_11\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[{\"meta\":{\"negate\":true,\"disabled\":true,\"alias\":\"Source AS Private\",\"type\":\"phrase\",\"key\":\"flow.src_autonomous_system\",\"value\":\"private\",\"params\":{\"query\":\"private\",\"type\":\"phrase\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"flow.src_autonomous_system\":{\"query\":\"private\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"negate\":true,\"disabled\":true,\"alias\":\"Destination AS Private\",\"type\":\"phrase\",\"key\":\"flow.dst_autonomous_system\",\"value\":\"private\",\"params\":{\"query\":\"private\",\"type\":\"phrase\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index\"},\"query\":{\"match\":{\"flow.dst_autonomous_system\":{\"query\":\"private\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "panel_0", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "8fee97e0-55b5-11e8-a1f3-452446793d46" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "e3c2e2c0-5607-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "77255120-55c6-11e8-a1f3-452446793d46" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "4c52f1f0-55c6-11e8-a1f3-452446793d46" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "1094b850-336b-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "9b135210-336c-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_7", + "type": "visualization", + "id": "066b9700-55c6-11e8-a1f3-452446793d46" + }, + { + "name": "panel_8", + "type": "visualization", + "id": "1a9184b0-55c6-11e8-a1f3-452446793d46" + }, + { + "name": "panel_9", + "type": "visualization", + "id": "88a5e860-55c6-11e8-a1f3-452446793d46" + }, + { + "name": "panel_10", + "type": "visualization", + "id": "97885520-55c6-11e8-a1f3-452446793d46" + }, + { + "name": "panel_11", + "type": "visualization", + "id": "819e7820-3374-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "a932b600-2fd2-11e7-99ed-49759aed30f5", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Geo Location (client/server)", + "hits": 0, + "description": "", + "panelsJSON": "[{\"gridData\":{\"x\":36,\"y\":3,\"w\":12,\"h\":11,\"i\":\"21\"},\"panelIndex\":\"21\",\"title\":\"Services (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{\"vis\":{\"legendOpen\":true}},\"gridData\":{\"x\":24,\"y\":3,\"w\":12,\"h\":11,\"i\":\"22\"},\"panelIndex\":\"22\",\"title\":\"Servers and Clients (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_1\"},{\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"27\"},\"panelIndex\":\"27\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{\"mapCenter\":[30.29701788337205,21.093750000000004],\"mapZoom\":2},\"gridData\":{\"x\":0,\"y\":14,\"w\":24,\"h\":27,\"i\":\"29\"},\"panelIndex\":\"29\",\"title\":\"Client Locations (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{\"mapCenter\":[29.6880527498568,22.148437500000004],\"mapZoom\":2},\"gridData\":{\"x\":24,\"y\":14,\"w\":24,\"h\":27,\"i\":\"30\"},\"panelIndex\":\"30\",\"title\":\"Server Locations (flow records) \",\"version\":\"6.6.0\",\"panelRefName\":\"panel_4\"},{\"gridData\":{\"x\":12,\"y\":3,\"w\":12,\"h\":11,\"i\":\"32\"},\"panelIndex\":\"32\",\"title\":\"Cities (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_5\"},{\"gridData\":{\"x\":0,\"y\":3,\"w\":12,\"h\":11,\"i\":\"33\"},\"panelIndex\":\"33\",\"title\":\"Countries (flow records)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_6\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":0,\"w\":29,\"h\":3,\"i\":\"34\"},\"panelIndex\":\"34\",\"version\":\"6.6.0\",\"title\":\"\",\"panelRefName\":\"panel_7\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":29,\"y\":0,\"w\":14,\"h\":3,\"i\":\"35\"},\"panelIndex\":\"35\",\"version\":\"6.6.0\",\"title\":\"\",\"panelRefName\":\"panel_8\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[{\"meta\":{\"negate\":false,\"disabled\":false,\"alias\":\"Public\",\"type\":\"phrase\",\"key\":\"flow.traffic_locality\",\"value\":\"public\",\"params\":{\"query\":\"public\",\"type\":\"phrase\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"flow.traffic_locality\":{\"query\":\"public\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "panel_0", + "type": "visualization", + "id": "be065300-801a-11e7-a69e-1db8cf608fe4" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "eada0e30-801f-11e7-8a72-651c4183643b" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "0b71ad10-5603-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "203cdb70-5603-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "849562d0-55be-11e8-a1f3-452446793d46" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "64d75bf0-55bf-11e8-a1f3-452446793d46" + }, + { + "name": "panel_7", + "type": "visualization", + "id": "f16133a0-336a-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_8", + "type": "visualization", + "id": "c0e6b360-336c-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "4b86b4c0-5628-11e8-b711-83a5f93b17f3", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Flows (src/dst)", + "hits": 0, + "description": "", + "panelsJSON": "[{\"panelIndex\":\"35\",\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"35\"},\"title\":\"\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_0\"},{\"panelIndex\":\"43\",\"gridData\":{\"x\":40,\"y\":3,\"w\":8,\"h\":5,\"i\":\"43\"},\"title\":\"\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_1\"},{\"panelIndex\":\"45\",\"gridData\":{\"x\":0,\"y\":3,\"w\":40,\"h\":5,\"i\":\"45\"},\"title\":\"\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_2\"},{\"panelIndex\":\"46\",\"gridData\":{\"x\":37,\"y\":30,\"w\":11,\"h\":11,\"i\":\"46\"},\"title\":\"Destinations (flow records)\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_3\"},{\"panelIndex\":\"48\",\"gridData\":{\"x\":0,\"y\":30,\"w\":11,\"h\":11,\"i\":\"48\"},\"title\":\"Sources (flow records)\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_4\"},{\"gridData\":{\"x\":0,\"y\":0,\"w\":29,\"h\":3,\"i\":\"52\"},\"version\":\"6.6.0\",\"panelIndex\":\"52\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_5\"},{\"gridData\":{\"x\":29,\"y\":0,\"w\":14,\"h\":3,\"i\":\"53\"},\"version\":\"6.6.0\",\"panelIndex\":\"53\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_6\"},{\"gridData\":{\"x\":37,\"y\":8,\"w\":11,\"h\":11,\"i\":\"54\"},\"version\":\"7.0.1\",\"panelIndex\":\"54\",\"embeddableConfig\":{},\"title\":\"Destinations (bytes)\",\"panelRefName\":\"panel_7\"},{\"gridData\":{\"x\":0,\"y\":8,\"w\":11,\"h\":11,\"i\":\"55\"},\"version\":\"7.0.1\",\"panelIndex\":\"55\",\"embeddableConfig\":{},\"title\":\"Sources (bytes)\",\"panelRefName\":\"panel_8\"},{\"gridData\":{\"x\":0,\"y\":19,\"w\":11,\"h\":11,\"i\":\"56\"},\"version\":\"7.0.1\",\"panelIndex\":\"56\",\"embeddableConfig\":{},\"title\":\"Sources (packets)\",\"panelRefName\":\"panel_9\"},{\"gridData\":{\"x\":37,\"y\":19,\"w\":11,\"h\":11,\"i\":\"58\"},\"version\":\"7.0.1\",\"panelIndex\":\"58\",\"embeddableConfig\":{},\"title\":\"Destinations (packets)\",\"panelRefName\":\"panel_10\"},{\"gridData\":{\"x\":11,\"y\":8,\"w\":26,\"h\":33,\"i\":\"59\"},\"version\":\"7.0.1\",\"panelIndex\":\"59\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_11\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "panel_0", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "8fee97e0-55b5-11e8-a1f3-452446793d46" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "17c29c50-55bd-11e8-a1f3-452446793d46" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "4f3525d0-2fc7-11e7-8936-6f5fd5520124" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "1e7d8770-2fc7-11e7-8936-6f5fd5520124" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "1094b850-336b-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "75a2aa30-336c-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_7", + "type": "visualization", + "id": "5fd2fe30-2fc7-11e7-8936-6f5fd5520124" + }, + { + "name": "panel_8", + "type": "visualization", + "id": "7c2cfd10-2fc7-11e7-8936-6f5fd5520124" + }, + { + "name": "panel_9", + "type": "visualization", + "id": "8a52f7a0-2fc7-11e7-8936-6f5fd5520124" + }, + { + "name": "panel_10", + "type": "visualization", + "id": "af1425a0-2fc7-11e7-8936-6f5fd5520124" + }, + { + "name": "panel_11", + "type": "visualization", + "id": "8dc8f0d0-3374-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "d7124e80-5625-11e8-b711-83a5f93b17f3", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Flows (client/server)", + "hits": 0, + "description": "", + "panelsJSON": "[{\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"35\"},\"panelIndex\":\"35\",\"title\":\"\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_0\"},{\"gridData\":{\"x\":0,\"y\":3,\"w\":40,\"h\":5,\"i\":\"36\"},\"panelIndex\":\"36\",\"title\":\"\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_1\"},{\"gridData\":{\"x\":40,\"y\":3,\"w\":8,\"h\":5,\"i\":\"43\"},\"panelIndex\":\"43\",\"title\":\"\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_2\"},{\"gridData\":{\"x\":0,\"y\":30,\"w\":11,\"h\":11,\"i\":\"45\"},\"panelIndex\":\"45\",\"title\":\"Clients (flow records)\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_3\"},{\"gridData\":{\"x\":37,\"y\":30,\"w\":11,\"h\":11,\"i\":\"46\"},\"panelIndex\":\"46\",\"title\":\"Servers (flow records)\",\"version\":\"6.3.2\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":0,\"w\":29,\"h\":3,\"i\":\"48\"},\"panelIndex\":\"48\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":29,\"y\":0,\"w\":14,\"h\":3,\"i\":\"49\"},\"panelIndex\":\"49\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_6\"},{\"gridData\":{\"x\":11,\"y\":8,\"w\":26,\"h\":33,\"i\":\"50\"},\"version\":\"7.0.1\",\"panelIndex\":\"50\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_7\"},{\"gridData\":{\"x\":0,\"y\":8,\"w\":11,\"h\":11,\"i\":\"51\"},\"version\":\"7.0.1\",\"panelIndex\":\"51\",\"embeddableConfig\":{},\"title\":\"Clients (bytes)\",\"panelRefName\":\"panel_8\"},{\"gridData\":{\"x\":0,\"y\":19,\"w\":11,\"h\":11,\"i\":\"52\"},\"version\":\"7.0.1\",\"panelIndex\":\"52\",\"embeddableConfig\":{},\"title\":\"Clients (packets)\",\"panelRefName\":\"panel_9\"},{\"gridData\":{\"x\":37,\"y\":8,\"w\":11,\"h\":11,\"i\":\"53\"},\"version\":\"7.0.1\",\"panelIndex\":\"53\",\"embeddableConfig\":{},\"title\":\"Servers (bytes)\",\"panelRefName\":\"panel_10\"},{\"gridData\":{\"x\":37,\"y\":19,\"w\":11,\"h\":11,\"i\":\"54\"},\"version\":\"7.0.1\",\"panelIndex\":\"54\",\"embeddableConfig\":{},\"title\":\"Servers (packets)\",\"panelRefName\":\"panel_11\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"*\"}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "panel_0", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "95799400-55b3-11e8-a1f3-452446793d46" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "8fee97e0-55b5-11e8-a1f3-452446793d46" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "69f4d440-8019-11e7-af24-27fa1061e1bd" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "aa56f4e0-801a-11e7-a69e-1db8cf608fe4" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "1094b850-336b-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "88535d00-336c-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_7", + "type": "visualization", + "id": "54525bd0-3373-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_8", + "type": "visualization", + "id": "37a8b330-8019-11e7-af24-27fa1061e1bd" + }, + { + "name": "panel_9", + "type": "visualization", + "id": "47bf0c10-8019-11e7-af24-27fa1061e1bd" + }, + { + "name": "panel_10", + "type": "visualization", + "id": "1c1f5550-801a-11e7-8b60-018ea0aa61a0" + }, + { + "name": "panel_11", + "type": "visualization", + "id": "fa3371f0-801a-11e7-b4bd-5b3ceedd298a" + } + ] + }, + { + "_id": "44d6d8c0-560b-11e8-b711-83a5f93b17f3", + "_type": "dashboard", + "_source": { + "title": "ElastiFlow: Top Applications", + "hits": 0, + "description": "", + "panelsJSON": "[{\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"gridData\":{\"x\":28,\"y\":18,\"w\":20,\"h\":32,\"i\":\"10\"},\"panelIndex\":\"10\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_0\"},{\"gridData\":{\"x\":43,\"y\":0,\"w\":5,\"h\":3,\"i\":\"18\"},\"panelIndex\":\"18\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_1\"},{\"gridData\":{\"x\":10,\"y\":3,\"w\":38,\"h\":15,\"i\":\"24\"},\"panelIndex\":\"24\",\"title\":\"Applications (bits/s)\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_2\"},{\"gridData\":{\"x\":0,\"y\":3,\"w\":10,\"h\":15,\"i\":\"25\"},\"panelIndex\":\"25\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_3\"},{\"gridData\":{\"x\":0,\"y\":18,\"w\":28,\"h\":32,\"i\":\"26\"},\"panelIndex\":\"26\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":0,\"w\":29,\"h\":3,\"i\":\"27\"},\"panelIndex\":\"27\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":29,\"y\":0,\"w\":14,\"h\":3,\"i\":\"28\"},\"panelIndex\":\"28\",\"title\":\"\",\"version\":\"6.6.0\",\"panelRefName\":\"panel_6\"}]", + "optionsJSON": "{\"darkTheme\":false,\"useMargins\":false}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"exists\":{\"field\":\"flow.application\"},\"meta\":{\"alias\":\"Application\",\"disabled\":false,\"key\":\"flow.application\",\"negate\":false,\"type\":\"exists\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}}],\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"*\"}}}}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "dashboard": "7.0.0" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "elastiflow-*" + }, + { + "name": "panel_0", + "type": "visualization", + "id": "bb92fa50-8020-11e7-bcae-4bd056c878e8" + }, + { + "name": "panel_1", + "type": "visualization", + "id": "AWFhGnANugC1WJLdzaom" + }, + { + "name": "panel_2", + "type": "visualization", + "id": "13b75a00-55cd-11e8-a695-171fb712da36" + }, + { + "name": "panel_3", + "type": "visualization", + "id": "72ac9770-560c-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_4", + "type": "visualization", + "id": "6aa2ae10-560d-11e8-b711-83a5f93b17f3" + }, + { + "name": "panel_5", + "type": "visualization", + "id": "30ff5d70-336b-11e9-aec0-c1d93190f676" + }, + { + "name": "panel_6", + "type": "visualization", + "id": "610605e0-336c-11e9-aec0-c1d93190f676" + } + ] + }, + { + "_id": "6aa2ae10-560d-11e8-b711-83a5f93b17f3", + "_type": "visualization", + "_source": { + "title": "ElastiFlow: Top Applications - table", + "visState": "{\"title\":\"ElastiFlow: Top Applications - table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":true,\"totalFunc\":\"sum\",\"showMetricsAtAllLevels\":false},\"aggs\":[{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.bytes\",\"customLabel\":\"Bytes\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow.packets\",\"customLabel\":\"Packets\"}},{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Flow Records\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.application\",\"size\":499,\"order\":\"desc\",\"orderBy\":\"2\",\"otherBucket\":true,\"otherBucketLabel\":\"other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Top Applications\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"flow.service_name\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"2\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Service\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true,\"default_field\":\"*\"}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + } + }, + "_meta": { + "savedObjectVersion": 2 + }, + "_migrationVersion": { + "visualization": "7.0.1" + }, + "_references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern", + "id": "elastiflow-*" + } + ] + } +] \ No newline at end of file diff --git a/logstash/elastiflow/conf.d/20_filter_10_begin.logstash.conf b/logstash/elastiflow/conf.d/20_filter_10_begin.logstash.conf index 248f9fb..f7f494a 100644 --- a/logstash/elastiflow/conf.d/20_filter_10_begin.logstash.conf +++ b/logstash/elastiflow/conf.d/20_filter_10_begin.logstash.conf @@ -27,7 +27,7 @@ filter { "[node][ipaddr]" => "%{host}" "[node][hostname]" => "%{host}" } - replace => { "@version" => "3.4.2" } + replace => { "@version" => "3.5.0" } } # Adjust data for Netflow and IPFIX being received on the same port. diff --git a/logstash/elastiflow/conf.d/30_output_10_single.logstash.conf b/logstash/elastiflow/conf.d/30_output_10_single.logstash.conf index 78a079e..122c2cf 100644 --- a/logstash/elastiflow/conf.d/30_output_10_single.logstash.conf +++ b/logstash/elastiflow/conf.d/30_output_10_single.logstash.conf @@ -25,9 +25,9 @@ output { #cacert => "/PATH/TO/CERT" user => "${ELASTIFLOW_ES_USER:elastic}" password => "${ELASTIFLOW_ES_PASSWD:changeme}" - index => "elastiflow-3.4.2-%{+YYYY.MM.dd}" + index => "elastiflow-3.5.0-%{+YYYY.MM.dd}" template => "${ELASTIFLOW_TEMPLATE_PATH:/etc/logstash/elastiflow/templates}/elastiflow.template.json" - template_name => "elastiflow-3.4.2" + template_name => "elastiflow-3.5.0" template_overwrite => "true" } } diff --git a/logstash/elastiflow/conf.d/30_output_20_multi.logstash.conf.disabled b/logstash/elastiflow/conf.d/30_output_20_multi.logstash.conf.disabled index 2cfe54a..587566c 100644 --- a/logstash/elastiflow/conf.d/30_output_20_multi.logstash.conf.disabled +++ b/logstash/elastiflow/conf.d/30_output_20_multi.logstash.conf.disabled @@ -25,9 +25,9 @@ output { #cacert => "/PATH/TO/CERT" user => "${ELASTIFLOW_ES_USER:elastic}" password => "${ELASTIFLOW_ES_PASSWD:changeme}" - index => "elastiflow-3.4.2-%{+YYYY.MM.dd}" + index => "elastiflow-3.5.0-%{+YYYY.MM.dd}" template => "${ELASTIFLOW_TEMPLATE_PATH:/etc/logstash/elastiflow/templates}/elastiflow.template.json" - template_name => "elastiflow-3.4.2" + template_name => "elastiflow-3.5.0" template_overwrite => "true" } } diff --git a/logstash/elastiflow/dictionaries/iana_service_names_tcp.yml b/logstash/elastiflow/dictionaries/iana_service_names_tcp.yml index 0df8880..461c158 100755 --- a/logstash/elastiflow/dictionaries/iana_service_names_tcp.yml +++ b/logstash/elastiflow/dictionaries/iana_service_names_tcp.yml @@ -2663,7 +2663,8 @@ "2997": rebol "2998": realsecure "2999": remoteware-un -"3000": hbci +#"3000": hbci +"3000": grafana "3001": origo-native "3002": exlm-agent "3003": cgms @@ -4700,7 +4701,8 @@ "6421": nim-wan "6432": pgbouncer "6442": tarp -"6443": sun-sr-https +#"6443": sun-sr-https +"6443": kubernetes-api "6444": sge-qmaster "6445": sge-execd "6446": mysql-proxy @@ -5065,9 +5067,11 @@ "8082": us-cli "8083": us-srv "8085": hbase-rest-info -"8086": d-s-n +#"8086": d-s-n +"8086": influxdb-http "8087": simplifymedia -"8088": radan-http +#"8088": radan-http +"8088": influxdb-rpc #"8091": jamlink "8091": couchbase-admin "8092": couchbase-api @@ -5189,7 +5193,8 @@ "8880": cddbp-alt "8881": galaxy4d "8883": secure-mqtt -"8888": ddi-tcp-1 +#"8888": ddi-tcp-1 +"8888": chronograf "8889": ddi-tcp-2 "8890": ddi-tcp-3 "8891": ddi-tcp-4 @@ -5213,7 +5218,8 @@ "8997": oracle-ms-ens "8998": canto-roboflow "8999": bctp -"9000": cslistener +#"9000": cslistener +"9000": kafka-manager "9001": etlservicemgr "9002": dynamid "9005": golem diff --git a/logstash/elastiflow/templates/elastiflow.template.json b/logstash/elastiflow/templates/elastiflow.template.json index 8322873..e996419 100755 --- a/logstash/elastiflow/templates/elastiflow.template.json +++ b/logstash/elastiflow/templates/elastiflow.template.json @@ -1,7 +1,7 @@ { "order": 0, - "version": 30402, - "index_patterns": "elastiflow-3.4.2-*", + "version": 30500, + "index_patterns": "elastiflow-3.5.0-*", "settings": { "index": { "number_of_shards": 3, @@ -12,28653 +12,28703 @@ "total_fields" : { "limit": 5000 } + }, + "query": { + "default_field": [ + "@timestamp", + "@version", + "event.host", + "event.type", + "flow.application", + "flow.autonomous_system", + "flow.bgp_next_hop", + "flow.bgp_valid_state", + "flow.city", + "flow.country", + "flow.country_code", + "flow.direction", + "flow.dst_addr", + "flow.dst_addr_trans", + "flow.dst_asn", + "flow.dst_hostname", + "flow.dst_mac", + "flow.dst_mask_len", + "flow.dst_port", + "flow.dst_port_trans", + "flow.dst_port_name", + "flow.input_ifname", + "flow.input_snmp", + "flow.ip_protocol", + "flow.ip_version", + "flow.next_hop", + "flow.output_ifname", + "flow.output_snmp", + "flow.rep_tags", + "flow.sampling_interval", + "flow.service_name", + "flow.src_addr", + "flow.src_addr_trans", + "flow.src_asn", + "flow.src_hostname", + "flow.src_mac", + "flow.src_mask_len", + "flow.src_port", + "flow.src_port_trans", + "flow.src_port_name", + "flow.tcp_flags", + "flow.tos", + "flow.traffic_direction", + "flow.traffic_locality", + "flow.vlan", + "node.ipaddr", + "node.hostname", + "tags" + ] } } }, "mappings": { - "doc": { - "numeric_detection": true, - "dynamic_templates": [ - { - "ipfix.octetDeltaCount": { - "path_match": "ipfix.octetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.packetDeltaCount": { - "path_match": "ipfix.packetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.deltaFlowCount": { - "path_match": "ipfix.deltaFlowCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.protocolIdentifier": { - "path_match": "ipfix.protocolIdentifier", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipClassOfService": { - "path_match": "ipfix.ipClassOfService", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpControlBits": { - "path_match": "ipfix.tcpControlBits", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sourceTransportPort": { - "path_match": "ipfix.sourceTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sourceIPv4Address": { - "path_match": "ipfix.sourceIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sourceIPv4PrefixLength": { - "path_match": "ipfix.sourceIPv4PrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ingressInterface": { - "path_match": "ipfix.ingressInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.destinationTransportPort": { - "path_match": "ipfix.destinationTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.destinationIPv4Address": { - "path_match": "ipfix.destinationIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.destinationIPv4PrefixLength": { - "path_match": "ipfix.destinationIPv4PrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.egressInterface": { - "path_match": "ipfix.egressInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipNextHopIPv4Address": { - "path_match": "ipfix.ipNextHopIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.bgpSourceAsNumber": { - "path_match": "ipfix.bgpSourceAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.bgpDestinationAsNumber": { - "path_match": "ipfix.bgpDestinationAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.bgpNextHopIPv4Address": { - "path_match": "ipfix.bgpNextHopIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.postMCastPacketDeltaCount": { - "path_match": "ipfix.postMCastPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postMCastOctetDeltaCount": { - "path_match": "ipfix.postMCastOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowEndSysUpTime": { - "path_match": "ipfix.flowEndSysUpTime", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowStartSysUpTime": { - "path_match": "ipfix.flowStartSysUpTime", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postOctetDeltaCount": { - "path_match": "ipfix.postOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postPacketDeltaCount": { - "path_match": "ipfix.postPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.minimumIpTotalLength": { - "path_match": "ipfix.minimumIpTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maximumIpTotalLength": { - "path_match": "ipfix.maximumIpTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sourceIPv6Address": { - "path_match": "ipfix.sourceIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.destinationIPv6Address": { - "path_match": "ipfix.destinationIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sourceIPv6PrefixLength": { - "path_match": "ipfix.sourceIPv6PrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.destinationIPv6PrefixLength": { - "path_match": "ipfix.destinationIPv6PrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowLabelIPv6": { - "path_match": "ipfix.flowLabelIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.icmpTypeCodeIPv4": { - "path_match": "ipfix.icmpTypeCodeIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.igmpType": { - "path_match": "ipfix.igmpType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingInterval": { - "path_match": "ipfix.samplingInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingAlgorithm": { - "path_match": "ipfix.samplingAlgorithm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowActiveTimeout": { - "path_match": "ipfix.flowActiveTimeout", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowIdleTimeout": { - "path_match": "ipfix.flowIdleTimeout", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.engineType": { - "path_match": "ipfix.engineType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.engineId": { - "path_match": "ipfix.engineId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exportedOctetTotalCount": { - "path_match": "ipfix.exportedOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exportedMessageTotalCount": { - "path_match": "ipfix.exportedMessageTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exportedFlowRecordTotalCount": { - "path_match": "ipfix.exportedFlowRecordTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipv4RouterSc": { - "path_match": "ipfix.ipv4RouterSc", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sourceIPv4Prefix": { - "path_match": "ipfix.sourceIPv4Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.destinationIPv4Prefix": { - "path_match": "ipfix.destinationIPv4Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.mplsTopLabelType": { - "path_match": "ipfix.mplsTopLabelType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsTopLabelIPv4Address": { - "path_match": "ipfix.mplsTopLabelIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.samplerId": { - "path_match": "ipfix.samplerId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplerMode": { - "path_match": "ipfix.samplerMode", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplerRandomInterval": { - "path_match": "ipfix.samplerRandomInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.classId": { - "path_match": "ipfix.classId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.minimumTTL": { - "path_match": "ipfix.minimumTTL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maximumTTL": { - "path_match": "ipfix.maximumTTL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.fragmentIdentification": { - "path_match": "ipfix.fragmentIdentification", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postIpClassOfService": { - "path_match": "ipfix.postIpClassOfService", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sourceMacAddress": { - "path_match": "ipfix.sourceMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.postDestinationMacAddress": { - "path_match": "ipfix.postDestinationMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.vlanId": { - "path_match": "ipfix.vlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postVlanId": { - "path_match": "ipfix.postVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipVersion": { - "path_match": "ipfix.ipVersion", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowDirection": { - "path_match": "ipfix.flowDirection", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipNextHopIPv6Address": { - "path_match": "ipfix.ipNextHopIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.bgpNextHopIPv6Address": { - "path_match": "ipfix.bgpNextHopIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ipv6ExtensionHeaders": { - "path_match": "ipfix.ipv6ExtensionHeaders", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.transportPacketLoss": { - "path_match": "ipfix.transportPacketLoss", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.transportUnreachability": { - "path_match": "ipfix.transportUnreachability", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.transportLatency": { - "path_match": "ipfix.transportLatency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsTopLabelStackSection": { - "path_match": "ipfix.mplsTopLabelStackSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection2": { - "path_match": "ipfix.mplsLabelStackSection2", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection3": { - "path_match": "ipfix.mplsLabelStackSection3", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection4": { - "path_match": "ipfix.mplsLabelStackSection4", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection5": { - "path_match": "ipfix.mplsLabelStackSection5", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection6": { - "path_match": "ipfix.mplsLabelStackSection6", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection7": { - "path_match": "ipfix.mplsLabelStackSection7", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection8": { - "path_match": "ipfix.mplsLabelStackSection8", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection9": { - "path_match": "ipfix.mplsLabelStackSection9", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection10": { - "path_match": "ipfix.mplsLabelStackSection10", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.destinationMacAddress": { - "path_match": "ipfix.destinationMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.postSourceMacAddress": { - "path_match": "ipfix.postSourceMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.interfaceName": { - "path_match": "ipfix.interfaceName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.interfaceDescription": { - "path_match": "ipfix.interfaceDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.samplerName": { - "path_match": "ipfix.samplerName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.octetTotalCount": { - "path_match": "ipfix.octetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.packetTotalCount": { - "path_match": "ipfix.packetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flagsAndSamplerId": { - "path_match": "ipfix.flagsAndSamplerId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.fragmentOffset": { - "path_match": "ipfix.fragmentOffset", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.forwardingStatus": { - "path_match": "ipfix.forwardingStatus", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsVpnRouteDistinguisher": { - "path_match": "ipfix.mplsVpnRouteDistinguisher", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsTopLabelPrefixLength": { - "path_match": "ipfix.mplsTopLabelPrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.srcTrafficIndex": { - "path_match": "ipfix.srcTrafficIndex", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dstTrafficIndex": { - "path_match": "ipfix.dstTrafficIndex", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.applicationDescription": { - "path_match": "ipfix.applicationDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.applicationId": { - "path_match": "ipfix.applicationId", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.applicationName": { - "path_match": "ipfix.applicationName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.subApplicationTag": { - "path_match": "ipfix.subApplicationTag", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.postIpDiffServCodePoint": { - "path_match": "ipfix.postIpDiffServCodePoint", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.multicastReplicationFactor": { - "path_match": "ipfix.multicastReplicationFactor", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.className": { - "path_match": "ipfix.className", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.classificationEngineId": { - "path_match": "ipfix.classificationEngineId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2packetSectionOffset": { - "path_match": "ipfix.layer2packetSectionOffset", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2packetSectionSize": { - "path_match": "ipfix.layer2packetSectionSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2packetSectionData": { - "path_match": "ipfix.layer2packetSectionData", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.applicationVersion": { - "path_match": "ipfix.applicationVersion", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.applicationVersionName": { - "path_match": "ipfix.applicationVersionName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.applicationVendor": { - "path_match": "ipfix.applicationVendor", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.subApplicationName": { - "path_match": "ipfix.subApplicationName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.subApplicationDescription": { - "path_match": "ipfix.subApplicationDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.templateParameterRangeEnd": { - "path_match": "ipfix.templateParameterRangeEnd", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.bgpNextAdjacentAsNumber": { - "path_match": "ipfix.bgpNextAdjacentAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.bgpPrevAdjacentAsNumber": { - "path_match": "ipfix.bgpPrevAdjacentAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exporterIPv4Address": { - "path_match": "ipfix.exporterIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.exporterIPv6Address": { - "path_match": "ipfix.exporterIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.droppedOctetDeltaCount": { - "path_match": "ipfix.droppedOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.droppedPacketDeltaCount": { - "path_match": "ipfix.droppedPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.droppedOctetTotalCount": { - "path_match": "ipfix.droppedOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.droppedPacketTotalCount": { - "path_match": "ipfix.droppedPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowEndReason": { - "path_match": "ipfix.flowEndReason", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.commonPropertiesId": { - "path_match": "ipfix.commonPropertiesId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.observationPointId": { - "path_match": "ipfix.observationPointId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.icmpTypeCodeIPv6": { - "path_match": "ipfix.icmpTypeCodeIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsTopLabelIPv6Address": { - "path_match": "ipfix.mplsTopLabelIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.lineCardId": { - "path_match": "ipfix.lineCardId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.portId": { - "path_match": "ipfix.portId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.meteringProcessId": { - "path_match": "ipfix.meteringProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exportingProcessId": { - "path_match": "ipfix.exportingProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.templateId": { - "path_match": "ipfix.templateId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.wlanChannelId": { - "path_match": "ipfix.wlanChannelId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.wlanSSID": { - "path_match": "ipfix.wlanSSID", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.flowId": { - "path_match": "ipfix.flowId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.observationDomainId": { - "path_match": "ipfix.observationDomainId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowStartSeconds": { - "path_match": "ipfix.flowStartSeconds", - "mapping": { - "type": "date" - } - } - }, - { - "ipfix.flowEndSeconds": { - "path_match": "ipfix.flowEndSeconds", - "mapping": { - "type": "date" - } - } - }, - { - "ipfix.flowStartMilliseconds": { - "path_match": "ipfix.flowStartMilliseconds", - "mapping": { - "type": "date" - } - } - }, - { - "ipfix.flowEndMilliseconds": { - "path_match": "ipfix.flowEndMilliseconds", - "mapping": { - "type": "date" - } - } - }, - { - "ipfix.flowStartMicroseconds": { - "path_match": "ipfix.flowStartMicroseconds", - "mapping": { - "type": "date" - } - } - }, - { - "ipfix.flowEndMicroseconds": { - "path_match": "ipfix.flowEndMicroseconds", - "mapping": { - "type": "date" - } - } - }, - { - "ipfix.flowStartNanoseconds": { - "path_match": "ipfix.flowStartNanoseconds", - "mapping": { - "type": "date" - } - } - }, - { - "ipfix.flowEndNanoseconds": { - "path_match": "ipfix.flowEndNanoseconds", - "mapping": { - "type": "date" - } - } - }, - { - "ipfix.flowStartDeltaMicroseconds": { - "path_match": "ipfix.flowStartDeltaMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowEndDeltaMicroseconds": { - "path_match": "ipfix.flowEndDeltaMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.systemInitTimeMilliseconds": { - "path_match": "ipfix.systemInitTimeMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowDurationMilliseconds": { - "path_match": "ipfix.flowDurationMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowDurationMicroseconds": { - "path_match": "ipfix.flowDurationMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.observedFlowTotalCount": { - "path_match": "ipfix.observedFlowTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ignoredPacketTotalCount": { - "path_match": "ipfix.ignoredPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ignoredOctetTotalCount": { - "path_match": "ipfix.ignoredOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.notSentFlowTotalCount": { - "path_match": "ipfix.notSentFlowTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.notSentPacketTotalCount": { - "path_match": "ipfix.notSentPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.notSentOctetTotalCount": { - "path_match": "ipfix.notSentOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.destinationIPv6Prefix": { - "path_match": "ipfix.destinationIPv6Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sourceIPv6Prefix": { - "path_match": "ipfix.sourceIPv6Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.postOctetTotalCount": { - "path_match": "ipfix.postOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postPacketTotalCount": { - "path_match": "ipfix.postPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowKeyIndicator": { - "path_match": "ipfix.flowKeyIndicator", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postMCastPacketTotalCount": { - "path_match": "ipfix.postMCastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postMCastOctetTotalCount": { - "path_match": "ipfix.postMCastOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.icmpTypeIPv4": { - "path_match": "ipfix.icmpTypeIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.icmpCodeIPv4": { - "path_match": "ipfix.icmpCodeIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.icmpTypeIPv6": { - "path_match": "ipfix.icmpTypeIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.icmpCodeIPv6": { - "path_match": "ipfix.icmpCodeIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.udpSourcePort": { - "path_match": "ipfix.udpSourcePort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.udpDestinationPort": { - "path_match": "ipfix.udpDestinationPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpSourcePort": { - "path_match": "ipfix.tcpSourcePort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpDestinationPort": { - "path_match": "ipfix.tcpDestinationPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpSequenceNumber": { - "path_match": "ipfix.tcpSequenceNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpAcknowledgementNumber": { - "path_match": "ipfix.tcpAcknowledgementNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpWindowSize": { - "path_match": "ipfix.tcpWindowSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpUrgentPointer": { - "path_match": "ipfix.tcpUrgentPointer", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpHeaderLength": { - "path_match": "ipfix.tcpHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipHeaderLength": { - "path_match": "ipfix.ipHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.totalLengthIPv4": { - "path_match": "ipfix.totalLengthIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.payloadLengthIPv6": { - "path_match": "ipfix.payloadLengthIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipTTL": { - "path_match": "ipfix.ipTTL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.nextHeaderIPv6": { - "path_match": "ipfix.nextHeaderIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsPayloadLength": { - "path_match": "ipfix.mplsPayloadLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipDiffServCodePoint": { - "path_match": "ipfix.ipDiffServCodePoint", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipPrecedence": { - "path_match": "ipfix.ipPrecedence", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.fragmentFlags": { - "path_match": "ipfix.fragmentFlags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.octetDeltaSumOfSquares": { - "path_match": "ipfix.octetDeltaSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.octetTotalSumOfSquares": { - "path_match": "ipfix.octetTotalSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsTopLabelTTL": { - "path_match": "ipfix.mplsTopLabelTTL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsLabelStackLength": { - "path_match": "ipfix.mplsLabelStackLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsLabelStackDepth": { - "path_match": "ipfix.mplsLabelStackDepth", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsTopLabelExp": { - "path_match": "ipfix.mplsTopLabelExp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipPayloadLength": { - "path_match": "ipfix.ipPayloadLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.udpMessageLength": { - "path_match": "ipfix.udpMessageLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.isMulticast": { - "path_match": "ipfix.isMulticast", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipv4IHL": { - "path_match": "ipfix.ipv4IHL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipv4Options": { - "path_match": "ipfix.ipv4Options", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpOptions": { - "path_match": "ipfix.tcpOptions", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.collectorIPv4Address": { - "path_match": "ipfix.collectorIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.collectorIPv6Address": { - "path_match": "ipfix.collectorIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.collectorTransportPort": { - "path_match": "ipfix.collectorTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exportInterface": { - "path_match": "ipfix.exportInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exportProtocolVersion": { - "path_match": "ipfix.exportProtocolVersion", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exportTransportProtocol": { - "path_match": "ipfix.exportTransportProtocol", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exporterTransportPort": { - "path_match": "ipfix.exporterTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpSynTotalCount": { - "path_match": "ipfix.tcpSynTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpFinTotalCount": { - "path_match": "ipfix.tcpFinTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpRstTotalCount": { - "path_match": "ipfix.tcpRstTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpPshTotalCount": { - "path_match": "ipfix.tcpPshTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpAckTotalCount": { - "path_match": "ipfix.tcpAckTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpUrgTotalCount": { - "path_match": "ipfix.tcpUrgTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipTotalLength": { - "path_match": "ipfix.ipTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postNATSourceIPv4Address": { - "path_match": "ipfix.postNATSourceIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.postNATDestinationIPv4Address": { - "path_match": "ipfix.postNATDestinationIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.postNAPTSourceTransportPort": { - "path_match": "ipfix.postNAPTSourceTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postNAPTDestinationTransportPort": { - "path_match": "ipfix.postNAPTDestinationTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.natOriginatingAddressRealm": { - "path_match": "ipfix.natOriginatingAddressRealm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.natEvent": { - "path_match": "ipfix.natEvent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.initiatorOctets": { - "path_match": "ipfix.initiatorOctets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.responderOctets": { - "path_match": "ipfix.responderOctets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.firewallEvent": { - "path_match": "ipfix.firewallEvent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ingressVRFID": { - "path_match": "ipfix.ingressVRFID", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.egressVRFID": { - "path_match": "ipfix.egressVRFID", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.VRFname": { - "path_match": "ipfix.VRFname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.postMplsTopLabelExp": { - "path_match": "ipfix.postMplsTopLabelExp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpWindowScale": { - "path_match": "ipfix.tcpWindowScale", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.biflowDirection": { - "path_match": "ipfix.biflowDirection", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ethernetHeaderLength": { - "path_match": "ipfix.ethernetHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ethernetPayloadLength": { - "path_match": "ipfix.ethernetPayloadLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ethernetTotalLength": { - "path_match": "ipfix.ethernetTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qVlanId": { - "path_match": "ipfix.dot1qVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qPriority": { - "path_match": "ipfix.dot1qPriority", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qCustomerVlanId": { - "path_match": "ipfix.dot1qCustomerVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qCustomerPriority": { - "path_match": "ipfix.dot1qCustomerPriority", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.metroEvcId": { - "path_match": "ipfix.metroEvcId", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.metroEvcType": { - "path_match": "ipfix.metroEvcType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.pseudoWireId": { - "path_match": "ipfix.pseudoWireId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.pseudoWireType": { - "path_match": "ipfix.pseudoWireType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.pseudoWireControlWord": { - "path_match": "ipfix.pseudoWireControlWord", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ingressPhysicalInterface": { - "path_match": "ipfix.ingressPhysicalInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.egressPhysicalInterface": { - "path_match": "ipfix.egressPhysicalInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postDot1qVlanId": { - "path_match": "ipfix.postDot1qVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postDot1qCustomerVlanId": { - "path_match": "ipfix.postDot1qCustomerVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ethernetType": { - "path_match": "ipfix.ethernetType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postIpPrecedence": { - "path_match": "ipfix.postIpPrecedence", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.collectionTimeMilliseconds": { - "path_match": "ipfix.collectionTimeMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exportSctpStreamId": { - "path_match": "ipfix.exportSctpStreamId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxExportSeconds": { - "path_match": "ipfix.maxExportSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxFlowEndSeconds": { - "path_match": "ipfix.maxFlowEndSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.messageMD5Checksum": { - "path_match": "ipfix.messageMD5Checksum", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.messageScope": { - "path_match": "ipfix.messageScope", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.minExportSeconds": { - "path_match": "ipfix.minExportSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.minFlowStartSeconds": { - "path_match": "ipfix.minFlowStartSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.opaqueOctets": { - "path_match": "ipfix.opaqueOctets", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sessionScope": { - "path_match": "ipfix.sessionScope", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxFlowEndMicroseconds": { - "path_match": "ipfix.maxFlowEndMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxFlowEndMilliseconds": { - "path_match": "ipfix.maxFlowEndMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxFlowEndNanoseconds": { - "path_match": "ipfix.maxFlowEndNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.minFlowStartMicroseconds": { - "path_match": "ipfix.minFlowStartMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.minFlowStartMilliseconds": { - "path_match": "ipfix.minFlowStartMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.minFlowStartNanoseconds": { - "path_match": "ipfix.minFlowStartNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.collectorCertificate": { - "path_match": "ipfix.collectorCertificate", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.exporterCertificate": { - "path_match": "ipfix.exporterCertificate", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.dataRecordsReliability": { - "path_match": "ipfix.dataRecordsReliability", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.observationPointType": { - "path_match": "ipfix.observationPointType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.newConnectionDeltaCount": { - "path_match": "ipfix.newConnectionDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.connectionSumDurationSeconds": { - "path_match": "ipfix.connectionSumDurationSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.connectionTransactionId": { - "path_match": "ipfix.connectionTransactionId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postNATSourceIPv6Address": { - "path_match": "ipfix.postNATSourceIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.postNATDestinationIPv6Address": { - "path_match": "ipfix.postNATDestinationIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.natPoolId": { - "path_match": "ipfix.natPoolId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.natPoolName": { - "path_match": "ipfix.natPoolName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.anonymizationFlags": { - "path_match": "ipfix.anonymizationFlags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.anonymizationTechnique": { - "path_match": "ipfix.anonymizationTechnique", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.informationElementIndex": { - "path_match": "ipfix.informationElementIndex", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.p2pTechnology": { - "path_match": "ipfix.p2pTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.tunnelTechnology": { - "path_match": "ipfix.tunnelTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.encryptedTechnology": { - "path_match": "ipfix.encryptedTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.bgpValidityState": { - "path_match": "ipfix.bgpValidityState", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.IPSecSPI": { - "path_match": "ipfix.IPSecSPI", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.greKey": { - "path_match": "ipfix.greKey", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.natType": { - "path_match": "ipfix.natType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.initiatorPackets": { - "path_match": "ipfix.initiatorPackets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.responderPackets": { - "path_match": "ipfix.responderPackets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.observationDomainName": { - "path_match": "ipfix.observationDomainName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.selectionSequenceId": { - "path_match": "ipfix.selectionSequenceId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.selectorId": { - "path_match": "ipfix.selectorId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.informationElementId": { - "path_match": "ipfix.informationElementId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.selectorAlgorithm": { - "path_match": "ipfix.selectorAlgorithm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingPacketInterval": { - "path_match": "ipfix.samplingPacketInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingPacketSpace": { - "path_match": "ipfix.samplingPacketSpace", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingTimeInterval": { - "path_match": "ipfix.samplingTimeInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingTimeSpace": { - "path_match": "ipfix.samplingTimeSpace", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingSize": { - "path_match": "ipfix.samplingSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingPopulation": { - "path_match": "ipfix.samplingPopulation", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingProbability": { - "path_match": "ipfix.samplingProbability", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.dataLinkFrameSize": { - "path_match": "ipfix.dataLinkFrameSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipHeaderPacketSection": { - "path_match": "ipfix.ipHeaderPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ipPayloadPacketSection": { - "path_match": "ipfix.ipPayloadPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.dataLinkFrameSection": { - "path_match": "ipfix.dataLinkFrameSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection": { - "path_match": "ipfix.mplsLabelStackSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsPayloadPacketSection": { - "path_match": "ipfix.mplsPayloadPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.selectorIdTotalPktsObserved": { - "path_match": "ipfix.selectorIdTotalPktsObserved", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.selectorIdTotalPktsSelected": { - "path_match": "ipfix.selectorIdTotalPktsSelected", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.absoluteError": { - "path_match": "ipfix.absoluteError", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.relativeError": { - "path_match": "ipfix.relativeError", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.observationTimeSeconds": { - "path_match": "ipfix.observationTimeSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.observationTimeMilliseconds": { - "path_match": "ipfix.observationTimeMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.observationTimeMicroseconds": { - "path_match": "ipfix.observationTimeMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.observationTimeNanoseconds": { - "path_match": "ipfix.observationTimeNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.digestHashValue": { - "path_match": "ipfix.digestHashValue", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashIPPayloadOffset": { - "path_match": "ipfix.hashIPPayloadOffset", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashIPPayloadSize": { - "path_match": "ipfix.hashIPPayloadSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashOutputRangeMin": { - "path_match": "ipfix.hashOutputRangeMin", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashOutputRangeMax": { - "path_match": "ipfix.hashOutputRangeMax", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashSelectedRangeMin": { - "path_match": "ipfix.hashSelectedRangeMin", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashSelectedRangeMax": { - "path_match": "ipfix.hashSelectedRangeMax", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashDigestOutput": { - "path_match": "ipfix.hashDigestOutput", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashInitialiserValue": { - "path_match": "ipfix.hashInitialiserValue", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.selectorName": { - "path_match": "ipfix.selectorName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.upperCILimit": { - "path_match": "ipfix.upperCILimit", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.lowerCILimit": { - "path_match": "ipfix.lowerCILimit", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.confidenceLevel": { - "path_match": "ipfix.confidenceLevel", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.informationElementDataType": { - "path_match": "ipfix.informationElementDataType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.informationElementDescription": { - "path_match": "ipfix.informationElementDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.informationElementName": { - "path_match": "ipfix.informationElementName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.informationElementRangeBegin": { - "path_match": "ipfix.informationElementRangeBegin", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.informationElementRangeEnd": { - "path_match": "ipfix.informationElementRangeEnd", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.informationElementSemantics": { - "path_match": "ipfix.informationElementSemantics", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.informationElementUnits": { - "path_match": "ipfix.informationElementUnits", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.privateEnterpriseNumber": { - "path_match": "ipfix.privateEnterpriseNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.virtualStationInterfaceId": { - "path_match": "ipfix.virtualStationInterfaceId", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.virtualStationInterfaceName": { - "path_match": "ipfix.virtualStationInterfaceName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.virtualStationUUID": { - "path_match": "ipfix.virtualStationUUID", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.virtualStationName": { - "path_match": "ipfix.virtualStationName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.layer2SegmentId": { - "path_match": "ipfix.layer2SegmentId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2OctetDeltaCount": { - "path_match": "ipfix.layer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2OctetTotalCount": { - "path_match": "ipfix.layer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ingressUnicastPacketTotalCount": { - "path_match": "ipfix.ingressUnicastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ingressMulticastPacketTotalCount": { - "path_match": "ipfix.ingressMulticastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ingressBroadcastPacketTotalCount": { - "path_match": "ipfix.ingressBroadcastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.egressUnicastPacketTotalCount": { - "path_match": "ipfix.egressUnicastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.egressBroadcastPacketTotalCount": { - "path_match": "ipfix.egressBroadcastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.monitoringIntervalStartMilliSeconds": { - "path_match": "ipfix.monitoringIntervalStartMilliSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.monitoringIntervalEndMilliSeconds": { - "path_match": "ipfix.monitoringIntervalEndMilliSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.portRangeStart": { - "path_match": "ipfix.portRangeStart", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.portRangeEnd": { - "path_match": "ipfix.portRangeEnd", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.portRangeStepSize": { - "path_match": "ipfix.portRangeStepSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.portRangeNumPorts": { - "path_match": "ipfix.portRangeNumPorts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.staMacAddress": { - "path_match": "ipfix.staMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.staIPv4Address": { - "path_match": "ipfix.staIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.wtpMacAddress": { - "path_match": "ipfix.wtpMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ingressInterfaceType": { - "path_match": "ipfix.ingressInterfaceType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.egressInterfaceType": { - "path_match": "ipfix.egressInterfaceType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.rtpSequenceNumber": { - "path_match": "ipfix.rtpSequenceNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.userName": { - "path_match": "ipfix.userName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.applicationCategoryName": { - "path_match": "ipfix.applicationCategoryName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.applicationSubCategoryName": { - "path_match": "ipfix.applicationSubCategoryName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.applicationGroupName": { - "path_match": "ipfix.applicationGroupName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.originalFlowsPresent": { - "path_match": "ipfix.originalFlowsPresent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.originalFlowsInitiated": { - "path_match": "ipfix.originalFlowsInitiated", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.originalFlowsCompleted": { - "path_match": "ipfix.originalFlowsCompleted", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.distinctCountOfSourceIPAddress": { - "path_match": "ipfix.distinctCountOfSourceIPAddress", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.distinctCountOfDestinationIPAddress": { - "path_match": "ipfix.distinctCountOfDestinationIPAddress", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.distinctCountOfSourceIPv4Address": { - "path_match": "ipfix.distinctCountOfSourceIPv4Address", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.distinctCountOfDestinationIPv4Address": { - "path_match": "ipfix.distinctCountOfDestinationIPv4Address", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.distinctCountOfSourceIPv6Address": { - "path_match": "ipfix.distinctCountOfSourceIPv6Address", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.distinctCountOfDestinationIPv6Address": { - "path_match": "ipfix.distinctCountOfDestinationIPv6Address", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.valueDistributionMethod": { - "path_match": "ipfix.valueDistributionMethod", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.rfc3550JitterMilliseconds": { - "path_match": "ipfix.rfc3550JitterMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.rfc3550JitterMicroseconds": { - "path_match": "ipfix.rfc3550JitterMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.rfc3550JitterNanoseconds": { - "path_match": "ipfix.rfc3550JitterNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qDEI": { - "path_match": "ipfix.dot1qDEI", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qCustomerDEI": { - "path_match": "ipfix.dot1qCustomerDEI", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowSelectorAlgorithm": { - "path_match": "ipfix.flowSelectorAlgorithm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowSelectedOctetDeltaCount": { - "path_match": "ipfix.flowSelectedOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowSelectedPacketDeltaCount": { - "path_match": "ipfix.flowSelectedPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowSelectedFlowDeltaCount": { - "path_match": "ipfix.flowSelectedFlowDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.selectorIDTotalFlowsObserved": { - "path_match": "ipfix.selectorIDTotalFlowsObserved", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.selectorIDTotalFlowsSelected": { - "path_match": "ipfix.selectorIDTotalFlowsSelected", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingFlowInterval": { - "path_match": "ipfix.samplingFlowInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingFlowSpacing": { - "path_match": "ipfix.samplingFlowSpacing", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowSamplingTimeInterval": { - "path_match": "ipfix.flowSamplingTimeInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowSamplingTimeSpacing": { - "path_match": "ipfix.flowSamplingTimeSpacing", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashFlowDomain": { - "path_match": "ipfix.hashFlowDomain", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.transportOctetDeltaCount": { - "path_match": "ipfix.transportOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.transportPacketDeltaCount": { - "path_match": "ipfix.transportPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.originalExporterIPv4Address": { - "path_match": "ipfix.originalExporterIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.originalExporterIPv6Address": { - "path_match": "ipfix.originalExporterIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.originalObservationDomainId": { - "path_match": "ipfix.originalObservationDomainId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.intermediateProcessId": { - "path_match": "ipfix.intermediateProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ignoredDataRecordTotalCount": { - "path_match": "ipfix.ignoredDataRecordTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dataLinkFrameType": { - "path_match": "ipfix.dataLinkFrameType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sectionOffset": { - "path_match": "ipfix.sectionOffset", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sectionExportedOctets": { - "path_match": "ipfix.sectionExportedOctets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qServiceInstanceTag": { - "path_match": "ipfix.dot1qServiceInstanceTag", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.dot1qServiceInstanceId": { - "path_match": "ipfix.dot1qServiceInstanceId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qServiceInstancePriority": { - "path_match": "ipfix.dot1qServiceInstancePriority", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qCustomerSourceMacAddress": { - "path_match": "ipfix.dot1qCustomerSourceMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.dot1qCustomerDestinationMacAddress": { - "path_match": "ipfix.dot1qCustomerDestinationMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.postLayer2OctetDeltaCount": { - "path_match": "ipfix.postLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postMCastLayer2OctetDeltaCount": { - "path_match": "ipfix.postMCastLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postLayer2OctetTotalCount": { - "path_match": "ipfix.postLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postMCastLayer2OctetTotalCount": { - "path_match": "ipfix.postMCastLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.minimumLayer2TotalLength": { - "path_match": "ipfix.minimumLayer2TotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maximumLayer2TotalLength": { - "path_match": "ipfix.maximumLayer2TotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.droppedLayer2OctetDeltaCount": { - "path_match": "ipfix.droppedLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.droppedLayer2OctetTotalCount": { - "path_match": "ipfix.droppedLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ignoredLayer2OctetTotalCount": { - "path_match": "ipfix.ignoredLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.notSentLayer2OctetTotalCount": { - "path_match": "ipfix.notSentLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2OctetDeltaSumOfSquares": { - "path_match": "ipfix.layer2OctetDeltaSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2OctetTotalSumOfSquares": { - "path_match": "ipfix.layer2OctetTotalSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2FrameDeltaCount": { - "path_match": "ipfix.layer2FrameDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2FrameTotalCount": { - "path_match": "ipfix.layer2FrameTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.pseudoWireDestinationIPv4Address": { - "path_match": "ipfix.pseudoWireDestinationIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ignoredLayer2FrameTotalCount": { - "path_match": "ipfix.ignoredLayer2FrameTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibObjectValueInteger": { - "path_match": "ipfix.mibObjectValueInteger", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibObjectValueOctetString": { - "path_match": "ipfix.mibObjectValueOctetString", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibObjectValueOID": { - "path_match": "ipfix.mibObjectValueOID", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibObjectValueBits": { - "path_match": "ipfix.mibObjectValueBits", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibObjectValueIPAddress": { - "path_match": "ipfix.mibObjectValueIPAddress", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.mibObjectValueCounter": { - "path_match": "ipfix.mibObjectValueCounter", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibObjectValueGauge": { - "path_match": "ipfix.mibObjectValueGauge", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibObjectValueTimeTicks": { - "path_match": "ipfix.mibObjectValueTimeTicks", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibObjectValueUnsigned": { - "path_match": "ipfix.mibObjectValueUnsigned", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibObjectValueTable": { - "path_match": "ipfix.mibObjectValueTable", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibObjectValueRow": { - "path_match": "ipfix.mibObjectValueRow", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibObjectIdentifier": { - "path_match": "ipfix.mibObjectIdentifier", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibSubIdentifier": { - "path_match": "ipfix.mibSubIdentifier", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibIndexIndicator": { - "path_match": "ipfix.mibIndexIndicator", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibCaptureTimeSemantics": { - "path_match": "ipfix.mibCaptureTimeSemantics", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibContextEngineID": { - "path_match": "ipfix.mibContextEngineID", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibContextName": { - "path_match": "ipfix.mibContextName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibObjectName": { - "path_match": "ipfix.mibObjectName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibObjectDescription": { - "path_match": "ipfix.mibObjectDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibObjectSyntax": { - "path_match": "ipfix.mibObjectSyntax", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibModuleName": { - "path_match": "ipfix.mibModuleName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mobileIMSI": { - "path_match": "ipfix.mobileIMSI", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mobileMSISDN": { - "path_match": "ipfix.mobileMSISDN", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.httpStatusCode": { - "path_match": "ipfix.httpStatusCode", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sourceTransportPortsLimit": { - "path_match": "ipfix.sourceTransportPortsLimit", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.httpRequestMethod": { - "path_match": "ipfix.httpRequestMethod", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.httpRequestHost": { - "path_match": "ipfix.httpRequestHost", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.httpRequestTarget": { - "path_match": "ipfix.httpRequestTarget", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.httpMessageVersion": { - "path_match": "ipfix.httpMessageVersion", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.natInstanceID": { - "path_match": "ipfix.natInstanceID", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.internalAddressRealm": { - "path_match": "ipfix.internalAddressRealm", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.externalAddressRealm": { - "path_match": "ipfix.externalAddressRealm", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.natQuotaExceededEvent": { - "path_match": "ipfix.natQuotaExceededEvent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.natThresholdEvent": { - "path_match": "ipfix.natThresholdEvent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.httpUserAgent": { - "path_match": "ipfix.httpUserAgent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.httpContentType": { - "path_match": "ipfix.httpContentType", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.httpReasonPhrase": { - "path_match": "ipfix.httpReasonPhrase", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.maxSessionEntries": { - "path_match": "ipfix.maxSessionEntries", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxBIBEntries": { - "path_match": "ipfix.maxBIBEntries", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxEntriesPerUser": { - "path_match": "ipfix.maxEntriesPerUser", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxSubscribers": { - "path_match": "ipfix.maxSubscribers", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxFragmentsPendingReassembly": { - "path_match": "ipfix.maxFragmentsPendingReassembly", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.addressPoolHighThreshold": { - "path_match": "ipfix.addressPoolHighThreshold", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.addressPoolLowThreshold": { - "path_match": "ipfix.addressPoolLowThreshold", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.addressPortMappingHighThreshold": { - "path_match": "ipfix.addressPortMappingHighThreshold", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.addressPortMappingLowThreshold": { - "path_match": "ipfix.addressPortMappingLowThreshold", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.addressPortMappingPerUserHighThreshold": { - "path_match": "ipfix.addressPortMappingPerUserHighThreshold", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.globalAddressMappingHighThreshold": { - "path_match": "ipfix.globalAddressMappingHighThreshold", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vpnIdentifier": { - "path_match": "ipfix.vpnIdentifier", - "mapping": { - "type": "keyword" - } - } - }, + "numeric_detection": true, + "dynamic_templates": [ + { + "ipfix.octetDeltaCount": { + "path_match": "ipfix.octetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.packetDeltaCount": { + "path_match": "ipfix.packetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.deltaFlowCount": { + "path_match": "ipfix.deltaFlowCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.protocolIdentifier": { + "path_match": "ipfix.protocolIdentifier", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipClassOfService": { + "path_match": "ipfix.ipClassOfService", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpControlBits": { + "path_match": "ipfix.tcpControlBits", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sourceTransportPort": { + "path_match": "ipfix.sourceTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sourceIPv4Address": { + "path_match": "ipfix.sourceIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sourceIPv4PrefixLength": { + "path_match": "ipfix.sourceIPv4PrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ingressInterface": { + "path_match": "ipfix.ingressInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.destinationTransportPort": { + "path_match": "ipfix.destinationTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.destinationIPv4Address": { + "path_match": "ipfix.destinationIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.destinationIPv4PrefixLength": { + "path_match": "ipfix.destinationIPv4PrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.egressInterface": { + "path_match": "ipfix.egressInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipNextHopIPv4Address": { + "path_match": "ipfix.ipNextHopIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.bgpSourceAsNumber": { + "path_match": "ipfix.bgpSourceAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.bgpDestinationAsNumber": { + "path_match": "ipfix.bgpDestinationAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.bgpNextHopIPv4Address": { + "path_match": "ipfix.bgpNextHopIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.postMCastPacketDeltaCount": { + "path_match": "ipfix.postMCastPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postMCastOctetDeltaCount": { + "path_match": "ipfix.postMCastOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowEndSysUpTime": { + "path_match": "ipfix.flowEndSysUpTime", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowStartSysUpTime": { + "path_match": "ipfix.flowStartSysUpTime", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postOctetDeltaCount": { + "path_match": "ipfix.postOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postPacketDeltaCount": { + "path_match": "ipfix.postPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.minimumIpTotalLength": { + "path_match": "ipfix.minimumIpTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maximumIpTotalLength": { + "path_match": "ipfix.maximumIpTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sourceIPv6Address": { + "path_match": "ipfix.sourceIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.destinationIPv6Address": { + "path_match": "ipfix.destinationIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sourceIPv6PrefixLength": { + "path_match": "ipfix.sourceIPv6PrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.destinationIPv6PrefixLength": { + "path_match": "ipfix.destinationIPv6PrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowLabelIPv6": { + "path_match": "ipfix.flowLabelIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.icmpTypeCodeIPv4": { + "path_match": "ipfix.icmpTypeCodeIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.igmpType": { + "path_match": "ipfix.igmpType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingInterval": { + "path_match": "ipfix.samplingInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingAlgorithm": { + "path_match": "ipfix.samplingAlgorithm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowActiveTimeout": { + "path_match": "ipfix.flowActiveTimeout", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowIdleTimeout": { + "path_match": "ipfix.flowIdleTimeout", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.engineType": { + "path_match": "ipfix.engineType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.engineId": { + "path_match": "ipfix.engineId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exportedOctetTotalCount": { + "path_match": "ipfix.exportedOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exportedMessageTotalCount": { + "path_match": "ipfix.exportedMessageTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exportedFlowRecordTotalCount": { + "path_match": "ipfix.exportedFlowRecordTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipv4RouterSc": { + "path_match": "ipfix.ipv4RouterSc", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sourceIPv4Prefix": { + "path_match": "ipfix.sourceIPv4Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.destinationIPv4Prefix": { + "path_match": "ipfix.destinationIPv4Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.mplsTopLabelType": { + "path_match": "ipfix.mplsTopLabelType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsTopLabelIPv4Address": { + "path_match": "ipfix.mplsTopLabelIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.samplerId": { + "path_match": "ipfix.samplerId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplerMode": { + "path_match": "ipfix.samplerMode", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplerRandomInterval": { + "path_match": "ipfix.samplerRandomInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.classId": { + "path_match": "ipfix.classId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.minimumTTL": { + "path_match": "ipfix.minimumTTL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maximumTTL": { + "path_match": "ipfix.maximumTTL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.fragmentIdentification": { + "path_match": "ipfix.fragmentIdentification", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postIpClassOfService": { + "path_match": "ipfix.postIpClassOfService", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sourceMacAddress": { + "path_match": "ipfix.sourceMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.postDestinationMacAddress": { + "path_match": "ipfix.postDestinationMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.vlanId": { + "path_match": "ipfix.vlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postVlanId": { + "path_match": "ipfix.postVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipVersion": { + "path_match": "ipfix.ipVersion", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowDirection": { + "path_match": "ipfix.flowDirection", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipNextHopIPv6Address": { + "path_match": "ipfix.ipNextHopIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.bgpNextHopIPv6Address": { + "path_match": "ipfix.bgpNextHopIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ipv6ExtensionHeaders": { + "path_match": "ipfix.ipv6ExtensionHeaders", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.transportPacketLoss": { + "path_match": "ipfix.transportPacketLoss", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.transportUnreachability": { + "path_match": "ipfix.transportUnreachability", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.transportLatency": { + "path_match": "ipfix.transportLatency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsTopLabelStackSection": { + "path_match": "ipfix.mplsTopLabelStackSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection2": { + "path_match": "ipfix.mplsLabelStackSection2", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection3": { + "path_match": "ipfix.mplsLabelStackSection3", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection4": { + "path_match": "ipfix.mplsLabelStackSection4", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection5": { + "path_match": "ipfix.mplsLabelStackSection5", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection6": { + "path_match": "ipfix.mplsLabelStackSection6", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection7": { + "path_match": "ipfix.mplsLabelStackSection7", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection8": { + "path_match": "ipfix.mplsLabelStackSection8", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection9": { + "path_match": "ipfix.mplsLabelStackSection9", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection10": { + "path_match": "ipfix.mplsLabelStackSection10", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.destinationMacAddress": { + "path_match": "ipfix.destinationMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.postSourceMacAddress": { + "path_match": "ipfix.postSourceMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.interfaceName": { + "path_match": "ipfix.interfaceName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.interfaceDescription": { + "path_match": "ipfix.interfaceDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.samplerName": { + "path_match": "ipfix.samplerName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.octetTotalCount": { + "path_match": "ipfix.octetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.packetTotalCount": { + "path_match": "ipfix.packetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flagsAndSamplerId": { + "path_match": "ipfix.flagsAndSamplerId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.fragmentOffset": { + "path_match": "ipfix.fragmentOffset", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.forwardingStatus": { + "path_match": "ipfix.forwardingStatus", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsVpnRouteDistinguisher": { + "path_match": "ipfix.mplsVpnRouteDistinguisher", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsTopLabelPrefixLength": { + "path_match": "ipfix.mplsTopLabelPrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.srcTrafficIndex": { + "path_match": "ipfix.srcTrafficIndex", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dstTrafficIndex": { + "path_match": "ipfix.dstTrafficIndex", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.applicationDescription": { + "path_match": "ipfix.applicationDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.applicationId": { + "path_match": "ipfix.applicationId", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.applicationName": { + "path_match": "ipfix.applicationName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.subApplicationTag": { + "path_match": "ipfix.subApplicationTag", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.postIpDiffServCodePoint": { + "path_match": "ipfix.postIpDiffServCodePoint", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.multicastReplicationFactor": { + "path_match": "ipfix.multicastReplicationFactor", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.className": { + "path_match": "ipfix.className", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.classificationEngineId": { + "path_match": "ipfix.classificationEngineId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2packetSectionOffset": { + "path_match": "ipfix.layer2packetSectionOffset", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2packetSectionSize": { + "path_match": "ipfix.layer2packetSectionSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2packetSectionData": { + "path_match": "ipfix.layer2packetSectionData", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.applicationVersion": { + "path_match": "ipfix.applicationVersion", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.applicationVersionName": { + "path_match": "ipfix.applicationVersionName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.applicationVendor": { + "path_match": "ipfix.applicationVendor", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.subApplicationName": { + "path_match": "ipfix.subApplicationName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.subApplicationDescription": { + "path_match": "ipfix.subApplicationDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.templateParameterRangeEnd": { + "path_match": "ipfix.templateParameterRangeEnd", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.bgpNextAdjacentAsNumber": { + "path_match": "ipfix.bgpNextAdjacentAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.bgpPrevAdjacentAsNumber": { + "path_match": "ipfix.bgpPrevAdjacentAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exporterIPv4Address": { + "path_match": "ipfix.exporterIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.exporterIPv6Address": { + "path_match": "ipfix.exporterIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.droppedOctetDeltaCount": { + "path_match": "ipfix.droppedOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.droppedPacketDeltaCount": { + "path_match": "ipfix.droppedPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.droppedOctetTotalCount": { + "path_match": "ipfix.droppedOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.droppedPacketTotalCount": { + "path_match": "ipfix.droppedPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowEndReason": { + "path_match": "ipfix.flowEndReason", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.commonPropertiesId": { + "path_match": "ipfix.commonPropertiesId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.observationPointId": { + "path_match": "ipfix.observationPointId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.icmpTypeCodeIPv6": { + "path_match": "ipfix.icmpTypeCodeIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsTopLabelIPv6Address": { + "path_match": "ipfix.mplsTopLabelIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.lineCardId": { + "path_match": "ipfix.lineCardId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.portId": { + "path_match": "ipfix.portId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.meteringProcessId": { + "path_match": "ipfix.meteringProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exportingProcessId": { + "path_match": "ipfix.exportingProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.templateId": { + "path_match": "ipfix.templateId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.wlanChannelId": { + "path_match": "ipfix.wlanChannelId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.wlanSSID": { + "path_match": "ipfix.wlanSSID", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.flowId": { + "path_match": "ipfix.flowId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.observationDomainId": { + "path_match": "ipfix.observationDomainId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowStartSeconds": { + "path_match": "ipfix.flowStartSeconds", + "mapping": { + "type": "date" + } + } + }, + { + "ipfix.flowEndSeconds": { + "path_match": "ipfix.flowEndSeconds", + "mapping": { + "type": "date" + } + } + }, + { + "ipfix.flowStartMilliseconds": { + "path_match": "ipfix.flowStartMilliseconds", + "mapping": { + "type": "date" + } + } + }, + { + "ipfix.flowEndMilliseconds": { + "path_match": "ipfix.flowEndMilliseconds", + "mapping": { + "type": "date" + } + } + }, + { + "ipfix.flowStartMicroseconds": { + "path_match": "ipfix.flowStartMicroseconds", + "mapping": { + "type": "date" + } + } + }, + { + "ipfix.flowEndMicroseconds": { + "path_match": "ipfix.flowEndMicroseconds", + "mapping": { + "type": "date" + } + } + }, + { + "ipfix.flowStartNanoseconds": { + "path_match": "ipfix.flowStartNanoseconds", + "mapping": { + "type": "date" + } + } + }, + { + "ipfix.flowEndNanoseconds": { + "path_match": "ipfix.flowEndNanoseconds", + "mapping": { + "type": "date" + } + } + }, + { + "ipfix.flowStartDeltaMicroseconds": { + "path_match": "ipfix.flowStartDeltaMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowEndDeltaMicroseconds": { + "path_match": "ipfix.flowEndDeltaMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.systemInitTimeMilliseconds": { + "path_match": "ipfix.systemInitTimeMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowDurationMilliseconds": { + "path_match": "ipfix.flowDurationMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowDurationMicroseconds": { + "path_match": "ipfix.flowDurationMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.observedFlowTotalCount": { + "path_match": "ipfix.observedFlowTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ignoredPacketTotalCount": { + "path_match": "ipfix.ignoredPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ignoredOctetTotalCount": { + "path_match": "ipfix.ignoredOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.notSentFlowTotalCount": { + "path_match": "ipfix.notSentFlowTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.notSentPacketTotalCount": { + "path_match": "ipfix.notSentPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.notSentOctetTotalCount": { + "path_match": "ipfix.notSentOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.destinationIPv6Prefix": { + "path_match": "ipfix.destinationIPv6Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sourceIPv6Prefix": { + "path_match": "ipfix.sourceIPv6Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.postOctetTotalCount": { + "path_match": "ipfix.postOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postPacketTotalCount": { + "path_match": "ipfix.postPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowKeyIndicator": { + "path_match": "ipfix.flowKeyIndicator", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postMCastPacketTotalCount": { + "path_match": "ipfix.postMCastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postMCastOctetTotalCount": { + "path_match": "ipfix.postMCastOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.icmpTypeIPv4": { + "path_match": "ipfix.icmpTypeIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.icmpCodeIPv4": { + "path_match": "ipfix.icmpCodeIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.icmpTypeIPv6": { + "path_match": "ipfix.icmpTypeIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.icmpCodeIPv6": { + "path_match": "ipfix.icmpCodeIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.udpSourcePort": { + "path_match": "ipfix.udpSourcePort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.udpDestinationPort": { + "path_match": "ipfix.udpDestinationPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpSourcePort": { + "path_match": "ipfix.tcpSourcePort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpDestinationPort": { + "path_match": "ipfix.tcpDestinationPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpSequenceNumber": { + "path_match": "ipfix.tcpSequenceNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpAcknowledgementNumber": { + "path_match": "ipfix.tcpAcknowledgementNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpWindowSize": { + "path_match": "ipfix.tcpWindowSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpUrgentPointer": { + "path_match": "ipfix.tcpUrgentPointer", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpHeaderLength": { + "path_match": "ipfix.tcpHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipHeaderLength": { + "path_match": "ipfix.ipHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.totalLengthIPv4": { + "path_match": "ipfix.totalLengthIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.payloadLengthIPv6": { + "path_match": "ipfix.payloadLengthIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipTTL": { + "path_match": "ipfix.ipTTL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.nextHeaderIPv6": { + "path_match": "ipfix.nextHeaderIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsPayloadLength": { + "path_match": "ipfix.mplsPayloadLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipDiffServCodePoint": { + "path_match": "ipfix.ipDiffServCodePoint", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipPrecedence": { + "path_match": "ipfix.ipPrecedence", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.fragmentFlags": { + "path_match": "ipfix.fragmentFlags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.octetDeltaSumOfSquares": { + "path_match": "ipfix.octetDeltaSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.octetTotalSumOfSquares": { + "path_match": "ipfix.octetTotalSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsTopLabelTTL": { + "path_match": "ipfix.mplsTopLabelTTL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsLabelStackLength": { + "path_match": "ipfix.mplsLabelStackLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsLabelStackDepth": { + "path_match": "ipfix.mplsLabelStackDepth", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsTopLabelExp": { + "path_match": "ipfix.mplsTopLabelExp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipPayloadLength": { + "path_match": "ipfix.ipPayloadLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.udpMessageLength": { + "path_match": "ipfix.udpMessageLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.isMulticast": { + "path_match": "ipfix.isMulticast", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipv4IHL": { + "path_match": "ipfix.ipv4IHL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipv4Options": { + "path_match": "ipfix.ipv4Options", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpOptions": { + "path_match": "ipfix.tcpOptions", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.collectorIPv4Address": { + "path_match": "ipfix.collectorIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.collectorIPv6Address": { + "path_match": "ipfix.collectorIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.collectorTransportPort": { + "path_match": "ipfix.collectorTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exportInterface": { + "path_match": "ipfix.exportInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exportProtocolVersion": { + "path_match": "ipfix.exportProtocolVersion", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exportTransportProtocol": { + "path_match": "ipfix.exportTransportProtocol", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exporterTransportPort": { + "path_match": "ipfix.exporterTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpSynTotalCount": { + "path_match": "ipfix.tcpSynTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpFinTotalCount": { + "path_match": "ipfix.tcpFinTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpRstTotalCount": { + "path_match": "ipfix.tcpRstTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpPshTotalCount": { + "path_match": "ipfix.tcpPshTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpAckTotalCount": { + "path_match": "ipfix.tcpAckTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpUrgTotalCount": { + "path_match": "ipfix.tcpUrgTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipTotalLength": { + "path_match": "ipfix.ipTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postNATSourceIPv4Address": { + "path_match": "ipfix.postNATSourceIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.postNATDestinationIPv4Address": { + "path_match": "ipfix.postNATDestinationIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.postNAPTSourceTransportPort": { + "path_match": "ipfix.postNAPTSourceTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postNAPTDestinationTransportPort": { + "path_match": "ipfix.postNAPTDestinationTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.natOriginatingAddressRealm": { + "path_match": "ipfix.natOriginatingAddressRealm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.natEvent": { + "path_match": "ipfix.natEvent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.initiatorOctets": { + "path_match": "ipfix.initiatorOctets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.responderOctets": { + "path_match": "ipfix.responderOctets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.firewallEvent": { + "path_match": "ipfix.firewallEvent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ingressVRFID": { + "path_match": "ipfix.ingressVRFID", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.egressVRFID": { + "path_match": "ipfix.egressVRFID", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.VRFname": { + "path_match": "ipfix.VRFname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.postMplsTopLabelExp": { + "path_match": "ipfix.postMplsTopLabelExp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpWindowScale": { + "path_match": "ipfix.tcpWindowScale", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.biflowDirection": { + "path_match": "ipfix.biflowDirection", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ethernetHeaderLength": { + "path_match": "ipfix.ethernetHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ethernetPayloadLength": { + "path_match": "ipfix.ethernetPayloadLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ethernetTotalLength": { + "path_match": "ipfix.ethernetTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qVlanId": { + "path_match": "ipfix.dot1qVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qPriority": { + "path_match": "ipfix.dot1qPriority", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qCustomerVlanId": { + "path_match": "ipfix.dot1qCustomerVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qCustomerPriority": { + "path_match": "ipfix.dot1qCustomerPriority", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.metroEvcId": { + "path_match": "ipfix.metroEvcId", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.metroEvcType": { + "path_match": "ipfix.metroEvcType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.pseudoWireId": { + "path_match": "ipfix.pseudoWireId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.pseudoWireType": { + "path_match": "ipfix.pseudoWireType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.pseudoWireControlWord": { + "path_match": "ipfix.pseudoWireControlWord", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ingressPhysicalInterface": { + "path_match": "ipfix.ingressPhysicalInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.egressPhysicalInterface": { + "path_match": "ipfix.egressPhysicalInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postDot1qVlanId": { + "path_match": "ipfix.postDot1qVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postDot1qCustomerVlanId": { + "path_match": "ipfix.postDot1qCustomerVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ethernetType": { + "path_match": "ipfix.ethernetType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postIpPrecedence": { + "path_match": "ipfix.postIpPrecedence", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.collectionTimeMilliseconds": { + "path_match": "ipfix.collectionTimeMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exportSctpStreamId": { + "path_match": "ipfix.exportSctpStreamId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxExportSeconds": { + "path_match": "ipfix.maxExportSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxFlowEndSeconds": { + "path_match": "ipfix.maxFlowEndSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.messageMD5Checksum": { + "path_match": "ipfix.messageMD5Checksum", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.messageScope": { + "path_match": "ipfix.messageScope", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.minExportSeconds": { + "path_match": "ipfix.minExportSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.minFlowStartSeconds": { + "path_match": "ipfix.minFlowStartSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.opaqueOctets": { + "path_match": "ipfix.opaqueOctets", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sessionScope": { + "path_match": "ipfix.sessionScope", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxFlowEndMicroseconds": { + "path_match": "ipfix.maxFlowEndMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxFlowEndMilliseconds": { + "path_match": "ipfix.maxFlowEndMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxFlowEndNanoseconds": { + "path_match": "ipfix.maxFlowEndNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.minFlowStartMicroseconds": { + "path_match": "ipfix.minFlowStartMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.minFlowStartMilliseconds": { + "path_match": "ipfix.minFlowStartMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.minFlowStartNanoseconds": { + "path_match": "ipfix.minFlowStartNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.collectorCertificate": { + "path_match": "ipfix.collectorCertificate", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.exporterCertificate": { + "path_match": "ipfix.exporterCertificate", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.dataRecordsReliability": { + "path_match": "ipfix.dataRecordsReliability", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.observationPointType": { + "path_match": "ipfix.observationPointType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.newConnectionDeltaCount": { + "path_match": "ipfix.newConnectionDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.connectionSumDurationSeconds": { + "path_match": "ipfix.connectionSumDurationSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.connectionTransactionId": { + "path_match": "ipfix.connectionTransactionId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postNATSourceIPv6Address": { + "path_match": "ipfix.postNATSourceIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.postNATDestinationIPv6Address": { + "path_match": "ipfix.postNATDestinationIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.natPoolId": { + "path_match": "ipfix.natPoolId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.natPoolName": { + "path_match": "ipfix.natPoolName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.anonymizationFlags": { + "path_match": "ipfix.anonymizationFlags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.anonymizationTechnique": { + "path_match": "ipfix.anonymizationTechnique", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.informationElementIndex": { + "path_match": "ipfix.informationElementIndex", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.p2pTechnology": { + "path_match": "ipfix.p2pTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.tunnelTechnology": { + "path_match": "ipfix.tunnelTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.encryptedTechnology": { + "path_match": "ipfix.encryptedTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.bgpValidityState": { + "path_match": "ipfix.bgpValidityState", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.IPSecSPI": { + "path_match": "ipfix.IPSecSPI", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.greKey": { + "path_match": "ipfix.greKey", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.natType": { + "path_match": "ipfix.natType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.initiatorPackets": { + "path_match": "ipfix.initiatorPackets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.responderPackets": { + "path_match": "ipfix.responderPackets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.observationDomainName": { + "path_match": "ipfix.observationDomainName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.selectionSequenceId": { + "path_match": "ipfix.selectionSequenceId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.selectorId": { + "path_match": "ipfix.selectorId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.informationElementId": { + "path_match": "ipfix.informationElementId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.selectorAlgorithm": { + "path_match": "ipfix.selectorAlgorithm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingPacketInterval": { + "path_match": "ipfix.samplingPacketInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingPacketSpace": { + "path_match": "ipfix.samplingPacketSpace", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingTimeInterval": { + "path_match": "ipfix.samplingTimeInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingTimeSpace": { + "path_match": "ipfix.samplingTimeSpace", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingSize": { + "path_match": "ipfix.samplingSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingPopulation": { + "path_match": "ipfix.samplingPopulation", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingProbability": { + "path_match": "ipfix.samplingProbability", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.dataLinkFrameSize": { + "path_match": "ipfix.dataLinkFrameSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipHeaderPacketSection": { + "path_match": "ipfix.ipHeaderPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ipPayloadPacketSection": { + "path_match": "ipfix.ipPayloadPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.dataLinkFrameSection": { + "path_match": "ipfix.dataLinkFrameSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection": { + "path_match": "ipfix.mplsLabelStackSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsPayloadPacketSection": { + "path_match": "ipfix.mplsPayloadPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.selectorIdTotalPktsObserved": { + "path_match": "ipfix.selectorIdTotalPktsObserved", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.selectorIdTotalPktsSelected": { + "path_match": "ipfix.selectorIdTotalPktsSelected", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.absoluteError": { + "path_match": "ipfix.absoluteError", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.relativeError": { + "path_match": "ipfix.relativeError", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.observationTimeSeconds": { + "path_match": "ipfix.observationTimeSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.observationTimeMilliseconds": { + "path_match": "ipfix.observationTimeMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.observationTimeMicroseconds": { + "path_match": "ipfix.observationTimeMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.observationTimeNanoseconds": { + "path_match": "ipfix.observationTimeNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.digestHashValue": { + "path_match": "ipfix.digestHashValue", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashIPPayloadOffset": { + "path_match": "ipfix.hashIPPayloadOffset", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashIPPayloadSize": { + "path_match": "ipfix.hashIPPayloadSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashOutputRangeMin": { + "path_match": "ipfix.hashOutputRangeMin", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashOutputRangeMax": { + "path_match": "ipfix.hashOutputRangeMax", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashSelectedRangeMin": { + "path_match": "ipfix.hashSelectedRangeMin", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashSelectedRangeMax": { + "path_match": "ipfix.hashSelectedRangeMax", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashDigestOutput": { + "path_match": "ipfix.hashDigestOutput", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashInitialiserValue": { + "path_match": "ipfix.hashInitialiserValue", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.selectorName": { + "path_match": "ipfix.selectorName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.upperCILimit": { + "path_match": "ipfix.upperCILimit", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.lowerCILimit": { + "path_match": "ipfix.lowerCILimit", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.confidenceLevel": { + "path_match": "ipfix.confidenceLevel", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.informationElementDataType": { + "path_match": "ipfix.informationElementDataType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.informationElementDescription": { + "path_match": "ipfix.informationElementDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.informationElementName": { + "path_match": "ipfix.informationElementName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.informationElementRangeBegin": { + "path_match": "ipfix.informationElementRangeBegin", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.informationElementRangeEnd": { + "path_match": "ipfix.informationElementRangeEnd", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.informationElementSemantics": { + "path_match": "ipfix.informationElementSemantics", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.informationElementUnits": { + "path_match": "ipfix.informationElementUnits", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.privateEnterpriseNumber": { + "path_match": "ipfix.privateEnterpriseNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.virtualStationInterfaceId": { + "path_match": "ipfix.virtualStationInterfaceId", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.virtualStationInterfaceName": { + "path_match": "ipfix.virtualStationInterfaceName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.virtualStationUUID": { + "path_match": "ipfix.virtualStationUUID", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.virtualStationName": { + "path_match": "ipfix.virtualStationName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.layer2SegmentId": { + "path_match": "ipfix.layer2SegmentId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2OctetDeltaCount": { + "path_match": "ipfix.layer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2OctetTotalCount": { + "path_match": "ipfix.layer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ingressUnicastPacketTotalCount": { + "path_match": "ipfix.ingressUnicastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ingressMulticastPacketTotalCount": { + "path_match": "ipfix.ingressMulticastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ingressBroadcastPacketTotalCount": { + "path_match": "ipfix.ingressBroadcastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.egressUnicastPacketTotalCount": { + "path_match": "ipfix.egressUnicastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.egressBroadcastPacketTotalCount": { + "path_match": "ipfix.egressBroadcastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.monitoringIntervalStartMilliSeconds": { + "path_match": "ipfix.monitoringIntervalStartMilliSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.monitoringIntervalEndMilliSeconds": { + "path_match": "ipfix.monitoringIntervalEndMilliSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.portRangeStart": { + "path_match": "ipfix.portRangeStart", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.portRangeEnd": { + "path_match": "ipfix.portRangeEnd", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.portRangeStepSize": { + "path_match": "ipfix.portRangeStepSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.portRangeNumPorts": { + "path_match": "ipfix.portRangeNumPorts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.staMacAddress": { + "path_match": "ipfix.staMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.staIPv4Address": { + "path_match": "ipfix.staIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.wtpMacAddress": { + "path_match": "ipfix.wtpMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ingressInterfaceType": { + "path_match": "ipfix.ingressInterfaceType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.egressInterfaceType": { + "path_match": "ipfix.egressInterfaceType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.rtpSequenceNumber": { + "path_match": "ipfix.rtpSequenceNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.userName": { + "path_match": "ipfix.userName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.applicationCategoryName": { + "path_match": "ipfix.applicationCategoryName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.applicationSubCategoryName": { + "path_match": "ipfix.applicationSubCategoryName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.applicationGroupName": { + "path_match": "ipfix.applicationGroupName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.originalFlowsPresent": { + "path_match": "ipfix.originalFlowsPresent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.originalFlowsInitiated": { + "path_match": "ipfix.originalFlowsInitiated", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.originalFlowsCompleted": { + "path_match": "ipfix.originalFlowsCompleted", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.distinctCountOfSourceIPAddress": { + "path_match": "ipfix.distinctCountOfSourceIPAddress", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.distinctCountOfDestinationIPAddress": { + "path_match": "ipfix.distinctCountOfDestinationIPAddress", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.distinctCountOfSourceIPv4Address": { + "path_match": "ipfix.distinctCountOfSourceIPv4Address", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.distinctCountOfDestinationIPv4Address": { + "path_match": "ipfix.distinctCountOfDestinationIPv4Address", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.distinctCountOfSourceIPv6Address": { + "path_match": "ipfix.distinctCountOfSourceIPv6Address", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.distinctCountOfDestinationIPv6Address": { + "path_match": "ipfix.distinctCountOfDestinationIPv6Address", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.valueDistributionMethod": { + "path_match": "ipfix.valueDistributionMethod", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.rfc3550JitterMilliseconds": { + "path_match": "ipfix.rfc3550JitterMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.rfc3550JitterMicroseconds": { + "path_match": "ipfix.rfc3550JitterMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.rfc3550JitterNanoseconds": { + "path_match": "ipfix.rfc3550JitterNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qDEI": { + "path_match": "ipfix.dot1qDEI", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qCustomerDEI": { + "path_match": "ipfix.dot1qCustomerDEI", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowSelectorAlgorithm": { + "path_match": "ipfix.flowSelectorAlgorithm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowSelectedOctetDeltaCount": { + "path_match": "ipfix.flowSelectedOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowSelectedPacketDeltaCount": { + "path_match": "ipfix.flowSelectedPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowSelectedFlowDeltaCount": { + "path_match": "ipfix.flowSelectedFlowDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.selectorIDTotalFlowsObserved": { + "path_match": "ipfix.selectorIDTotalFlowsObserved", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.selectorIDTotalFlowsSelected": { + "path_match": "ipfix.selectorIDTotalFlowsSelected", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingFlowInterval": { + "path_match": "ipfix.samplingFlowInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingFlowSpacing": { + "path_match": "ipfix.samplingFlowSpacing", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowSamplingTimeInterval": { + "path_match": "ipfix.flowSamplingTimeInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowSamplingTimeSpacing": { + "path_match": "ipfix.flowSamplingTimeSpacing", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashFlowDomain": { + "path_match": "ipfix.hashFlowDomain", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.transportOctetDeltaCount": { + "path_match": "ipfix.transportOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.transportPacketDeltaCount": { + "path_match": "ipfix.transportPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.originalExporterIPv4Address": { + "path_match": "ipfix.originalExporterIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.originalExporterIPv6Address": { + "path_match": "ipfix.originalExporterIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.originalObservationDomainId": { + "path_match": "ipfix.originalObservationDomainId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.intermediateProcessId": { + "path_match": "ipfix.intermediateProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ignoredDataRecordTotalCount": { + "path_match": "ipfix.ignoredDataRecordTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dataLinkFrameType": { + "path_match": "ipfix.dataLinkFrameType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sectionOffset": { + "path_match": "ipfix.sectionOffset", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sectionExportedOctets": { + "path_match": "ipfix.sectionExportedOctets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qServiceInstanceTag": { + "path_match": "ipfix.dot1qServiceInstanceTag", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.dot1qServiceInstanceId": { + "path_match": "ipfix.dot1qServiceInstanceId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qServiceInstancePriority": { + "path_match": "ipfix.dot1qServiceInstancePriority", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qCustomerSourceMacAddress": { + "path_match": "ipfix.dot1qCustomerSourceMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.dot1qCustomerDestinationMacAddress": { + "path_match": "ipfix.dot1qCustomerDestinationMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.postLayer2OctetDeltaCount": { + "path_match": "ipfix.postLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postMCastLayer2OctetDeltaCount": { + "path_match": "ipfix.postMCastLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postLayer2OctetTotalCount": { + "path_match": "ipfix.postLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postMCastLayer2OctetTotalCount": { + "path_match": "ipfix.postMCastLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.minimumLayer2TotalLength": { + "path_match": "ipfix.minimumLayer2TotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maximumLayer2TotalLength": { + "path_match": "ipfix.maximumLayer2TotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.droppedLayer2OctetDeltaCount": { + "path_match": "ipfix.droppedLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.droppedLayer2OctetTotalCount": { + "path_match": "ipfix.droppedLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ignoredLayer2OctetTotalCount": { + "path_match": "ipfix.ignoredLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.notSentLayer2OctetTotalCount": { + "path_match": "ipfix.notSentLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2OctetDeltaSumOfSquares": { + "path_match": "ipfix.layer2OctetDeltaSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2OctetTotalSumOfSquares": { + "path_match": "ipfix.layer2OctetTotalSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2FrameDeltaCount": { + "path_match": "ipfix.layer2FrameDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2FrameTotalCount": { + "path_match": "ipfix.layer2FrameTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.pseudoWireDestinationIPv4Address": { + "path_match": "ipfix.pseudoWireDestinationIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ignoredLayer2FrameTotalCount": { + "path_match": "ipfix.ignoredLayer2FrameTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibObjectValueInteger": { + "path_match": "ipfix.mibObjectValueInteger", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibObjectValueOctetString": { + "path_match": "ipfix.mibObjectValueOctetString", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibObjectValueOID": { + "path_match": "ipfix.mibObjectValueOID", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibObjectValueBits": { + "path_match": "ipfix.mibObjectValueBits", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibObjectValueIPAddress": { + "path_match": "ipfix.mibObjectValueIPAddress", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.mibObjectValueCounter": { + "path_match": "ipfix.mibObjectValueCounter", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibObjectValueGauge": { + "path_match": "ipfix.mibObjectValueGauge", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibObjectValueTimeTicks": { + "path_match": "ipfix.mibObjectValueTimeTicks", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibObjectValueUnsigned": { + "path_match": "ipfix.mibObjectValueUnsigned", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibObjectValueTable": { + "path_match": "ipfix.mibObjectValueTable", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibObjectValueRow": { + "path_match": "ipfix.mibObjectValueRow", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibObjectIdentifier": { + "path_match": "ipfix.mibObjectIdentifier", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibSubIdentifier": { + "path_match": "ipfix.mibSubIdentifier", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibIndexIndicator": { + "path_match": "ipfix.mibIndexIndicator", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibCaptureTimeSemantics": { + "path_match": "ipfix.mibCaptureTimeSemantics", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibContextEngineID": { + "path_match": "ipfix.mibContextEngineID", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibContextName": { + "path_match": "ipfix.mibContextName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibObjectName": { + "path_match": "ipfix.mibObjectName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibObjectDescription": { + "path_match": "ipfix.mibObjectDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibObjectSyntax": { + "path_match": "ipfix.mibObjectSyntax", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibModuleName": { + "path_match": "ipfix.mibModuleName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mobileIMSI": { + "path_match": "ipfix.mobileIMSI", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mobileMSISDN": { + "path_match": "ipfix.mobileMSISDN", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.httpStatusCode": { + "path_match": "ipfix.httpStatusCode", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sourceTransportPortsLimit": { + "path_match": "ipfix.sourceTransportPortsLimit", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.httpRequestMethod": { + "path_match": "ipfix.httpRequestMethod", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.httpRequestHost": { + "path_match": "ipfix.httpRequestHost", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.httpRequestTarget": { + "path_match": "ipfix.httpRequestTarget", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.httpMessageVersion": { + "path_match": "ipfix.httpMessageVersion", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.natInstanceID": { + "path_match": "ipfix.natInstanceID", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.internalAddressRealm": { + "path_match": "ipfix.internalAddressRealm", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.externalAddressRealm": { + "path_match": "ipfix.externalAddressRealm", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.natQuotaExceededEvent": { + "path_match": "ipfix.natQuotaExceededEvent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.natThresholdEvent": { + "path_match": "ipfix.natThresholdEvent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.httpUserAgent": { + "path_match": "ipfix.httpUserAgent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.httpContentType": { + "path_match": "ipfix.httpContentType", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.httpReasonPhrase": { + "path_match": "ipfix.httpReasonPhrase", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.maxSessionEntries": { + "path_match": "ipfix.maxSessionEntries", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxBIBEntries": { + "path_match": "ipfix.maxBIBEntries", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxEntriesPerUser": { + "path_match": "ipfix.maxEntriesPerUser", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxSubscribers": { + "path_match": "ipfix.maxSubscribers", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxFragmentsPendingReassembly": { + "path_match": "ipfix.maxFragmentsPendingReassembly", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.addressPoolHighThreshold": { + "path_match": "ipfix.addressPoolHighThreshold", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.addressPoolLowThreshold": { + "path_match": "ipfix.addressPoolLowThreshold", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.addressPortMappingHighThreshold": { + "path_match": "ipfix.addressPortMappingHighThreshold", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.addressPortMappingLowThreshold": { + "path_match": "ipfix.addressPortMappingLowThreshold", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.addressPortMappingPerUserHighThreshold": { + "path_match": "ipfix.addressPortMappingPerUserHighThreshold", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.globalAddressMappingHighThreshold": { + "path_match": "ipfix.globalAddressMappingHighThreshold", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vpnIdentifier": { + "path_match": "ipfix.vpnIdentifier", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.reverseOctetDeltaCount": { - "path_match": "ipfix.reverseOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePacketDeltaCount": { - "path_match": "ipfix.reversePacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDeltaFlowCount": { - "path_match": "ipfix.reverseDeltaFlowCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseProtocolIdentifier": { - "path_match": "ipfix.reverseProtocolIdentifier", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpClassOfService": { - "path_match": "ipfix.reverseIpClassOfService", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpControlBits": { - "path_match": "ipfix.reverseTcpControlBits", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSourceTransportPort": { - "path_match": "ipfix.reverseSourceTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSourceIPv4Address": { - "path_match": "ipfix.reverseSourceIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseSourceIPv4PrefixLength": { - "path_match": "ipfix.reverseSourceIPv4PrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIngressInterface": { - "path_match": "ipfix.reverseIngressInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDestinationTransportPort": { - "path_match": "ipfix.reverseDestinationTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDestinationIPv4Address": { - "path_match": "ipfix.reverseDestinationIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseDestinationIPv4PrefixLength": { - "path_match": "ipfix.reverseDestinationIPv4PrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEgressInterface": { - "path_match": "ipfix.reverseEgressInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpNextHopIPv4Address": { - "path_match": "ipfix.reverseIpNextHopIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseBgpSourceAsNumber": { - "path_match": "ipfix.reverseBgpSourceAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseBgpDestinationAsNumber": { - "path_match": "ipfix.reverseBgpDestinationAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseBgpNextHopIPv4Address": { - "path_match": "ipfix.reverseBgpNextHopIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reversePostMCastPacketDeltaCount": { - "path_match": "ipfix.reversePostMCastPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostMCastOctetDeltaCount": { - "path_match": "ipfix.reversePostMCastOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowEndSysUpTime": { - "path_match": "ipfix.reverseFlowEndSysUpTime", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowStartSysUpTime": { - "path_match": "ipfix.reverseFlowStartSysUpTime", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostOctetDeltaCount": { - "path_match": "ipfix.reversePostOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostPacketDeltaCount": { - "path_match": "ipfix.reversePostPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMinimumIpTotalLength": { - "path_match": "ipfix.reverseMinimumIpTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMaximumIpTotalLength": { - "path_match": "ipfix.reverseMaximumIpTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSourceIPv6Address": { - "path_match": "ipfix.reverseSourceIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseDestinationIPv6Address": { - "path_match": "ipfix.reverseDestinationIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseSourceIPv6PrefixLength": { - "path_match": "ipfix.reverseSourceIPv6PrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDestinationIPv6PrefixLength": { - "path_match": "ipfix.reverseDestinationIPv6PrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowLabelIPv6": { - "path_match": "ipfix.reverseFlowLabelIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIcmpTypeCodeIPv4": { - "path_match": "ipfix.reverseIcmpTypeCodeIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIgmpType": { - "path_match": "ipfix.reverseIgmpType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingInterval": { - "path_match": "ipfix.reverseSamplingInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingAlgorithm": { - "path_match": "ipfix.reverseSamplingAlgorithm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowActiveTimeout": { - "path_match": "ipfix.reverseFlowActiveTimeout", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowIdleTimeout": { - "path_match": "ipfix.reverseFlowIdleTimeout", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEngineType": { - "path_match": "ipfix.reverseEngineType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEngineId": { - "path_match": "ipfix.reverseEngineId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpv4RouterSc": { - "path_match": "ipfix.reverseIpv4RouterSc", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseSourceIPv4Prefix": { - "path_match": "ipfix.reverseSourceIPv4Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseDestinationIPv4Prefix": { - "path_match": "ipfix.reverseDestinationIPv4Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseMplsTopLabelType": { - "path_match": "ipfix.reverseMplsTopLabelType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsTopLabelIPv4Address": { - "path_match": "ipfix.reverseMplsTopLabelIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseSamplerId": { - "path_match": "ipfix.reverseSamplerId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplerMode": { - "path_match": "ipfix.reverseSamplerMode", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplerRandomInterval": { - "path_match": "ipfix.reverseSamplerRandomInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseClassId": { - "path_match": "ipfix.reverseClassId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMinimumTTL": { - "path_match": "ipfix.reverseMinimumTTL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMaximumTTL": { - "path_match": "ipfix.reverseMaximumTTL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFragmentIdentification": { - "path_match": "ipfix.reverseFragmentIdentification", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostIpClassOfService": { - "path_match": "ipfix.reversePostIpClassOfService", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSourceMacAddress": { - "path_match": "ipfix.reverseSourceMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reversePostDestinationMacAddress": { - "path_match": "ipfix.reversePostDestinationMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseVlanId": { - "path_match": "ipfix.reverseVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostVlanId": { - "path_match": "ipfix.reversePostVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpVersion": { - "path_match": "ipfix.reverseIpVersion", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowDirection": { - "path_match": "ipfix.reverseFlowDirection", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpNextHopIPv6Address": { - "path_match": "ipfix.reverseIpNextHopIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseBgpNextHopIPv6Address": { - "path_match": "ipfix.reverseBgpNextHopIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseIpv6ExtensionHeaders": { - "path_match": "ipfix.reverseIpv6ExtensionHeaders", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsTopLabelStackSection": { - "path_match": "ipfix.reverseMplsTopLabelStackSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection2": { - "path_match": "ipfix.reverseMplsLabelStackSection2", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection3": { - "path_match": "ipfix.reverseMplsLabelStackSection3", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection4": { - "path_match": "ipfix.reverseMplsLabelStackSection4", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection5": { - "path_match": "ipfix.reverseMplsLabelStackSection5", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection6": { - "path_match": "ipfix.reverseMplsLabelStackSection6", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection7": { - "path_match": "ipfix.reverseMplsLabelStackSection7", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection8": { - "path_match": "ipfix.reverseMplsLabelStackSection8", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection9": { - "path_match": "ipfix.reverseMplsLabelStackSection9", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection10": { - "path_match": "ipfix.reverseMplsLabelStackSection10", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseDestinationMacAddress": { - "path_match": "ipfix.reverseDestinationMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reversePostSourceMacAddress": { - "path_match": "ipfix.reversePostSourceMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseInterfaceName": { - "path_match": "ipfix.reverseInterfaceName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseInterfaceDescription": { - "path_match": "ipfix.reverseInterfaceDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseSamplerName": { - "path_match": "ipfix.reverseSamplerName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseOctetTotalCount": { - "path_match": "ipfix.reverseOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePacketTotalCount": { - "path_match": "ipfix.reversePacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlagsAndSamplerId": { - "path_match": "ipfix.reverseFlagsAndSamplerId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFragmentOffset": { - "path_match": "ipfix.reverseFragmentOffset", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseForwardingStatus": { - "path_match": "ipfix.reverseForwardingStatus", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsVpnRouteDistinguisher": { - "path_match": "ipfix.reverseMplsVpnRouteDistinguisher", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsTopLabelPrefixLength": { - "path_match": "ipfix.reverseMplsTopLabelPrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSrcTrafficIndex": { - "path_match": "ipfix.reverseSrcTrafficIndex", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDstTrafficIndex": { - "path_match": "ipfix.reverseDstTrafficIndex", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseApplicationDescription": { - "path_match": "ipfix.reverseApplicationDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseApplicationId": { - "path_match": "ipfix.reverseApplicationId", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseApplicationName": { - "path_match": "ipfix.reverseApplicationName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reversePostIpDiffServCodePoint": { - "path_match": "ipfix.reversePostIpDiffServCodePoint", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMulticastReplicationFactor": { - "path_match": "ipfix.reverseMulticastReplicationFactor", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseClassName": { - "path_match": "ipfix.reverseClassName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseClassificationEngineId": { - "path_match": "ipfix.reverseClassificationEngineId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2packetSectionOffset": { - "path_match": "ipfix.reverseLayer2packetSectionOffset", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2packetSectionSize": { - "path_match": "ipfix.reverseLayer2packetSectionSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2packetSectionData": { - "path_match": "ipfix.reverseLayer2packetSectionData", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseBgpNextAdjacentAsNumber": { - "path_match": "ipfix.reverseBgpNextAdjacentAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseBgpPrevAdjacentAsNumber": { - "path_match": "ipfix.reverseBgpPrevAdjacentAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDroppedOctetDeltaCount": { - "path_match": "ipfix.reverseDroppedOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDroppedPacketDeltaCount": { - "path_match": "ipfix.reverseDroppedPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDroppedPacketTotalCount": { - "path_match": "ipfix.reverseDroppedPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDroppedOctetTotalCount": { - "path_match": "ipfix.reverseDroppedOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowEndReason": { - "path_match": "ipfix.reverseFlowEndReason", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseObservationPointId": { - "path_match": "ipfix.reverseObservationPointId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIcmpTypeCodeIPv6": { - "path_match": "ipfix.reverseIcmpTypeCodeIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsTopLabelIPv6Address": { - "path_match": "ipfix.reverseMplsTopLabelIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseLineCardId": { - "path_match": "ipfix.reverseLineCardId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePortId": { - "path_match": "ipfix.reversePortId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMeteringProcessId": { - "path_match": "ipfix.reverseMeteringProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseExportingProcessId": { - "path_match": "ipfix.reverseExportingProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseWlanChannelId": { - "path_match": "ipfix.reverseWlanChannelId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseWlanSSID": { - "path_match": "ipfix.reverseWlanSSID", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseFlowStartSeconds": { - "path_match": "ipfix.reverseFlowStartSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowEndSeconds": { - "path_match": "ipfix.reverseFlowEndSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowStartMilliseconds": { - "path_match": "ipfix.reverseFlowStartMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowEndMilliseconds": { - "path_match": "ipfix.reverseFlowEndMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowStartMicroseconds": { - "path_match": "ipfix.reverseFlowStartMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowEndMicroseconds": { - "path_match": "ipfix.reverseFlowEndMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowStartNanoseconds": { - "path_match": "ipfix.reverseFlowStartNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowEndNanoseconds": { - "path_match": "ipfix.reverseFlowEndNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowStartDeltaMicroseconds": { - "path_match": "ipfix.reverseFlowStartDeltaMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowEndDeltaMicroseconds": { - "path_match": "ipfix.reverseFlowEndDeltaMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSystemInitTimeMilliseconds": { - "path_match": "ipfix.reverseSystemInitTimeMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowDurationMilliseconds": { - "path_match": "ipfix.reverseFlowDurationMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowDurationMicroseconds": { - "path_match": "ipfix.reverseFlowDurationMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDestinationIPv6Prefix": { - "path_match": "ipfix.reverseDestinationIPv6Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseSourceIPv6Prefix": { - "path_match": "ipfix.reverseSourceIPv6Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reversePostOctetTotalCount": { - "path_match": "ipfix.reversePostOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostPacketTotalCount": { - "path_match": "ipfix.reversePostPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostMCastPacketTotalCount": { - "path_match": "ipfix.reversePostMCastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostMCastOctetTotalCount": { - "path_match": "ipfix.reversePostMCastOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIcmpTypeIPv4": { - "path_match": "ipfix.reverseIcmpTypeIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIcmpCodeIPv4": { - "path_match": "ipfix.reverseIcmpCodeIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIcmpTypeIPv6": { - "path_match": "ipfix.reverseIcmpTypeIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIcmpCodeIPv6": { - "path_match": "ipfix.reverseIcmpCodeIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseUdpSourcePort": { - "path_match": "ipfix.reverseUdpSourcePort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseUdpDestinationPort": { - "path_match": "ipfix.reverseUdpDestinationPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpSourcePort": { - "path_match": "ipfix.reverseTcpSourcePort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpDestinationPort": { - "path_match": "ipfix.reverseTcpDestinationPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpSequenceNumber": { - "path_match": "ipfix.reverseTcpSequenceNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpAcknowledgementNumber": { - "path_match": "ipfix.reverseTcpAcknowledgementNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpWindowSize": { - "path_match": "ipfix.reverseTcpWindowSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpUrgentPointer": { - "path_match": "ipfix.reverseTcpUrgentPointer", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpHeaderLength": { - "path_match": "ipfix.reverseTcpHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpHeaderLength": { - "path_match": "ipfix.reverseIpHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTotalLengthIPv4": { - "path_match": "ipfix.reverseTotalLengthIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePayloadLengthIPv6": { - "path_match": "ipfix.reversePayloadLengthIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpTTL": { - "path_match": "ipfix.reverseIpTTL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseNextHeaderIPv6": { - "path_match": "ipfix.reverseNextHeaderIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsPayloadLength": { - "path_match": "ipfix.reverseMplsPayloadLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpDiffServCodePoint": { - "path_match": "ipfix.reverseIpDiffServCodePoint", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpPrecedence": { - "path_match": "ipfix.reverseIpPrecedence", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFragmentFlags": { - "path_match": "ipfix.reverseFragmentFlags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseOctetDeltaSumOfSquares": { - "path_match": "ipfix.reverseOctetDeltaSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseOctetTotalSumOfSquares": { - "path_match": "ipfix.reverseOctetTotalSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsTopLabelTTL": { - "path_match": "ipfix.reverseMplsTopLabelTTL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsLabelStackLength": { - "path_match": "ipfix.reverseMplsLabelStackLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsLabelStackDepth": { - "path_match": "ipfix.reverseMplsLabelStackDepth", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsTopLabelExp": { - "path_match": "ipfix.reverseMplsTopLabelExp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpPayloadLength": { - "path_match": "ipfix.reverseIpPayloadLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseUdpMessageLength": { - "path_match": "ipfix.reverseUdpMessageLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIsMulticast": { - "path_match": "ipfix.reverseIsMulticast", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpv4IHL": { - "path_match": "ipfix.reverseIpv4IHL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpv4Options": { - "path_match": "ipfix.reverseIpv4Options", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpOptions": { - "path_match": "ipfix.reverseTcpOptions", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpSynTotalCount": { - "path_match": "ipfix.reverseTcpSynTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpFinTotalCount": { - "path_match": "ipfix.reverseTcpFinTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpRstTotalCount": { - "path_match": "ipfix.reverseTcpRstTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpPshTotalCount": { - "path_match": "ipfix.reverseTcpPshTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpAckTotalCount": { - "path_match": "ipfix.reverseTcpAckTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpUrgTotalCount": { - "path_match": "ipfix.reverseTcpUrgTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpTotalLength": { - "path_match": "ipfix.reverseIpTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostNATSourceIPv4Address": { - "path_match": "ipfix.reversePostNATSourceIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reversePostNATDestinationIPv4Address": { - "path_match": "ipfix.reversePostNATDestinationIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reversePostNAPTSourceTransportPort": { - "path_match": "ipfix.reversePostNAPTSourceTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostNAPTDestinationTransportPort": { - "path_match": "ipfix.reversePostNAPTDestinationTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseNatOriginatingAddressRealm": { - "path_match": "ipfix.reverseNatOriginatingAddressRealm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseNatEvent": { - "path_match": "ipfix.reverseNatEvent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseInitiatorOctets": { - "path_match": "ipfix.reverseInitiatorOctets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseResponderOctets": { - "path_match": "ipfix.reverseResponderOctets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFirewallEvent": { - "path_match": "ipfix.reverseFirewallEvent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIngressVRFID": { - "path_match": "ipfix.reverseIngressVRFID", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEgressVRFID": { - "path_match": "ipfix.reverseEgressVRFID", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseVRFname": { - "path_match": "ipfix.reverseVRFname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reversePostMplsTopLabelExp": { - "path_match": "ipfix.reversePostMplsTopLabelExp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpWindowScale": { - "path_match": "ipfix.reverseTcpWindowScale", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEthernetHeaderLength": { - "path_match": "ipfix.reverseEthernetHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEthernetPayloadLength": { - "path_match": "ipfix.reverseEthernetPayloadLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEthernetTotalLength": { - "path_match": "ipfix.reverseEthernetTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qVlanId": { - "path_match": "ipfix.reverseDot1qVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qPriority": { - "path_match": "ipfix.reverseDot1qPriority", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qCustomerVlanId": { - "path_match": "ipfix.reverseDot1qCustomerVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qCustomerPriority": { - "path_match": "ipfix.reverseDot1qCustomerPriority", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMetroEvcId": { - "path_match": "ipfix.reverseMetroEvcId", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMetroEvcType": { - "path_match": "ipfix.reverseMetroEvcType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePseudoWireId": { - "path_match": "ipfix.reversePseudoWireId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePseudoWireType": { - "path_match": "ipfix.reversePseudoWireType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePseudoWireControlWord": { - "path_match": "ipfix.reversePseudoWireControlWord", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIngressPhysicalInterface": { - "path_match": "ipfix.reverseIngressPhysicalInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEgressPhysicalInterface": { - "path_match": "ipfix.reverseEgressPhysicalInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostDot1qVlanId": { - "path_match": "ipfix.reversePostDot1qVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostDot1qCustomerVlanId": { - "path_match": "ipfix.reversePostDot1qCustomerVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEthernetType": { - "path_match": "ipfix.reverseEthernetType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostIpPrecedence": { - "path_match": "ipfix.reversePostIpPrecedence", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseCollectionTimeMilliseconds": { - "path_match": "ipfix.reverseCollectionTimeMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseExportSctpStreamId": { - "path_match": "ipfix.reverseExportSctpStreamId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMaxExportSeconds": { - "path_match": "ipfix.reverseMaxExportSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMaxFlowEndSeconds": { - "path_match": "ipfix.reverseMaxFlowEndSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMessageMD5Checksum": { - "path_match": "ipfix.reverseMessageMD5Checksum", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMessageScope": { - "path_match": "ipfix.reverseMessageScope", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMinExportSeconds": { - "path_match": "ipfix.reverseMinExportSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMinFlowStartSeconds": { - "path_match": "ipfix.reverseMinFlowStartSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseOpaqueOctets": { - "path_match": "ipfix.reverseOpaqueOctets", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseSessionScope": { - "path_match": "ipfix.reverseSessionScope", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMaxFlowEndMicroseconds": { - "path_match": "ipfix.reverseMaxFlowEndMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMaxFlowEndMilliseconds": { - "path_match": "ipfix.reverseMaxFlowEndMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMaxFlowEndNanoseconds": { - "path_match": "ipfix.reverseMaxFlowEndNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMinFlowStartMicroseconds": { - "path_match": "ipfix.reverseMinFlowStartMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMinFlowStartMilliseconds": { - "path_match": "ipfix.reverseMinFlowStartMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMinFlowStartNanoseconds": { - "path_match": "ipfix.reverseMinFlowStartNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseCollectorCertificate": { - "path_match": "ipfix.reverseCollectorCertificate", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseExporterCertificate": { - "path_match": "ipfix.reverseExporterCertificate", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseDataRecordsReliability": { - "path_match": "ipfix.reverseDataRecordsReliability", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseObservationPointType": { - "path_match": "ipfix.reverseObservationPointType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseNewConnectionDeltaCount": { - "path_match": "ipfix.reverseNewConnectionDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseConnectionSumDurationSeconds": { - "path_match": "ipfix.reverseConnectionSumDurationSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseConnectionTransactionId": { - "path_match": "ipfix.reverseConnectionTransactionId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostNATSourceIPv6Address": { - "path_match": "ipfix.reversePostNATSourceIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reversePostNATDestinationIPv6Address": { - "path_match": "ipfix.reversePostNATDestinationIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseNatPoolId": { - "path_match": "ipfix.reverseNatPoolId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseNatPoolName": { - "path_match": "ipfix.reverseNatPoolName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseAnonymizationFlags": { - "path_match": "ipfix.reverseAnonymizationFlags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseAnonymizationTechnique": { - "path_match": "ipfix.reverseAnonymizationTechnique", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseInformationElementIndex": { - "path_match": "ipfix.reverseInformationElementIndex", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseP2pTechnology": { - "path_match": "ipfix.reverseP2pTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseTunnelTechnology": { - "path_match": "ipfix.reverseTunnelTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseEncryptedTechnology": { - "path_match": "ipfix.reverseEncryptedTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseBgpValidityState": { - "path_match": "ipfix.reverseBgpValidityState", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIPSecSPI": { - "path_match": "ipfix.reverseIPSecSPI", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseGreKey": { - "path_match": "ipfix.reverseGreKey", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseNatType": { - "path_match": "ipfix.reverseNatType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseInitiatorPackets": { - "path_match": "ipfix.reverseInitiatorPackets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseResponderPackets": { - "path_match": "ipfix.reverseResponderPackets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseObservationDomainName": { - "path_match": "ipfix.reverseObservationDomainName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseSelectionSequenceId": { - "path_match": "ipfix.reverseSelectionSequenceId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSelectorId": { - "path_match": "ipfix.reverseSelectorId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseInformationElementId": { - "path_match": "ipfix.reverseInformationElementId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSelectorAlgorithm": { - "path_match": "ipfix.reverseSelectorAlgorithm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingPacketInterval": { - "path_match": "ipfix.reverseSamplingPacketInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingPacketSpace": { - "path_match": "ipfix.reverseSamplingPacketSpace", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingTimeInterval": { - "path_match": "ipfix.reverseSamplingTimeInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingTimeSpace": { - "path_match": "ipfix.reverseSamplingTimeSpace", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingSize": { - "path_match": "ipfix.reverseSamplingSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingPopulation": { - "path_match": "ipfix.reverseSamplingPopulation", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingProbability": { - "path_match": "ipfix.reverseSamplingProbability", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDataLinkFrameSize": { - "path_match": "ipfix.reverseDataLinkFrameSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpHeaderPacketSection": { - "path_match": "ipfix.reverseIpHeaderPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseIpPayloadPacketSection": { - "path_match": "ipfix.reverseIpPayloadPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseDataLinkFrameSection": { - "path_match": "ipfix.reverseDataLinkFrameSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection": { - "path_match": "ipfix.reverseMplsLabelStackSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsPayloadPacketSection": { - "path_match": "ipfix.reverseMplsPayloadPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseSelectorIdTotalPktsObserved": { - "path_match": "ipfix.reverseSelectorIdTotalPktsObserved", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSelectorIdTotalPktsSelected": { - "path_match": "ipfix.reverseSelectorIdTotalPktsSelected", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseAbsoluteError": { - "path_match": "ipfix.reverseAbsoluteError", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.reverseRelativeError": { - "path_match": "ipfix.reverseRelativeError", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.reverseObservationTimeSeconds": { - "path_match": "ipfix.reverseObservationTimeSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseObservationTimeMilliseconds": { - "path_match": "ipfix.reverseObservationTimeMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseObservationTimeMicroseconds": { - "path_match": "ipfix.reverseObservationTimeMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseObservationTimeNanoseconds": { - "path_match": "ipfix.reverseObservationTimeNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDigestHashValue": { - "path_match": "ipfix.reverseDigestHashValue", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashIPPayloadOffset": { - "path_match": "ipfix.reverseHashIPPayloadOffset", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashIPPayloadSize": { - "path_match": "ipfix.reverseHashIPPayloadSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashOutputRangeMin": { - "path_match": "ipfix.reverseHashOutputRangeMin", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashOutputRangeMax": { - "path_match": "ipfix.reverseHashOutputRangeMax", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashSelectedRangeMin": { - "path_match": "ipfix.reverseHashSelectedRangeMin", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashSelectedRangeMax": { - "path_match": "ipfix.reverseHashSelectedRangeMax", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashDigestOutput": { - "path_match": "ipfix.reverseHashDigestOutput", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashInitialiserValue": { - "path_match": "ipfix.reverseHashInitialiserValue", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSelectorName": { - "path_match": "ipfix.reverseSelectorName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseUpperCILimit": { - "path_match": "ipfix.reverseUpperCILimit", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.reverseLowerCILimit": { - "path_match": "ipfix.reverseLowerCILimit", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.reverseConfidenceLevel": { - "path_match": "ipfix.reverseConfidenceLevel", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.reverseInformationElementDataType": { - "path_match": "ipfix.reverseInformationElementDataType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseInformationElementDescription": { - "path_match": "ipfix.reverseInformationElementDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseInformationElementName": { - "path_match": "ipfix.reverseInformationElementName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseInformationElementRangeBegin": { - "path_match": "ipfix.reverseInformationElementRangeBegin", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseInformationElementRangeEnd": { - "path_match": "ipfix.reverseInformationElementRangeEnd", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseInformationElementSemantics": { - "path_match": "ipfix.reverseInformationElementSemantics", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseInformationElementUnits": { - "path_match": "ipfix.reverseInformationElementUnits", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePrivateEnterpriseNumber": { - "path_match": "ipfix.reversePrivateEnterpriseNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseVirtualStationInterfaceId": { - "path_match": "ipfix.reverseVirtualStationInterfaceId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseVirtualStationInterfaceName": { - "path_match": "ipfix.reverseVirtualStationInterfaceName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseVirtualStationUUID": { - "path_match": "ipfix.reverseVirtualStationUUID", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseVirtualStationName": { - "path_match": "ipfix.reverseVirtualStationName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseLayer2SegmentId": { - "path_match": "ipfix.reverseLayer2SegmentId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2OctetDeltaCount": { - "path_match": "ipfix.reverseLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2OctetTotalCount": { - "path_match": "ipfix.reverseLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIngressUnicastPacketTotalCount": { - "path_match": "ipfix.reverseIngressUnicastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIngressMulticastPacketTotalCount": { - "path_match": "ipfix.reverseIngressMulticastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIngressBroadcastPacketTotalCount": { - "path_match": "ipfix.reverseIngressBroadcastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEgressUnicastPacketTotalCount": { - "path_match": "ipfix.reverseEgressUnicastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEgressBroadcastPacketTotalCount": { - "path_match": "ipfix.reverseEgressBroadcastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMonitoringIntervalStartMilliSeconds": { - "path_match": "ipfix.reverseMonitoringIntervalStartMilliSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMonitoringIntervalEndMilliSeconds": { - "path_match": "ipfix.reverseMonitoringIntervalEndMilliSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePortRangeStart": { - "path_match": "ipfix.reversePortRangeStart", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePortRangeEnd": { - "path_match": "ipfix.reversePortRangeEnd", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePortRangeStepSize": { - "path_match": "ipfix.reversePortRangeStepSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePortRangeNumPorts": { - "path_match": "ipfix.reversePortRangeNumPorts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseStaMacAddress": { - "path_match": "ipfix.reverseStaMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseStaIPv4Address": { - "path_match": "ipfix.reverseStaIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseWtpMacAddress": { - "path_match": "ipfix.reverseWtpMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseIngressInterfaceType": { - "path_match": "ipfix.reverseIngressInterfaceType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEgressInterfaceType": { - "path_match": "ipfix.reverseEgressInterfaceType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseRtpSequenceNumber": { - "path_match": "ipfix.reverseRtpSequenceNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseUserName": { - "path_match": "ipfix.reverseUserName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseApplicationCategoryName": { - "path_match": "ipfix.reverseApplicationCategoryName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseApplicationSubCategoryName": { - "path_match": "ipfix.reverseApplicationSubCategoryName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseApplicationGroupName": { - "path_match": "ipfix.reverseApplicationGroupName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseOriginalFlowsPresent": { - "path_match": "ipfix.reverseOriginalFlowsPresent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseOriginalFlowsInitiated": { - "path_match": "ipfix.reverseOriginalFlowsInitiated", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseOriginalFlowsCompleted": { - "path_match": "ipfix.reverseOriginalFlowsCompleted", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDistinctCountOfSourceIPAddress": { - "path_match": "ipfix.reverseDistinctCountOfSourceIPAddress", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDistinctCountOfDestinationIPAddress": { - "path_match": "ipfix.reverseDistinctCountOfDestinationIPAddress", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDistinctCountOfSourceIPv4Address": { - "path_match": "ipfix.reverseDistinctCountOfSourceIPv4Address", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDistinctCountOfDestinationIPv4Address": { - "path_match": "ipfix.reverseDistinctCountOfDestinationIPv4Address", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDistinctCountOfSourceIPv6Address": { - "path_match": "ipfix.reverseDistinctCountOfSourceIPv6Address", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDistinctCountOfDestinationIPv6Address": { - "path_match": "ipfix.reverseDistinctCountOfDestinationIPv6Address", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseValueDistributionMethod": { - "path_match": "ipfix.reverseValueDistributionMethod", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseRfc3550JitterMilliseconds": { - "path_match": "ipfix.reverseRfc3550JitterMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseRfc3550JitterMicroseconds": { - "path_match": "ipfix.reverseRfc3550JitterMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseRfc3550JitterNanoseconds": { - "path_match": "ipfix.reverseRfc3550JitterNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qDEI": { - "path_match": "ipfix.reverseDot1qDEI", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qCustomerDEI": { - "path_match": "ipfix.reverseDot1qCustomerDEI", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowSelectorAlgorithm": { - "path_match": "ipfix.reverseFlowSelectorAlgorithm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowSelectedOctetDeltaCount": { - "path_match": "ipfix.reverseFlowSelectedOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowSelectedPacketDeltaCount": { - "path_match": "ipfix.reverseFlowSelectedPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowSelectedFlowDeltaCount": { - "path_match": "ipfix.reverseFlowSelectedFlowDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSelectorIDTotalFlowsObserved": { - "path_match": "ipfix.reverseSelectorIDTotalFlowsObserved", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSelectorIDTotalFlowsSelected": { - "path_match": "ipfix.reverseSelectorIDTotalFlowsSelected", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingFlowInterval": { - "path_match": "ipfix.reverseSamplingFlowInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingFlowSpacing": { - "path_match": "ipfix.reverseSamplingFlowSpacing", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowSamplingTimeInterval": { - "path_match": "ipfix.reverseFlowSamplingTimeInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowSamplingTimeSpacing": { - "path_match": "ipfix.reverseFlowSamplingTimeSpacing", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashFlowDomain": { - "path_match": "ipfix.reverseHashFlowDomain", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTransportOctetDeltaCount": { - "path_match": "ipfix.reverseTransportOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTransportPacketDeltaCount": { - "path_match": "ipfix.reverseTransportPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseOriginalExporterIPv4Address": { - "path_match": "ipfix.reverseOriginalExporterIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseOriginalExporterIPv6Address": { - "path_match": "ipfix.reverseOriginalExporterIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseOriginalObservationDomainId": { - "path_match": "ipfix.reverseOriginalObservationDomainId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIntermediateProcessId": { - "path_match": "ipfix.reverseIntermediateProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIgnoredDataRecordTotalCount": { - "path_match": "ipfix.reverseIgnoredDataRecordTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDataLinkFrameType": { - "path_match": "ipfix.reverseDataLinkFrameType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSectionOffset": { - "path_match": "ipfix.reverseSectionOffset", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSectionExportedOctets": { - "path_match": "ipfix.reverseSectionExportedOctets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qServiceInstanceTag": { - "path_match": "ipfix.reverseDot1qServiceInstanceTag", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseDot1qServiceInstanceId": { - "path_match": "ipfix.reverseDot1qServiceInstanceId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qServiceInstancePriority": { - "path_match": "ipfix.reverseDot1qServiceInstancePriority", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qCustomerSourceMacAddress": { - "path_match": "ipfix.reverseDot1qCustomerSourceMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseDot1qCustomerDestinationMacAddress": { - "path_match": "ipfix.reverseDot1qCustomerDestinationMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reversePostLayer2OctetDeltaCount": { - "path_match": "ipfix.reversePostLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostMCastLayer2OctetDeltaCount": { - "path_match": "ipfix.reversePostMCastLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostLayer2OctetTotalCount": { - "path_match": "ipfix.reversePostLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - - { - "ipfix.reversePostMCastLayer2OctetTotalCount": { - "path_match": "ipfix.reversePostMCastLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMinimumLayer2TotalLength": { - "path_match": "ipfix.reverseMinimumLayer2TotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMaximumLayer2TotalLength": { - "path_match": "ipfix.reverseMaximumLayer2TotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDroppedLayer2OctetDeltaCount": { - "path_match": "ipfix.reverseDroppedLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDroppedLayer2OctetTotalCount": { - "path_match": "ipfix.reverseDroppedLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIgnoredLayer2OctetTotalCount": { - "path_match": "ipfix.reverseIgnoredLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseNotSentLayer2OctetTotalCount": { - "path_match": "ipfix.reverseNotSentLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2OctetDeltaSumOfSquares": { - "path_match": "ipfix.reverseLayer2OctetDeltaSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2OctetTotalSumOfSquares": { - "path_match": "ipfix.reverseLayer2OctetTotalSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2FrameDeltaCount": { - "path_match": "ipfix.reverseLayer2FrameDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2FrameTotalCount": { - "path_match": "ipfix.reverseLayer2FrameTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePseudoWireDestinationIPv4Address": { - "path_match": "ipfix.reversePseudoWireDestinationIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseIgnoredLayer2FrameTotalCount": { - "path_match": "ipfix.reverseIgnoredLayer2FrameTotalCount", - "mapping": { - "type": "long" - } - } - }, - + { + "ipfix.reverseOctetDeltaCount": { + "path_match": "ipfix.reverseOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePacketDeltaCount": { + "path_match": "ipfix.reversePacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDeltaFlowCount": { + "path_match": "ipfix.reverseDeltaFlowCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseProtocolIdentifier": { + "path_match": "ipfix.reverseProtocolIdentifier", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpClassOfService": { + "path_match": "ipfix.reverseIpClassOfService", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpControlBits": { + "path_match": "ipfix.reverseTcpControlBits", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSourceTransportPort": { + "path_match": "ipfix.reverseSourceTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSourceIPv4Address": { + "path_match": "ipfix.reverseSourceIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseSourceIPv4PrefixLength": { + "path_match": "ipfix.reverseSourceIPv4PrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIngressInterface": { + "path_match": "ipfix.reverseIngressInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDestinationTransportPort": { + "path_match": "ipfix.reverseDestinationTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDestinationIPv4Address": { + "path_match": "ipfix.reverseDestinationIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseDestinationIPv4PrefixLength": { + "path_match": "ipfix.reverseDestinationIPv4PrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEgressInterface": { + "path_match": "ipfix.reverseEgressInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpNextHopIPv4Address": { + "path_match": "ipfix.reverseIpNextHopIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseBgpSourceAsNumber": { + "path_match": "ipfix.reverseBgpSourceAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseBgpDestinationAsNumber": { + "path_match": "ipfix.reverseBgpDestinationAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseBgpNextHopIPv4Address": { + "path_match": "ipfix.reverseBgpNextHopIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reversePostMCastPacketDeltaCount": { + "path_match": "ipfix.reversePostMCastPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostMCastOctetDeltaCount": { + "path_match": "ipfix.reversePostMCastOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowEndSysUpTime": { + "path_match": "ipfix.reverseFlowEndSysUpTime", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowStartSysUpTime": { + "path_match": "ipfix.reverseFlowStartSysUpTime", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostOctetDeltaCount": { + "path_match": "ipfix.reversePostOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostPacketDeltaCount": { + "path_match": "ipfix.reversePostPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMinimumIpTotalLength": { + "path_match": "ipfix.reverseMinimumIpTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMaximumIpTotalLength": { + "path_match": "ipfix.reverseMaximumIpTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSourceIPv6Address": { + "path_match": "ipfix.reverseSourceIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseDestinationIPv6Address": { + "path_match": "ipfix.reverseDestinationIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseSourceIPv6PrefixLength": { + "path_match": "ipfix.reverseSourceIPv6PrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDestinationIPv6PrefixLength": { + "path_match": "ipfix.reverseDestinationIPv6PrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowLabelIPv6": { + "path_match": "ipfix.reverseFlowLabelIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIcmpTypeCodeIPv4": { + "path_match": "ipfix.reverseIcmpTypeCodeIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIgmpType": { + "path_match": "ipfix.reverseIgmpType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingInterval": { + "path_match": "ipfix.reverseSamplingInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingAlgorithm": { + "path_match": "ipfix.reverseSamplingAlgorithm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowActiveTimeout": { + "path_match": "ipfix.reverseFlowActiveTimeout", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowIdleTimeout": { + "path_match": "ipfix.reverseFlowIdleTimeout", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEngineType": { + "path_match": "ipfix.reverseEngineType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEngineId": { + "path_match": "ipfix.reverseEngineId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpv4RouterSc": { + "path_match": "ipfix.reverseIpv4RouterSc", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseSourceIPv4Prefix": { + "path_match": "ipfix.reverseSourceIPv4Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseDestinationIPv4Prefix": { + "path_match": "ipfix.reverseDestinationIPv4Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseMplsTopLabelType": { + "path_match": "ipfix.reverseMplsTopLabelType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsTopLabelIPv4Address": { + "path_match": "ipfix.reverseMplsTopLabelIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseSamplerId": { + "path_match": "ipfix.reverseSamplerId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplerMode": { + "path_match": "ipfix.reverseSamplerMode", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplerRandomInterval": { + "path_match": "ipfix.reverseSamplerRandomInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseClassId": { + "path_match": "ipfix.reverseClassId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMinimumTTL": { + "path_match": "ipfix.reverseMinimumTTL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMaximumTTL": { + "path_match": "ipfix.reverseMaximumTTL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFragmentIdentification": { + "path_match": "ipfix.reverseFragmentIdentification", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostIpClassOfService": { + "path_match": "ipfix.reversePostIpClassOfService", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSourceMacAddress": { + "path_match": "ipfix.reverseSourceMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reversePostDestinationMacAddress": { + "path_match": "ipfix.reversePostDestinationMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseVlanId": { + "path_match": "ipfix.reverseVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostVlanId": { + "path_match": "ipfix.reversePostVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpVersion": { + "path_match": "ipfix.reverseIpVersion", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowDirection": { + "path_match": "ipfix.reverseFlowDirection", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpNextHopIPv6Address": { + "path_match": "ipfix.reverseIpNextHopIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseBgpNextHopIPv6Address": { + "path_match": "ipfix.reverseBgpNextHopIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseIpv6ExtensionHeaders": { + "path_match": "ipfix.reverseIpv6ExtensionHeaders", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsTopLabelStackSection": { + "path_match": "ipfix.reverseMplsTopLabelStackSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection2": { + "path_match": "ipfix.reverseMplsLabelStackSection2", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection3": { + "path_match": "ipfix.reverseMplsLabelStackSection3", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection4": { + "path_match": "ipfix.reverseMplsLabelStackSection4", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection5": { + "path_match": "ipfix.reverseMplsLabelStackSection5", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection6": { + "path_match": "ipfix.reverseMplsLabelStackSection6", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection7": { + "path_match": "ipfix.reverseMplsLabelStackSection7", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection8": { + "path_match": "ipfix.reverseMplsLabelStackSection8", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection9": { + "path_match": "ipfix.reverseMplsLabelStackSection9", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection10": { + "path_match": "ipfix.reverseMplsLabelStackSection10", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseDestinationMacAddress": { + "path_match": "ipfix.reverseDestinationMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reversePostSourceMacAddress": { + "path_match": "ipfix.reversePostSourceMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseInterfaceName": { + "path_match": "ipfix.reverseInterfaceName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseInterfaceDescription": { + "path_match": "ipfix.reverseInterfaceDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseSamplerName": { + "path_match": "ipfix.reverseSamplerName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseOctetTotalCount": { + "path_match": "ipfix.reverseOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePacketTotalCount": { + "path_match": "ipfix.reversePacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlagsAndSamplerId": { + "path_match": "ipfix.reverseFlagsAndSamplerId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFragmentOffset": { + "path_match": "ipfix.reverseFragmentOffset", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseForwardingStatus": { + "path_match": "ipfix.reverseForwardingStatus", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsVpnRouteDistinguisher": { + "path_match": "ipfix.reverseMplsVpnRouteDistinguisher", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsTopLabelPrefixLength": { + "path_match": "ipfix.reverseMplsTopLabelPrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSrcTrafficIndex": { + "path_match": "ipfix.reverseSrcTrafficIndex", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDstTrafficIndex": { + "path_match": "ipfix.reverseDstTrafficIndex", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseApplicationDescription": { + "path_match": "ipfix.reverseApplicationDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseApplicationId": { + "path_match": "ipfix.reverseApplicationId", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseApplicationName": { + "path_match": "ipfix.reverseApplicationName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reversePostIpDiffServCodePoint": { + "path_match": "ipfix.reversePostIpDiffServCodePoint", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMulticastReplicationFactor": { + "path_match": "ipfix.reverseMulticastReplicationFactor", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseClassName": { + "path_match": "ipfix.reverseClassName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseClassificationEngineId": { + "path_match": "ipfix.reverseClassificationEngineId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2packetSectionOffset": { + "path_match": "ipfix.reverseLayer2packetSectionOffset", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2packetSectionSize": { + "path_match": "ipfix.reverseLayer2packetSectionSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2packetSectionData": { + "path_match": "ipfix.reverseLayer2packetSectionData", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseBgpNextAdjacentAsNumber": { + "path_match": "ipfix.reverseBgpNextAdjacentAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseBgpPrevAdjacentAsNumber": { + "path_match": "ipfix.reverseBgpPrevAdjacentAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDroppedOctetDeltaCount": { + "path_match": "ipfix.reverseDroppedOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDroppedPacketDeltaCount": { + "path_match": "ipfix.reverseDroppedPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDroppedPacketTotalCount": { + "path_match": "ipfix.reverseDroppedPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDroppedOctetTotalCount": { + "path_match": "ipfix.reverseDroppedOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowEndReason": { + "path_match": "ipfix.reverseFlowEndReason", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseObservationPointId": { + "path_match": "ipfix.reverseObservationPointId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIcmpTypeCodeIPv6": { + "path_match": "ipfix.reverseIcmpTypeCodeIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsTopLabelIPv6Address": { + "path_match": "ipfix.reverseMplsTopLabelIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseLineCardId": { + "path_match": "ipfix.reverseLineCardId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePortId": { + "path_match": "ipfix.reversePortId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMeteringProcessId": { + "path_match": "ipfix.reverseMeteringProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseExportingProcessId": { + "path_match": "ipfix.reverseExportingProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseWlanChannelId": { + "path_match": "ipfix.reverseWlanChannelId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseWlanSSID": { + "path_match": "ipfix.reverseWlanSSID", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseFlowStartSeconds": { + "path_match": "ipfix.reverseFlowStartSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowEndSeconds": { + "path_match": "ipfix.reverseFlowEndSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowStartMilliseconds": { + "path_match": "ipfix.reverseFlowStartMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowEndMilliseconds": { + "path_match": "ipfix.reverseFlowEndMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowStartMicroseconds": { + "path_match": "ipfix.reverseFlowStartMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowEndMicroseconds": { + "path_match": "ipfix.reverseFlowEndMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowStartNanoseconds": { + "path_match": "ipfix.reverseFlowStartNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowEndNanoseconds": { + "path_match": "ipfix.reverseFlowEndNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowStartDeltaMicroseconds": { + "path_match": "ipfix.reverseFlowStartDeltaMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowEndDeltaMicroseconds": { + "path_match": "ipfix.reverseFlowEndDeltaMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSystemInitTimeMilliseconds": { + "path_match": "ipfix.reverseSystemInitTimeMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowDurationMilliseconds": { + "path_match": "ipfix.reverseFlowDurationMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowDurationMicroseconds": { + "path_match": "ipfix.reverseFlowDurationMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDestinationIPv6Prefix": { + "path_match": "ipfix.reverseDestinationIPv6Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseSourceIPv6Prefix": { + "path_match": "ipfix.reverseSourceIPv6Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reversePostOctetTotalCount": { + "path_match": "ipfix.reversePostOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostPacketTotalCount": { + "path_match": "ipfix.reversePostPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostMCastPacketTotalCount": { + "path_match": "ipfix.reversePostMCastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostMCastOctetTotalCount": { + "path_match": "ipfix.reversePostMCastOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIcmpTypeIPv4": { + "path_match": "ipfix.reverseIcmpTypeIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIcmpCodeIPv4": { + "path_match": "ipfix.reverseIcmpCodeIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIcmpTypeIPv6": { + "path_match": "ipfix.reverseIcmpTypeIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIcmpCodeIPv6": { + "path_match": "ipfix.reverseIcmpCodeIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseUdpSourcePort": { + "path_match": "ipfix.reverseUdpSourcePort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseUdpDestinationPort": { + "path_match": "ipfix.reverseUdpDestinationPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpSourcePort": { + "path_match": "ipfix.reverseTcpSourcePort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpDestinationPort": { + "path_match": "ipfix.reverseTcpDestinationPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpSequenceNumber": { + "path_match": "ipfix.reverseTcpSequenceNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpAcknowledgementNumber": { + "path_match": "ipfix.reverseTcpAcknowledgementNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpWindowSize": { + "path_match": "ipfix.reverseTcpWindowSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpUrgentPointer": { + "path_match": "ipfix.reverseTcpUrgentPointer", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpHeaderLength": { + "path_match": "ipfix.reverseTcpHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpHeaderLength": { + "path_match": "ipfix.reverseIpHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTotalLengthIPv4": { + "path_match": "ipfix.reverseTotalLengthIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePayloadLengthIPv6": { + "path_match": "ipfix.reversePayloadLengthIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpTTL": { + "path_match": "ipfix.reverseIpTTL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseNextHeaderIPv6": { + "path_match": "ipfix.reverseNextHeaderIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsPayloadLength": { + "path_match": "ipfix.reverseMplsPayloadLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpDiffServCodePoint": { + "path_match": "ipfix.reverseIpDiffServCodePoint", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpPrecedence": { + "path_match": "ipfix.reverseIpPrecedence", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFragmentFlags": { + "path_match": "ipfix.reverseFragmentFlags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseOctetDeltaSumOfSquares": { + "path_match": "ipfix.reverseOctetDeltaSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseOctetTotalSumOfSquares": { + "path_match": "ipfix.reverseOctetTotalSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsTopLabelTTL": { + "path_match": "ipfix.reverseMplsTopLabelTTL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsLabelStackLength": { + "path_match": "ipfix.reverseMplsLabelStackLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsLabelStackDepth": { + "path_match": "ipfix.reverseMplsLabelStackDepth", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsTopLabelExp": { + "path_match": "ipfix.reverseMplsTopLabelExp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpPayloadLength": { + "path_match": "ipfix.reverseIpPayloadLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseUdpMessageLength": { + "path_match": "ipfix.reverseUdpMessageLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIsMulticast": { + "path_match": "ipfix.reverseIsMulticast", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpv4IHL": { + "path_match": "ipfix.reverseIpv4IHL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpv4Options": { + "path_match": "ipfix.reverseIpv4Options", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpOptions": { + "path_match": "ipfix.reverseTcpOptions", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpSynTotalCount": { + "path_match": "ipfix.reverseTcpSynTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpFinTotalCount": { + "path_match": "ipfix.reverseTcpFinTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpRstTotalCount": { + "path_match": "ipfix.reverseTcpRstTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpPshTotalCount": { + "path_match": "ipfix.reverseTcpPshTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpAckTotalCount": { + "path_match": "ipfix.reverseTcpAckTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpUrgTotalCount": { + "path_match": "ipfix.reverseTcpUrgTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpTotalLength": { + "path_match": "ipfix.reverseIpTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostNATSourceIPv4Address": { + "path_match": "ipfix.reversePostNATSourceIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reversePostNATDestinationIPv4Address": { + "path_match": "ipfix.reversePostNATDestinationIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reversePostNAPTSourceTransportPort": { + "path_match": "ipfix.reversePostNAPTSourceTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostNAPTDestinationTransportPort": { + "path_match": "ipfix.reversePostNAPTDestinationTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseNatOriginatingAddressRealm": { + "path_match": "ipfix.reverseNatOriginatingAddressRealm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseNatEvent": { + "path_match": "ipfix.reverseNatEvent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseInitiatorOctets": { + "path_match": "ipfix.reverseInitiatorOctets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseResponderOctets": { + "path_match": "ipfix.reverseResponderOctets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFirewallEvent": { + "path_match": "ipfix.reverseFirewallEvent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIngressVRFID": { + "path_match": "ipfix.reverseIngressVRFID", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEgressVRFID": { + "path_match": "ipfix.reverseEgressVRFID", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseVRFname": { + "path_match": "ipfix.reverseVRFname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reversePostMplsTopLabelExp": { + "path_match": "ipfix.reversePostMplsTopLabelExp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpWindowScale": { + "path_match": "ipfix.reverseTcpWindowScale", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEthernetHeaderLength": { + "path_match": "ipfix.reverseEthernetHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEthernetPayloadLength": { + "path_match": "ipfix.reverseEthernetPayloadLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEthernetTotalLength": { + "path_match": "ipfix.reverseEthernetTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qVlanId": { + "path_match": "ipfix.reverseDot1qVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qPriority": { + "path_match": "ipfix.reverseDot1qPriority", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qCustomerVlanId": { + "path_match": "ipfix.reverseDot1qCustomerVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qCustomerPriority": { + "path_match": "ipfix.reverseDot1qCustomerPriority", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMetroEvcId": { + "path_match": "ipfix.reverseMetroEvcId", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMetroEvcType": { + "path_match": "ipfix.reverseMetroEvcType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePseudoWireId": { + "path_match": "ipfix.reversePseudoWireId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePseudoWireType": { + "path_match": "ipfix.reversePseudoWireType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePseudoWireControlWord": { + "path_match": "ipfix.reversePseudoWireControlWord", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIngressPhysicalInterface": { + "path_match": "ipfix.reverseIngressPhysicalInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEgressPhysicalInterface": { + "path_match": "ipfix.reverseEgressPhysicalInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostDot1qVlanId": { + "path_match": "ipfix.reversePostDot1qVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostDot1qCustomerVlanId": { + "path_match": "ipfix.reversePostDot1qCustomerVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEthernetType": { + "path_match": "ipfix.reverseEthernetType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostIpPrecedence": { + "path_match": "ipfix.reversePostIpPrecedence", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseCollectionTimeMilliseconds": { + "path_match": "ipfix.reverseCollectionTimeMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseExportSctpStreamId": { + "path_match": "ipfix.reverseExportSctpStreamId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMaxExportSeconds": { + "path_match": "ipfix.reverseMaxExportSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMaxFlowEndSeconds": { + "path_match": "ipfix.reverseMaxFlowEndSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMessageMD5Checksum": { + "path_match": "ipfix.reverseMessageMD5Checksum", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMessageScope": { + "path_match": "ipfix.reverseMessageScope", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMinExportSeconds": { + "path_match": "ipfix.reverseMinExportSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMinFlowStartSeconds": { + "path_match": "ipfix.reverseMinFlowStartSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseOpaqueOctets": { + "path_match": "ipfix.reverseOpaqueOctets", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseSessionScope": { + "path_match": "ipfix.reverseSessionScope", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMaxFlowEndMicroseconds": { + "path_match": "ipfix.reverseMaxFlowEndMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMaxFlowEndMilliseconds": { + "path_match": "ipfix.reverseMaxFlowEndMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMaxFlowEndNanoseconds": { + "path_match": "ipfix.reverseMaxFlowEndNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMinFlowStartMicroseconds": { + "path_match": "ipfix.reverseMinFlowStartMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMinFlowStartMilliseconds": { + "path_match": "ipfix.reverseMinFlowStartMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMinFlowStartNanoseconds": { + "path_match": "ipfix.reverseMinFlowStartNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseCollectorCertificate": { + "path_match": "ipfix.reverseCollectorCertificate", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseExporterCertificate": { + "path_match": "ipfix.reverseExporterCertificate", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseDataRecordsReliability": { + "path_match": "ipfix.reverseDataRecordsReliability", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseObservationPointType": { + "path_match": "ipfix.reverseObservationPointType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseNewConnectionDeltaCount": { + "path_match": "ipfix.reverseNewConnectionDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseConnectionSumDurationSeconds": { + "path_match": "ipfix.reverseConnectionSumDurationSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseConnectionTransactionId": { + "path_match": "ipfix.reverseConnectionTransactionId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostNATSourceIPv6Address": { + "path_match": "ipfix.reversePostNATSourceIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reversePostNATDestinationIPv6Address": { + "path_match": "ipfix.reversePostNATDestinationIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseNatPoolId": { + "path_match": "ipfix.reverseNatPoolId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseNatPoolName": { + "path_match": "ipfix.reverseNatPoolName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseAnonymizationFlags": { + "path_match": "ipfix.reverseAnonymizationFlags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseAnonymizationTechnique": { + "path_match": "ipfix.reverseAnonymizationTechnique", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseInformationElementIndex": { + "path_match": "ipfix.reverseInformationElementIndex", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseP2pTechnology": { + "path_match": "ipfix.reverseP2pTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseTunnelTechnology": { + "path_match": "ipfix.reverseTunnelTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseEncryptedTechnology": { + "path_match": "ipfix.reverseEncryptedTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseBgpValidityState": { + "path_match": "ipfix.reverseBgpValidityState", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIPSecSPI": { + "path_match": "ipfix.reverseIPSecSPI", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseGreKey": { + "path_match": "ipfix.reverseGreKey", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseNatType": { + "path_match": "ipfix.reverseNatType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseInitiatorPackets": { + "path_match": "ipfix.reverseInitiatorPackets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseResponderPackets": { + "path_match": "ipfix.reverseResponderPackets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseObservationDomainName": { + "path_match": "ipfix.reverseObservationDomainName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseSelectionSequenceId": { + "path_match": "ipfix.reverseSelectionSequenceId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSelectorId": { + "path_match": "ipfix.reverseSelectorId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseInformationElementId": { + "path_match": "ipfix.reverseInformationElementId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSelectorAlgorithm": { + "path_match": "ipfix.reverseSelectorAlgorithm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingPacketInterval": { + "path_match": "ipfix.reverseSamplingPacketInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingPacketSpace": { + "path_match": "ipfix.reverseSamplingPacketSpace", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingTimeInterval": { + "path_match": "ipfix.reverseSamplingTimeInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingTimeSpace": { + "path_match": "ipfix.reverseSamplingTimeSpace", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingSize": { + "path_match": "ipfix.reverseSamplingSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingPopulation": { + "path_match": "ipfix.reverseSamplingPopulation", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingProbability": { + "path_match": "ipfix.reverseSamplingProbability", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDataLinkFrameSize": { + "path_match": "ipfix.reverseDataLinkFrameSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpHeaderPacketSection": { + "path_match": "ipfix.reverseIpHeaderPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseIpPayloadPacketSection": { + "path_match": "ipfix.reverseIpPayloadPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseDataLinkFrameSection": { + "path_match": "ipfix.reverseDataLinkFrameSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection": { + "path_match": "ipfix.reverseMplsLabelStackSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsPayloadPacketSection": { + "path_match": "ipfix.reverseMplsPayloadPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseSelectorIdTotalPktsObserved": { + "path_match": "ipfix.reverseSelectorIdTotalPktsObserved", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSelectorIdTotalPktsSelected": { + "path_match": "ipfix.reverseSelectorIdTotalPktsSelected", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseAbsoluteError": { + "path_match": "ipfix.reverseAbsoluteError", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.reverseRelativeError": { + "path_match": "ipfix.reverseRelativeError", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.reverseObservationTimeSeconds": { + "path_match": "ipfix.reverseObservationTimeSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseObservationTimeMilliseconds": { + "path_match": "ipfix.reverseObservationTimeMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseObservationTimeMicroseconds": { + "path_match": "ipfix.reverseObservationTimeMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseObservationTimeNanoseconds": { + "path_match": "ipfix.reverseObservationTimeNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDigestHashValue": { + "path_match": "ipfix.reverseDigestHashValue", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashIPPayloadOffset": { + "path_match": "ipfix.reverseHashIPPayloadOffset", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashIPPayloadSize": { + "path_match": "ipfix.reverseHashIPPayloadSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashOutputRangeMin": { + "path_match": "ipfix.reverseHashOutputRangeMin", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashOutputRangeMax": { + "path_match": "ipfix.reverseHashOutputRangeMax", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashSelectedRangeMin": { + "path_match": "ipfix.reverseHashSelectedRangeMin", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashSelectedRangeMax": { + "path_match": "ipfix.reverseHashSelectedRangeMax", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashDigestOutput": { + "path_match": "ipfix.reverseHashDigestOutput", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashInitialiserValue": { + "path_match": "ipfix.reverseHashInitialiserValue", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSelectorName": { + "path_match": "ipfix.reverseSelectorName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseUpperCILimit": { + "path_match": "ipfix.reverseUpperCILimit", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.reverseLowerCILimit": { + "path_match": "ipfix.reverseLowerCILimit", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.reverseConfidenceLevel": { + "path_match": "ipfix.reverseConfidenceLevel", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.reverseInformationElementDataType": { + "path_match": "ipfix.reverseInformationElementDataType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseInformationElementDescription": { + "path_match": "ipfix.reverseInformationElementDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseInformationElementName": { + "path_match": "ipfix.reverseInformationElementName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseInformationElementRangeBegin": { + "path_match": "ipfix.reverseInformationElementRangeBegin", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseInformationElementRangeEnd": { + "path_match": "ipfix.reverseInformationElementRangeEnd", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseInformationElementSemantics": { + "path_match": "ipfix.reverseInformationElementSemantics", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseInformationElementUnits": { + "path_match": "ipfix.reverseInformationElementUnits", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePrivateEnterpriseNumber": { + "path_match": "ipfix.reversePrivateEnterpriseNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseVirtualStationInterfaceId": { + "path_match": "ipfix.reverseVirtualStationInterfaceId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseVirtualStationInterfaceName": { + "path_match": "ipfix.reverseVirtualStationInterfaceName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseVirtualStationUUID": { + "path_match": "ipfix.reverseVirtualStationUUID", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseVirtualStationName": { + "path_match": "ipfix.reverseVirtualStationName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseLayer2SegmentId": { + "path_match": "ipfix.reverseLayer2SegmentId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2OctetDeltaCount": { + "path_match": "ipfix.reverseLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2OctetTotalCount": { + "path_match": "ipfix.reverseLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIngressUnicastPacketTotalCount": { + "path_match": "ipfix.reverseIngressUnicastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIngressMulticastPacketTotalCount": { + "path_match": "ipfix.reverseIngressMulticastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIngressBroadcastPacketTotalCount": { + "path_match": "ipfix.reverseIngressBroadcastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEgressUnicastPacketTotalCount": { + "path_match": "ipfix.reverseEgressUnicastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEgressBroadcastPacketTotalCount": { + "path_match": "ipfix.reverseEgressBroadcastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMonitoringIntervalStartMilliSeconds": { + "path_match": "ipfix.reverseMonitoringIntervalStartMilliSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMonitoringIntervalEndMilliSeconds": { + "path_match": "ipfix.reverseMonitoringIntervalEndMilliSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePortRangeStart": { + "path_match": "ipfix.reversePortRangeStart", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePortRangeEnd": { + "path_match": "ipfix.reversePortRangeEnd", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePortRangeStepSize": { + "path_match": "ipfix.reversePortRangeStepSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePortRangeNumPorts": { + "path_match": "ipfix.reversePortRangeNumPorts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseStaMacAddress": { + "path_match": "ipfix.reverseStaMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseStaIPv4Address": { + "path_match": "ipfix.reverseStaIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseWtpMacAddress": { + "path_match": "ipfix.reverseWtpMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseIngressInterfaceType": { + "path_match": "ipfix.reverseIngressInterfaceType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEgressInterfaceType": { + "path_match": "ipfix.reverseEgressInterfaceType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseRtpSequenceNumber": { + "path_match": "ipfix.reverseRtpSequenceNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseUserName": { + "path_match": "ipfix.reverseUserName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseApplicationCategoryName": { + "path_match": "ipfix.reverseApplicationCategoryName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseApplicationSubCategoryName": { + "path_match": "ipfix.reverseApplicationSubCategoryName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseApplicationGroupName": { + "path_match": "ipfix.reverseApplicationGroupName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseOriginalFlowsPresent": { + "path_match": "ipfix.reverseOriginalFlowsPresent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseOriginalFlowsInitiated": { + "path_match": "ipfix.reverseOriginalFlowsInitiated", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseOriginalFlowsCompleted": { + "path_match": "ipfix.reverseOriginalFlowsCompleted", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDistinctCountOfSourceIPAddress": { + "path_match": "ipfix.reverseDistinctCountOfSourceIPAddress", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDistinctCountOfDestinationIPAddress": { + "path_match": "ipfix.reverseDistinctCountOfDestinationIPAddress", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDistinctCountOfSourceIPv4Address": { + "path_match": "ipfix.reverseDistinctCountOfSourceIPv4Address", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDistinctCountOfDestinationIPv4Address": { + "path_match": "ipfix.reverseDistinctCountOfDestinationIPv4Address", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDistinctCountOfSourceIPv6Address": { + "path_match": "ipfix.reverseDistinctCountOfSourceIPv6Address", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDistinctCountOfDestinationIPv6Address": { + "path_match": "ipfix.reverseDistinctCountOfDestinationIPv6Address", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseValueDistributionMethod": { + "path_match": "ipfix.reverseValueDistributionMethod", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseRfc3550JitterMilliseconds": { + "path_match": "ipfix.reverseRfc3550JitterMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseRfc3550JitterMicroseconds": { + "path_match": "ipfix.reverseRfc3550JitterMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseRfc3550JitterNanoseconds": { + "path_match": "ipfix.reverseRfc3550JitterNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qDEI": { + "path_match": "ipfix.reverseDot1qDEI", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qCustomerDEI": { + "path_match": "ipfix.reverseDot1qCustomerDEI", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowSelectorAlgorithm": { + "path_match": "ipfix.reverseFlowSelectorAlgorithm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowSelectedOctetDeltaCount": { + "path_match": "ipfix.reverseFlowSelectedOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowSelectedPacketDeltaCount": { + "path_match": "ipfix.reverseFlowSelectedPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowSelectedFlowDeltaCount": { + "path_match": "ipfix.reverseFlowSelectedFlowDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSelectorIDTotalFlowsObserved": { + "path_match": "ipfix.reverseSelectorIDTotalFlowsObserved", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSelectorIDTotalFlowsSelected": { + "path_match": "ipfix.reverseSelectorIDTotalFlowsSelected", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingFlowInterval": { + "path_match": "ipfix.reverseSamplingFlowInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingFlowSpacing": { + "path_match": "ipfix.reverseSamplingFlowSpacing", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowSamplingTimeInterval": { + "path_match": "ipfix.reverseFlowSamplingTimeInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowSamplingTimeSpacing": { + "path_match": "ipfix.reverseFlowSamplingTimeSpacing", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashFlowDomain": { + "path_match": "ipfix.reverseHashFlowDomain", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTransportOctetDeltaCount": { + "path_match": "ipfix.reverseTransportOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTransportPacketDeltaCount": { + "path_match": "ipfix.reverseTransportPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseOriginalExporterIPv4Address": { + "path_match": "ipfix.reverseOriginalExporterIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseOriginalExporterIPv6Address": { + "path_match": "ipfix.reverseOriginalExporterIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseOriginalObservationDomainId": { + "path_match": "ipfix.reverseOriginalObservationDomainId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIntermediateProcessId": { + "path_match": "ipfix.reverseIntermediateProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIgnoredDataRecordTotalCount": { + "path_match": "ipfix.reverseIgnoredDataRecordTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDataLinkFrameType": { + "path_match": "ipfix.reverseDataLinkFrameType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSectionOffset": { + "path_match": "ipfix.reverseSectionOffset", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSectionExportedOctets": { + "path_match": "ipfix.reverseSectionExportedOctets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qServiceInstanceTag": { + "path_match": "ipfix.reverseDot1qServiceInstanceTag", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseDot1qServiceInstanceId": { + "path_match": "ipfix.reverseDot1qServiceInstanceId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qServiceInstancePriority": { + "path_match": "ipfix.reverseDot1qServiceInstancePriority", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qCustomerSourceMacAddress": { + "path_match": "ipfix.reverseDot1qCustomerSourceMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseDot1qCustomerDestinationMacAddress": { + "path_match": "ipfix.reverseDot1qCustomerDestinationMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reversePostLayer2OctetDeltaCount": { + "path_match": "ipfix.reversePostLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostMCastLayer2OctetDeltaCount": { + "path_match": "ipfix.reversePostMCastLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostLayer2OctetTotalCount": { + "path_match": "ipfix.reversePostLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + + { + "ipfix.reversePostMCastLayer2OctetTotalCount": { + "path_match": "ipfix.reversePostMCastLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMinimumLayer2TotalLength": { + "path_match": "ipfix.reverseMinimumLayer2TotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMaximumLayer2TotalLength": { + "path_match": "ipfix.reverseMaximumLayer2TotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDroppedLayer2OctetDeltaCount": { + "path_match": "ipfix.reverseDroppedLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDroppedLayer2OctetTotalCount": { + "path_match": "ipfix.reverseDroppedLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIgnoredLayer2OctetTotalCount": { + "path_match": "ipfix.reverseIgnoredLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseNotSentLayer2OctetTotalCount": { + "path_match": "ipfix.reverseNotSentLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2OctetDeltaSumOfSquares": { + "path_match": "ipfix.reverseLayer2OctetDeltaSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2OctetTotalSumOfSquares": { + "path_match": "ipfix.reverseLayer2OctetTotalSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2FrameDeltaCount": { + "path_match": "ipfix.reverseLayer2FrameDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2FrameTotalCount": { + "path_match": "ipfix.reverseLayer2FrameTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePseudoWireDestinationIPv4Address": { + "path_match": "ipfix.reversePseudoWireDestinationIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseIgnoredLayer2FrameTotalCount": { + "path_match": "ipfix.reverseIgnoredLayer2FrameTotalCount", + "mapping": { + "type": "long" + } + } + }, + - { - "ipfix.alu_nat_inside_svcid": { - "path_match": "ipfix.alu_nat_inside_svcid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.alu_nat_outside_svcid": { - "path_match": "ipfix.alu_nat_outside_svcid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.alu_nat_sub_string": { - "path_match": "ipfix.alu_nat_sub_string", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.alu_nat_inside_svcid": { + "path_match": "ipfix.alu_nat_inside_svcid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.alu_nat_outside_svcid": { + "path_match": "ipfix.alu_nat_outside_svcid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.alu_nat_sub_string": { + "path_match": "ipfix.alu_nat_sub_string", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.barracuda_timestamp": { - "path_match": "ipfix.barracuda_timestamp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.barracuda_log_op": { - "path_match": "ipfix.barracuda_log_op", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.barracuda_traffic_type": { - "path_match": "ipfix.barracuda_traffic_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.barracuda_fw_rule": { - "path_match": "ipfix.barracuda_fw_rule", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.barracuda_service": { - "path_match": "ipfix.barracuda_service", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.barracuda_reason": { - "path_match": "ipfix.barracuda_reason", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.barracuda_reason_text": { - "path_match": "ipfix.barracuda_reason_text", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.barracuda_bind_ipv4_addr": { - "path_match": "ipfix.barracuda_bind_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.barracuda_bind_l4_port": { - "path_match": "ipfix.barracuda_bind_l4_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.barracuda_conn_ipv4_addr": { - "path_match": "ipfix.barracuda_conn_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.barracuda_conn_l4_port": { - "path_match": "ipfix.barracuda_conn_l4_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.barracuda_audit_counter": { - "path_match": "ipfix.barracuda_audit_counter", - "mapping": { - "type": "long" - } - } - }, + { + "ipfix.barracuda_timestamp": { + "path_match": "ipfix.barracuda_timestamp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.barracuda_log_op": { + "path_match": "ipfix.barracuda_log_op", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.barracuda_traffic_type": { + "path_match": "ipfix.barracuda_traffic_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.barracuda_fw_rule": { + "path_match": "ipfix.barracuda_fw_rule", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.barracuda_service": { + "path_match": "ipfix.barracuda_service", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.barracuda_reason": { + "path_match": "ipfix.barracuda_reason", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.barracuda_reason_text": { + "path_match": "ipfix.barracuda_reason_text", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.barracuda_bind_ipv4_addr": { + "path_match": "ipfix.barracuda_bind_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.barracuda_bind_l4_port": { + "path_match": "ipfix.barracuda_bind_l4_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.barracuda_conn_ipv4_addr": { + "path_match": "ipfix.barracuda_conn_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.barracuda_conn_l4_port": { + "path_match": "ipfix.barracuda_conn_l4_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.barracuda_audit_counter": { + "path_match": "ipfix.barracuda_audit_counter", + "mapping": { + "type": "long" + } + } + }, - { - "ipfix.cace_local_ipv4_addr": { - "path_match": "ipfix.cace_local_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cace_remote_ipv4_addr": { - "path_match": "ipfix.cace_remote_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cace_local_ipv6_addr": { - "path_match": "ipfix.cace_local_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cace_remote_ipv6_addr": { - "path_match": "ipfix.cace_remote_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cace_local_l4_port": { - "path_match": "ipfix.cace_local_l4_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cace_remote_l4_port": { - "path_match": "ipfix.cace_remote_l4_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cace_local_ipv4_id": { - "path_match": "ipfix.cace_local_ipv4_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cace_local_icmp_id": { - "path_match": "ipfix.cace_local_icmp_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cace_local_proc_user_id": { - "path_match": "ipfix.cace_local_proc_user_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cace_local_proc_id": { - "path_match": "ipfix.cace_local_proc_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cace_local_proc_user": { - "path_match": "ipfix.cace_local_proc_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cace_local_proc_command": { - "path_match": "ipfix.cace_local_proc_command", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.cace_local_ipv4_addr": { + "path_match": "ipfix.cace_local_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cace_remote_ipv4_addr": { + "path_match": "ipfix.cace_remote_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cace_local_ipv6_addr": { + "path_match": "ipfix.cace_local_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cace_remote_ipv6_addr": { + "path_match": "ipfix.cace_remote_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cace_local_l4_port": { + "path_match": "ipfix.cace_local_l4_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cace_remote_l4_port": { + "path_match": "ipfix.cace_remote_l4_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cace_local_ipv4_id": { + "path_match": "ipfix.cace_local_ipv4_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cace_local_icmp_id": { + "path_match": "ipfix.cace_local_icmp_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cace_local_proc_user_id": { + "path_match": "ipfix.cace_local_proc_user_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cace_local_proc_id": { + "path_match": "ipfix.cace_local_proc_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cace_local_proc_user": { + "path_match": "ipfix.cace_local_proc_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cace_local_proc_command": { + "path_match": "ipfix.cace_local_proc_command", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.cert_obsolete_rev_bytes_total": { - "path_match": "ipfix.cert_obsolete_rev_bytes_total", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_obsolete_rev_packets_total": { - "path_match": "ipfix.cert_obsolete_rev_packets_total", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_init_tcp_flags": { - "path_match": "ipfix.cert_init_tcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_union_tcp_flags": { - "path_match": "ipfix.cert_union_tcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_obsolete_rev_init_tcp_flags": { - "path_match": "ipfix.cert_obsolete_rev_init_tcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_obsolete_rev_union_tcp_flags": { - "path_match": "ipfix.cert_obsolete_rev_union_tcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_payload": { - "path_match": "ipfix.cert_payload", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_obsolete_rev_payload": { - "path_match": "ipfix.cert_obsolete_rev_payload", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_obsolete_rev_tcp_seq_num": { - "path_match": "ipfix.cert_obsolete_rev_tcp_seq_num", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_flow_delta_millis": { - "path_match": "ipfix.cert_rev_flow_delta_millis", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_obsolete_rev_vlan_id": { - "path_match": "ipfix.cert_obsolete_rev_vlan_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_silk_flow_type": { - "path_match": "ipfix.cert_silk_flow_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_silk_flow_sensor": { - "path_match": "ipfix.cert_silk_flow_sensor", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_silk_tcp_state": { - "path_match": "ipfix.cert_silk_tcp_state", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_silk_app_label": { - "path_match": "ipfix.cert_silk_app_label", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_payload_entropy": { - "path_match": "ipfix.cert_payload_entropy", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_os": { - "path_match": "ipfix.cert_os", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_os_ver": { - "path_match": "ipfix.cert_os_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_first_packet_banner": { - "path_match": "ipfix.cert_first_packet_banner", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_second_packet_banner": { - "path_match": "ipfix.cert_second_packet_banner", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_flow_attr": { - "path_match": "ipfix.cert_flow_attr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_expired_frags": { - "path_match": "ipfix.cert_expired_frags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_assembled_frags": { - "path_match": "ipfix.cert_assembled_frags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mean_flow_rate": { - "path_match": "ipfix.cert_mean_flow_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mean_packet_rate": { - "path_match": "ipfix.cert_mean_packet_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_flow_table_flushes": { - "path_match": "ipfix.cert_flow_table_flushes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_flow_table_peak": { - "path_match": "ipfix.cert_flow_table_peak", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_yaf_flow_keyhash": { - "path_match": "ipfix.cert_yaf_flow_keyhash", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_os_fingerprint": { - "path_match": "ipfix.cert_os_fingerprint", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_server_string": { - "path_match": "ipfix.cert_http_server_string", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_user_agent": { - "path_match": "ipfix.cert_http_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_get": { - "path_match": "ipfix.cert_http_get", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_conn": { - "path_match": "ipfix.cert_http_conn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_ver": { - "path_match": "ipfix.cert_http_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_referrer": { - "path_match": "ipfix.cert_http_referrer", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_location": { - "path_match": "ipfix.cert_http_location", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_host": { - "path_match": "ipfix.cert_http_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_content_len": { - "path_match": "ipfix.cert_http_content_len", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_age": { - "path_match": "ipfix.cert_http_age", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_accept": { - "path_match": "ipfix.cert_http_accept", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_accept_lang": { - "path_match": "ipfix.cert_http_accept_lang", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_content_type": { - "path_match": "ipfix.cert_http_content_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_resp": { - "path_match": "ipfix.cert_http_resp", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_pop3_text_msg": { - "path_match": "ipfix.cert_pop3_text_msg", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_irc_text_msg": { - "path_match": "ipfix.cert_irc_text_msg", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_tftp_filename": { - "path_match": "ipfix.cert_tftp_filename", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_tftp_mode": { - "path_match": "ipfix.cert_tftp_mode", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_slp_ver": { - "path_match": "ipfix.cert_slp_ver", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_slp_msg_type": { - "path_match": "ipfix.cert_slp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_slp_string": { - "path_match": "ipfix.cert_slp_string", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ftp_return": { - "path_match": "ipfix.cert_ftp_return", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ftp_user": { - "path_match": "ipfix.cert_ftp_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ftp_pass": { - "path_match": "ipfix.cert_ftp_pass", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ftp_type": { - "path_match": "ipfix.cert_ftp_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ftp_resp_code": { - "path_match": "ipfix.cert_ftp_resp_code", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_imap_capability": { - "path_match": "ipfix.cert_imap_capability", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_imap_login": { - "path_match": "ipfix.cert_imap_login", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_imap_start_tls": { - "path_match": "ipfix.cert_imap_start_tls", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_imap_auth": { - "path_match": "ipfix.cert_imap_auth", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_imap_command": { - "path_match": "ipfix.cert_imap_command", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_imap_exists": { - "path_match": "ipfix.cert_imap_exists", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_imap_recent": { - "path_match": "ipfix.cert_imap_recent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_url": { - "path_match": "ipfix.cert_rtsp_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_ver": { - "path_match": "ipfix.cert_rtsp_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_return_code": { - "path_match": "ipfix.cert_rtsp_return_code", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_content_len": { - "path_match": "ipfix.cert_rtsp_content_len", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_command": { - "path_match": "ipfix.cert_rtsp_command", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_content_type": { - "path_match": "ipfix.cert_rtsp_content_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_transport": { - "path_match": "ipfix.cert_rtsp_transport", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_cseq": { - "path_match": "ipfix.cert_rtsp_cseq", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_location": { - "path_match": "ipfix.cert_rtsp_location", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_packets_rcv": { - "path_match": "ipfix.cert_rtsp_packets_rcv", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rtsp_user_agent": { - "path_match": "ipfix.cert_rtsp_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_jitter": { - "path_match": "ipfix.cert_rtsp_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_sip_invite": { - "path_match": "ipfix.cert_sip_invite", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_sip_command": { - "path_match": "ipfix.cert_sip_command", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_sip_via": { - "path_match": "ipfix.cert_sip_via", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_sip_max_forwards": { - "path_match": "ipfix.cert_sip_max_forwards", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_sip_address": { - "path_match": "ipfix.cert_sip_address", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_sip_content_len": { - "path_match": "ipfix.cert_sip_content_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_sip_user_agent": { - "path_match": "ipfix.cert_sip_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_hello": { - "path_match": "ipfix.cert_smtp_hello", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_from": { - "path_match": "ipfix.cert_smtp_from", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_to": { - "path_match": "ipfix.cert_smtp_to", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_content_type": { - "path_match": "ipfix.cert_smtp_content_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_subject": { - "path_match": "ipfix.cert_smtp_subject", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_filename": { - "path_match": "ipfix.cert_smtp_filename", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_content_disposition": { - "path_match": "ipfix.cert_smtp_content_disposition", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_resp": { - "path_match": "ipfix.cert_smtp_resp", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_enhanced": { - "path_match": "ipfix.cert_smtp_enhanced", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssh_ver": { - "path_match": "ipfix.cert_ssh_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_nntp_resp": { - "path_match": "ipfix.cert_nntp_resp", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_nntp_command": { - "path_match": "ipfix.cert_nntp_command", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_query_resp": { - "path_match": "ipfix.cert_dns_query_resp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_qrtype": { - "path_match": "ipfix.cert_dns_qrtype", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_authoritative": { - "path_match": "ipfix.cert_dns_authoritative", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_nxdomain": { - "path_match": "ipfix.cert_dns_nxdomain", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_rrsection": { - "path_match": "ipfix.cert_dns_rrsection", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_qname": { - "path_match": "ipfix.cert_dns_qname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_cname": { - "path_match": "ipfix.cert_dns_cname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_mxpref": { - "path_match": "ipfix.cert_dns_mxpref", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_mxexch": { - "path_match": "ipfix.cert_dns_mxexch", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_ns_dname": { - "path_match": "ipfix.cert_dns_ns_dname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_ptr_dname": { - "path_match": "ipfix.cert_dns_ptr_dname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cipher": { - "path_match": "ipfix.cert_ssl_cipher", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_client_ver": { - "path_match": "ipfix.cert_ssl_client_ver", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_server_cipher": { - "path_match": "ipfix.cert_ssl_server_cipher", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_compress_method": { - "path_match": "ipfix.cert_ssl_compress_method", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_cert_ver": { - "path_match": "ipfix.cert_ssl_cert_ver", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_cert_sig": { - "path_match": "ipfix.cert_ssl_cert_sig", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_issuer_country": { - "path_match": "ipfix.cert_ssl_cert_issuer_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_issuer_org": { - "path_match": "ipfix.cert_ssl_cert_issuer_org", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_issuer_org_unit": { - "path_match": "ipfix.cert_ssl_cert_issuer_org_unit", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_issuer_zipcode": { - "path_match": "ipfix.cert_ssl_cert_issuer_zipcode", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_issuer_state": { - "path_match": "ipfix.cert_ssl_cert_issuer_state", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_issuer_common": { - "path_match": "ipfix.cert_ssl_cert_issuer_common", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_issuer_locality": { - "path_match": "ipfix.cert_ssl_cert_issuer_locality", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_issuer_street": { - "path_match": "ipfix.cert_ssl_cert_issuer_street", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_ttl": { - "path_match": "ipfix.cert_dns_ttl", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_cert_sub_country": { - "path_match": "ipfix.cert_ssl_cert_sub_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_sub_org": { - "path_match": "ipfix.cert_ssl_cert_sub_org", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_sub_org_unit": { - "path_match": "ipfix.cert_ssl_cert_sub_org_unit", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_sub_zipcode": { - "path_match": "ipfix.cert_ssl_cert_sub_zipcode", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_sub_state": { - "path_match": "ipfix.cert_ssl_cert_sub_state", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_sub_common": { - "path_match": "ipfix.cert_ssl_cert_sub_common", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_sub_locality": { - "path_match": "ipfix.cert_ssl_cert_sub_locality", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_sub_street": { - "path_match": "ipfix.cert_ssl_cert_sub_street", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_txtdata": { - "path_match": "ipfix.cert_dns_txtdata", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_soa_serial": { - "path_match": "ipfix.cert_dns_soa_serial", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_soa_refresh": { - "path_match": "ipfix.cert_dns_soa_refresh", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_soa_retry": { - "path_match": "ipfix.cert_dns_soa_retry", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_soa_expire": { - "path_match": "ipfix.cert_dns_soa_expire", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_soa_min": { - "path_match": "ipfix.cert_dns_soa_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_soa_mname": { - "path_match": "ipfix.cert_dns_soa_mname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_soa_rname": { - "path_match": "ipfix.cert_dns_soa_rname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_srv_pri": { - "path_match": "ipfix.cert_dns_srv_pri", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_srv_weight": { - "path_match": "ipfix.cert_dns_srv_weight", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_srv_port": { - "path_match": "ipfix.cert_dns_srv_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_srv_target": { - "path_match": "ipfix.cert_dns_srv_target", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_cookie": { - "path_match": "ipfix.cert_http_cookie", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_set_cookie": { - "path_match": "ipfix.cert_http_set_cookie", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_size": { - "path_match": "ipfix.cert_smtp_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mysql_user": { - "path_match": "ipfix.cert_mysql_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_mysql_command_code": { - "path_match": "ipfix.cert_mysql_command_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mysql_command_text": { - "path_match": "ipfix.cert_mysql_command_text", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_id": { - "path_match": "ipfix.cert_dns_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_algorithm": { - "path_match": "ipfix.cert_dns_algorithm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_key_tag": { - "path_match": "ipfix.cert_dns_key_tag", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_signer": { - "path_match": "ipfix.cert_dns_signer", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_sig": { - "path_match": "ipfix.cert_dns_sig", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_digest": { - "path_match": "ipfix.cert_dns_digest", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_public_key": { - "path_match": "ipfix.cert_dns_public_key", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_salt": { - "path_match": "ipfix.cert_dns_salt", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_hash_data": { - "path_match": "ipfix.cert_dns_hash_data", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_iterations": { - "path_match": "ipfix.cert_dns_iterations", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_sig_expire": { - "path_match": "ipfix.cert_dns_sig_expire", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_sig_inception": { - "path_match": "ipfix.cert_dns_sig_inception", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_digest_type": { - "path_match": "ipfix.cert_dns_digest_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_labels": { - "path_match": "ipfix.cert_dns_labels", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_type_covered": { - "path_match": "ipfix.cert_dns_type_covered", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_flags": { - "path_match": "ipfix.cert_dns_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dhcp_fingerprint": { - "path_match": "ipfix.cert_dhcp_fingerprint", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dhcp_vendor_code": { - "path_match": "ipfix.cert_dhcp_vendor_code", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_serial_num": { - "path_match": "ipfix.cert_ssl_cert_serial_num", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_object_type": { - "path_match": "ipfix.cert_ssl_object_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_object_value": { - "path_match": "ipfix.cert_ssl_object_value", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_valid_not_before": { - "path_match": "ipfix.cert_ssl_cert_valid_not_before", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_valid_not_after": { - "path_match": "ipfix.cert_ssl_cert_valid_not_after", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_public_key_alg": { - "path_match": "ipfix.cert_ssl_public_key_alg", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_public_key_len": { - "path_match": "ipfix.cert_ssl_public_key_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_smtp_date": { - "path_match": "ipfix.cert_smtp_date", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_auth": { - "path_match": "ipfix.cert_http_auth", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_via": { - "path_match": "ipfix.cert_http_via", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_x_forwarded_for": { - "path_match": "ipfix.cert_http_x_forwarded_for", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_expires": { - "path_match": "ipfix.cert_http_expires", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_refresh": { - "path_match": "ipfix.cert_http_refresh", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_imei": { - "path_match": "ipfix.cert_http_imei", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_imsi": { - "path_match": "ipfix.cert_http_imsi", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_msisdn": { - "path_match": "ipfix.cert_http_msisdn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_subscriber": { - "path_match": "ipfix.cert_http_subscriber", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_accept_charset": { - "path_match": "ipfix.cert_http_accept_charset", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_accept_encoding": { - "path_match": "ipfix.cert_http_accept_encoding", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_allow": { - "path_match": "ipfix.cert_http_allow", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_date": { - "path_match": "ipfix.cert_http_date", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_expect": { - "path_match": "ipfix.cert_http_expect", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_from": { - "path_match": "ipfix.cert_http_from", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_proxy_auth": { - "path_match": "ipfix.cert_http_proxy_auth", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_upgrade": { - "path_match": "ipfix.cert_http_upgrade", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_warning": { - "path_match": "ipfix.cert_http_warning", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_dnt": { - "path_match": "ipfix.cert_http_dnt", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_x_forwarded_proto": { - "path_match": "ipfix.cert_http_x_forwarded_proto", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_x_forwarded_host": { - "path_match": "ipfix.cert_http_x_forwarded_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_x_forwarded_server": { - "path_match": "ipfix.cert_http_x_forwarded_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_x_device_id": { - "path_match": "ipfix.cert_http_x_device_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_x_profile": { - "path_match": "ipfix.cert_http_x_profile", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_last_modified": { - "path_match": "ipfix.cert_http_last_modified", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_content_encoding": { - "path_match": "ipfix.cert_http_content_encoding", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_content_language": { - "path_match": "ipfix.cert_http_content_language", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_content_location": { - "path_match": "ipfix.cert_http_content_location", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_xua_compatible": { - "path_match": "ipfix.cert_http_xua_compatible", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dnp3_src_addr": { - "path_match": "ipfix.cert_dnp3_src_addr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dnp3_dst_addr": { - "path_match": "ipfix.cert_dnp3_dst_addr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dnp3_func": { - "path_match": "ipfix.cert_dnp3_func", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dnp3_object_data": { - "path_match": "ipfix.cert_dnp3_object_data", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_modbus_data": { - "path_match": "ipfix.cert_modbus_data", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ethernet_ip_data": { - "path_match": "ipfix.cert_ethernet_ip_data", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtp_payload_type": { - "path_match": "ipfix.cert_rtp_payload_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_record_ver": { - "path_match": "ipfix.cert_ssl_record_ver", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mptcp_init_data_seq_num": { - "path_match": "ipfix.cert_mptcp_init_data_seq_num", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mptcp_rcvr_token": { - "path_match": "ipfix.cert_mptcp_rcvr_token", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mptcp_max_seg_size": { - "path_match": "ipfix.cert_mptcp_max_seg_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mptcp_addr_id": { - "path_match": "ipfix.cert_mptcp_addr_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mptcp_flags": { - "path_match": "ipfix.cert_mptcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_server": { - "path_match": "ipfix.cert_ssl_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_hash": { - "path_match": "ipfix.cert_ssl_cert_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert": { - "path_match": "ipfix.cert_ssl_cert", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dhcp_option": { - "path_match": "ipfix.cert_dhcp_option", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_cert_sha1": { - "path_match": "ipfix.cert_ssl_cert_sha1", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_md5": { - "path_match": "ipfix.cert_ssl_cert_md5", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ndpi_l7_proto": { - "path_match": "ipfix.cert_ndpi_l7_proto", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ndpi_l7_sub_proto": { - "path_match": "ipfix.cert_ndpi_l7_sub_proto", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rr_ipv4": { - "path_match": "ipfix.cert_rr_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cert_rr_ipv6": { - "path_match": "ipfix.cert_rr_ipv6", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cert_dns_key_proto_id": { - "path_match": "ipfix.cert_dns_key_proto_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_a_record": { - "path_match": "ipfix.cert_dns_a_record", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_aaaa_record": { - "path_match": "ipfix.cert_dns_aaaa_record", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_small_packets": { - "path_match": "ipfix.cert_small_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_nonempty_packets": { - "path_match": "ipfix.cert_nonempty_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_data_bytes": { - "path_match": "ipfix.cert_data_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_avg_interarrival_time": { - "path_match": "ipfix.cert_avg_interarrival_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_std_dev_interarrival_time": { - "path_match": "ipfix.cert_std_dev_interarrival_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_first_nonempty_packet_size": { - "path_match": "ipfix.cert_first_nonempty_packet_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_max_packet_size": { - "path_match": "ipfix.cert_max_packet_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_first_eight_nonempty_packet_dir": { - "path_match": "ipfix.cert_first_eight_nonempty_packet_dir", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_std_dev_payload_len": { - "path_match": "ipfix.cert_std_dev_payload_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_tcp_urgent_count": { - "path_match": "ipfix.cert_tcp_urgent_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_large_packets": { - "path_match": "ipfix.cert_large_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_tombstone_id": { - "path_match": "ipfix.cert_tombstone_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_exporter_config_id": { - "path_match": "ipfix.cert_exporter_config_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_exporter_unique_id": { - "path_match": "ipfix.cert_exporter_unique_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_rname": { - "path_match": "ipfix.cert_dns_rname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_hits": { - "path_match": "ipfix.cert_dns_hits", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_observed_data_total": { - "path_match": "ipfix.cert_observed_data_total", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_observed_data": { - "path_match": "ipfix.cert_observed_data", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_template": { - "path_match": "ipfix.cert_template", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_template_descr": { - "path_match": "ipfix.cert_template_descr", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_init_tcp_flags": { - "path_match": "ipfix.cert_rev_init_tcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_union_tcp_flags": { - "path_match": "ipfix.cert_rev_union_tcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_payload": { - "path_match": "ipfix.cert_rev_payload", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_payload_entropy": { - "path_match": "ipfix.cert_rev_payload_entropy", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_os": { - "path_match": "ipfix.cert_rev_os", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_os_ver": { - "path_match": "ipfix.cert_rev_os_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_first_packet_banner": { - "path_match": "ipfix.cert_rev_first_packet_banner", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_second_packet_banner": { - "path_match": "ipfix.cert_rev_second_packet_banner", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_flow_attr": { - "path_match": "ipfix.cert_rev_flow_attr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_os_fingerprint": { - "path_match": "ipfix.cert_rev_os_fingerprint", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_dhcp_fingerprint": { - "path_match": "ipfix.cert_rev_dhcp_fingerprint", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_dhcp_vendor_code": { - "path_match": "ipfix.cert_rev_dhcp_vendor_code", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_rtp_payload_type": { - "path_match": "ipfix.cert_rev_rtp_payload_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_small_packets": { - "path_match": "ipfix.cert_rev_small_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_nonempty_packets": { - "path_match": "ipfix.cert_rev_nonempty_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_data_bytes": { - "path_match": "ipfix.cert_rev_data_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_avg_interarrival_time": { - "path_match": "ipfix.cert_rev_avg_interarrival_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_std_dev_interarrival_time": { - "path_match": "ipfix.cert_rev_std_dev_interarrival_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_first_nonempty_packet_size": { - "path_match": "ipfix.cert_rev_first_nonempty_packet_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_max_packet_size": { - "path_match": "ipfix.cert_rev_max_packet_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_first_eight_nonempty_packet_dir": { - "path_match": "ipfix.cert_rev_first_eight_nonempty_packet_dir", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_std_dev_payload_len": { - "path_match": "ipfix.cert_rev_std_dev_payload_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_tcp_urgent_count": { - "path_match": "ipfix.cert_rev_tcp_urgent_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_large_packets": { - "path_match": "ipfix.cert_rev_large_packets", - "mapping": { - "type": "long" - } - } - }, + { + "ipfix.cert_obsolete_rev_bytes_total": { + "path_match": "ipfix.cert_obsolete_rev_bytes_total", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_obsolete_rev_packets_total": { + "path_match": "ipfix.cert_obsolete_rev_packets_total", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_init_tcp_flags": { + "path_match": "ipfix.cert_init_tcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_union_tcp_flags": { + "path_match": "ipfix.cert_union_tcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_obsolete_rev_init_tcp_flags": { + "path_match": "ipfix.cert_obsolete_rev_init_tcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_obsolete_rev_union_tcp_flags": { + "path_match": "ipfix.cert_obsolete_rev_union_tcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_payload": { + "path_match": "ipfix.cert_payload", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_obsolete_rev_payload": { + "path_match": "ipfix.cert_obsolete_rev_payload", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_obsolete_rev_tcp_seq_num": { + "path_match": "ipfix.cert_obsolete_rev_tcp_seq_num", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_flow_delta_millis": { + "path_match": "ipfix.cert_rev_flow_delta_millis", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_obsolete_rev_vlan_id": { + "path_match": "ipfix.cert_obsolete_rev_vlan_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_silk_flow_type": { + "path_match": "ipfix.cert_silk_flow_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_silk_flow_sensor": { + "path_match": "ipfix.cert_silk_flow_sensor", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_silk_tcp_state": { + "path_match": "ipfix.cert_silk_tcp_state", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_silk_app_label": { + "path_match": "ipfix.cert_silk_app_label", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_payload_entropy": { + "path_match": "ipfix.cert_payload_entropy", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_os": { + "path_match": "ipfix.cert_os", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_os_ver": { + "path_match": "ipfix.cert_os_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_first_packet_banner": { + "path_match": "ipfix.cert_first_packet_banner", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_second_packet_banner": { + "path_match": "ipfix.cert_second_packet_banner", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_flow_attr": { + "path_match": "ipfix.cert_flow_attr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_expired_frags": { + "path_match": "ipfix.cert_expired_frags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_assembled_frags": { + "path_match": "ipfix.cert_assembled_frags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mean_flow_rate": { + "path_match": "ipfix.cert_mean_flow_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mean_packet_rate": { + "path_match": "ipfix.cert_mean_packet_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_flow_table_flushes": { + "path_match": "ipfix.cert_flow_table_flushes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_flow_table_peak": { + "path_match": "ipfix.cert_flow_table_peak", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_yaf_flow_keyhash": { + "path_match": "ipfix.cert_yaf_flow_keyhash", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_os_fingerprint": { + "path_match": "ipfix.cert_os_fingerprint", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_server_string": { + "path_match": "ipfix.cert_http_server_string", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_user_agent": { + "path_match": "ipfix.cert_http_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_get": { + "path_match": "ipfix.cert_http_get", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_conn": { + "path_match": "ipfix.cert_http_conn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_ver": { + "path_match": "ipfix.cert_http_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_referrer": { + "path_match": "ipfix.cert_http_referrer", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_location": { + "path_match": "ipfix.cert_http_location", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_host": { + "path_match": "ipfix.cert_http_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_content_len": { + "path_match": "ipfix.cert_http_content_len", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_age": { + "path_match": "ipfix.cert_http_age", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_accept": { + "path_match": "ipfix.cert_http_accept", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_accept_lang": { + "path_match": "ipfix.cert_http_accept_lang", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_content_type": { + "path_match": "ipfix.cert_http_content_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_resp": { + "path_match": "ipfix.cert_http_resp", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_pop3_text_msg": { + "path_match": "ipfix.cert_pop3_text_msg", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_irc_text_msg": { + "path_match": "ipfix.cert_irc_text_msg", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_tftp_filename": { + "path_match": "ipfix.cert_tftp_filename", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_tftp_mode": { + "path_match": "ipfix.cert_tftp_mode", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_slp_ver": { + "path_match": "ipfix.cert_slp_ver", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_slp_msg_type": { + "path_match": "ipfix.cert_slp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_slp_string": { + "path_match": "ipfix.cert_slp_string", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ftp_return": { + "path_match": "ipfix.cert_ftp_return", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ftp_user": { + "path_match": "ipfix.cert_ftp_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ftp_pass": { + "path_match": "ipfix.cert_ftp_pass", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ftp_type": { + "path_match": "ipfix.cert_ftp_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ftp_resp_code": { + "path_match": "ipfix.cert_ftp_resp_code", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_imap_capability": { + "path_match": "ipfix.cert_imap_capability", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_imap_login": { + "path_match": "ipfix.cert_imap_login", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_imap_start_tls": { + "path_match": "ipfix.cert_imap_start_tls", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_imap_auth": { + "path_match": "ipfix.cert_imap_auth", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_imap_command": { + "path_match": "ipfix.cert_imap_command", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_imap_exists": { + "path_match": "ipfix.cert_imap_exists", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_imap_recent": { + "path_match": "ipfix.cert_imap_recent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_url": { + "path_match": "ipfix.cert_rtsp_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_ver": { + "path_match": "ipfix.cert_rtsp_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_return_code": { + "path_match": "ipfix.cert_rtsp_return_code", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_content_len": { + "path_match": "ipfix.cert_rtsp_content_len", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_command": { + "path_match": "ipfix.cert_rtsp_command", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_content_type": { + "path_match": "ipfix.cert_rtsp_content_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_transport": { + "path_match": "ipfix.cert_rtsp_transport", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_cseq": { + "path_match": "ipfix.cert_rtsp_cseq", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_location": { + "path_match": "ipfix.cert_rtsp_location", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_packets_rcv": { + "path_match": "ipfix.cert_rtsp_packets_rcv", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rtsp_user_agent": { + "path_match": "ipfix.cert_rtsp_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_jitter": { + "path_match": "ipfix.cert_rtsp_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_sip_invite": { + "path_match": "ipfix.cert_sip_invite", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_sip_command": { + "path_match": "ipfix.cert_sip_command", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_sip_via": { + "path_match": "ipfix.cert_sip_via", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_sip_max_forwards": { + "path_match": "ipfix.cert_sip_max_forwards", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_sip_address": { + "path_match": "ipfix.cert_sip_address", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_sip_content_len": { + "path_match": "ipfix.cert_sip_content_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_sip_user_agent": { + "path_match": "ipfix.cert_sip_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_hello": { + "path_match": "ipfix.cert_smtp_hello", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_from": { + "path_match": "ipfix.cert_smtp_from", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_to": { + "path_match": "ipfix.cert_smtp_to", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_content_type": { + "path_match": "ipfix.cert_smtp_content_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_subject": { + "path_match": "ipfix.cert_smtp_subject", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_filename": { + "path_match": "ipfix.cert_smtp_filename", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_content_disposition": { + "path_match": "ipfix.cert_smtp_content_disposition", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_resp": { + "path_match": "ipfix.cert_smtp_resp", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_enhanced": { + "path_match": "ipfix.cert_smtp_enhanced", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssh_ver": { + "path_match": "ipfix.cert_ssh_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_nntp_resp": { + "path_match": "ipfix.cert_nntp_resp", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_nntp_command": { + "path_match": "ipfix.cert_nntp_command", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_query_resp": { + "path_match": "ipfix.cert_dns_query_resp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_qrtype": { + "path_match": "ipfix.cert_dns_qrtype", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_authoritative": { + "path_match": "ipfix.cert_dns_authoritative", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_nxdomain": { + "path_match": "ipfix.cert_dns_nxdomain", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_rrsection": { + "path_match": "ipfix.cert_dns_rrsection", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_qname": { + "path_match": "ipfix.cert_dns_qname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_cname": { + "path_match": "ipfix.cert_dns_cname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_mxpref": { + "path_match": "ipfix.cert_dns_mxpref", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_mxexch": { + "path_match": "ipfix.cert_dns_mxexch", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_ns_dname": { + "path_match": "ipfix.cert_dns_ns_dname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_ptr_dname": { + "path_match": "ipfix.cert_dns_ptr_dname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cipher": { + "path_match": "ipfix.cert_ssl_cipher", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_client_ver": { + "path_match": "ipfix.cert_ssl_client_ver", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_server_cipher": { + "path_match": "ipfix.cert_ssl_server_cipher", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_compress_method": { + "path_match": "ipfix.cert_ssl_compress_method", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_cert_ver": { + "path_match": "ipfix.cert_ssl_cert_ver", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_cert_sig": { + "path_match": "ipfix.cert_ssl_cert_sig", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_issuer_country": { + "path_match": "ipfix.cert_ssl_cert_issuer_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_issuer_org": { + "path_match": "ipfix.cert_ssl_cert_issuer_org", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_issuer_org_unit": { + "path_match": "ipfix.cert_ssl_cert_issuer_org_unit", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_issuer_zipcode": { + "path_match": "ipfix.cert_ssl_cert_issuer_zipcode", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_issuer_state": { + "path_match": "ipfix.cert_ssl_cert_issuer_state", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_issuer_common": { + "path_match": "ipfix.cert_ssl_cert_issuer_common", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_issuer_locality": { + "path_match": "ipfix.cert_ssl_cert_issuer_locality", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_issuer_street": { + "path_match": "ipfix.cert_ssl_cert_issuer_street", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_ttl": { + "path_match": "ipfix.cert_dns_ttl", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_cert_sub_country": { + "path_match": "ipfix.cert_ssl_cert_sub_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_sub_org": { + "path_match": "ipfix.cert_ssl_cert_sub_org", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_sub_org_unit": { + "path_match": "ipfix.cert_ssl_cert_sub_org_unit", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_sub_zipcode": { + "path_match": "ipfix.cert_ssl_cert_sub_zipcode", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_sub_state": { + "path_match": "ipfix.cert_ssl_cert_sub_state", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_sub_common": { + "path_match": "ipfix.cert_ssl_cert_sub_common", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_sub_locality": { + "path_match": "ipfix.cert_ssl_cert_sub_locality", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_sub_street": { + "path_match": "ipfix.cert_ssl_cert_sub_street", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_txtdata": { + "path_match": "ipfix.cert_dns_txtdata", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_soa_serial": { + "path_match": "ipfix.cert_dns_soa_serial", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_soa_refresh": { + "path_match": "ipfix.cert_dns_soa_refresh", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_soa_retry": { + "path_match": "ipfix.cert_dns_soa_retry", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_soa_expire": { + "path_match": "ipfix.cert_dns_soa_expire", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_soa_min": { + "path_match": "ipfix.cert_dns_soa_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_soa_mname": { + "path_match": "ipfix.cert_dns_soa_mname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_soa_rname": { + "path_match": "ipfix.cert_dns_soa_rname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_srv_pri": { + "path_match": "ipfix.cert_dns_srv_pri", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_srv_weight": { + "path_match": "ipfix.cert_dns_srv_weight", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_srv_port": { + "path_match": "ipfix.cert_dns_srv_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_srv_target": { + "path_match": "ipfix.cert_dns_srv_target", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_cookie": { + "path_match": "ipfix.cert_http_cookie", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_set_cookie": { + "path_match": "ipfix.cert_http_set_cookie", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_size": { + "path_match": "ipfix.cert_smtp_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mysql_user": { + "path_match": "ipfix.cert_mysql_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_mysql_command_code": { + "path_match": "ipfix.cert_mysql_command_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mysql_command_text": { + "path_match": "ipfix.cert_mysql_command_text", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_id": { + "path_match": "ipfix.cert_dns_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_algorithm": { + "path_match": "ipfix.cert_dns_algorithm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_key_tag": { + "path_match": "ipfix.cert_dns_key_tag", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_signer": { + "path_match": "ipfix.cert_dns_signer", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_sig": { + "path_match": "ipfix.cert_dns_sig", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_digest": { + "path_match": "ipfix.cert_dns_digest", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_public_key": { + "path_match": "ipfix.cert_dns_public_key", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_salt": { + "path_match": "ipfix.cert_dns_salt", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_hash_data": { + "path_match": "ipfix.cert_dns_hash_data", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_iterations": { + "path_match": "ipfix.cert_dns_iterations", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_sig_expire": { + "path_match": "ipfix.cert_dns_sig_expire", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_sig_inception": { + "path_match": "ipfix.cert_dns_sig_inception", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_digest_type": { + "path_match": "ipfix.cert_dns_digest_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_labels": { + "path_match": "ipfix.cert_dns_labels", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_type_covered": { + "path_match": "ipfix.cert_dns_type_covered", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_flags": { + "path_match": "ipfix.cert_dns_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dhcp_fingerprint": { + "path_match": "ipfix.cert_dhcp_fingerprint", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dhcp_vendor_code": { + "path_match": "ipfix.cert_dhcp_vendor_code", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_serial_num": { + "path_match": "ipfix.cert_ssl_cert_serial_num", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_object_type": { + "path_match": "ipfix.cert_ssl_object_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_object_value": { + "path_match": "ipfix.cert_ssl_object_value", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_valid_not_before": { + "path_match": "ipfix.cert_ssl_cert_valid_not_before", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_valid_not_after": { + "path_match": "ipfix.cert_ssl_cert_valid_not_after", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_public_key_alg": { + "path_match": "ipfix.cert_ssl_public_key_alg", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_public_key_len": { + "path_match": "ipfix.cert_ssl_public_key_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_smtp_date": { + "path_match": "ipfix.cert_smtp_date", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_auth": { + "path_match": "ipfix.cert_http_auth", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_via": { + "path_match": "ipfix.cert_http_via", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_x_forwarded_for": { + "path_match": "ipfix.cert_http_x_forwarded_for", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_expires": { + "path_match": "ipfix.cert_http_expires", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_refresh": { + "path_match": "ipfix.cert_http_refresh", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_imei": { + "path_match": "ipfix.cert_http_imei", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_imsi": { + "path_match": "ipfix.cert_http_imsi", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_msisdn": { + "path_match": "ipfix.cert_http_msisdn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_subscriber": { + "path_match": "ipfix.cert_http_subscriber", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_accept_charset": { + "path_match": "ipfix.cert_http_accept_charset", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_accept_encoding": { + "path_match": "ipfix.cert_http_accept_encoding", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_allow": { + "path_match": "ipfix.cert_http_allow", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_date": { + "path_match": "ipfix.cert_http_date", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_expect": { + "path_match": "ipfix.cert_http_expect", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_from": { + "path_match": "ipfix.cert_http_from", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_proxy_auth": { + "path_match": "ipfix.cert_http_proxy_auth", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_upgrade": { + "path_match": "ipfix.cert_http_upgrade", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_warning": { + "path_match": "ipfix.cert_http_warning", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_dnt": { + "path_match": "ipfix.cert_http_dnt", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_x_forwarded_proto": { + "path_match": "ipfix.cert_http_x_forwarded_proto", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_x_forwarded_host": { + "path_match": "ipfix.cert_http_x_forwarded_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_x_forwarded_server": { + "path_match": "ipfix.cert_http_x_forwarded_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_x_device_id": { + "path_match": "ipfix.cert_http_x_device_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_x_profile": { + "path_match": "ipfix.cert_http_x_profile", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_last_modified": { + "path_match": "ipfix.cert_http_last_modified", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_content_encoding": { + "path_match": "ipfix.cert_http_content_encoding", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_content_language": { + "path_match": "ipfix.cert_http_content_language", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_content_location": { + "path_match": "ipfix.cert_http_content_location", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_xua_compatible": { + "path_match": "ipfix.cert_http_xua_compatible", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dnp3_src_addr": { + "path_match": "ipfix.cert_dnp3_src_addr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dnp3_dst_addr": { + "path_match": "ipfix.cert_dnp3_dst_addr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dnp3_func": { + "path_match": "ipfix.cert_dnp3_func", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dnp3_object_data": { + "path_match": "ipfix.cert_dnp3_object_data", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_modbus_data": { + "path_match": "ipfix.cert_modbus_data", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ethernet_ip_data": { + "path_match": "ipfix.cert_ethernet_ip_data", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtp_payload_type": { + "path_match": "ipfix.cert_rtp_payload_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_record_ver": { + "path_match": "ipfix.cert_ssl_record_ver", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mptcp_init_data_seq_num": { + "path_match": "ipfix.cert_mptcp_init_data_seq_num", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mptcp_rcvr_token": { + "path_match": "ipfix.cert_mptcp_rcvr_token", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mptcp_max_seg_size": { + "path_match": "ipfix.cert_mptcp_max_seg_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mptcp_addr_id": { + "path_match": "ipfix.cert_mptcp_addr_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mptcp_flags": { + "path_match": "ipfix.cert_mptcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_server": { + "path_match": "ipfix.cert_ssl_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_hash": { + "path_match": "ipfix.cert_ssl_cert_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert": { + "path_match": "ipfix.cert_ssl_cert", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dhcp_option": { + "path_match": "ipfix.cert_dhcp_option", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_cert_sha1": { + "path_match": "ipfix.cert_ssl_cert_sha1", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_md5": { + "path_match": "ipfix.cert_ssl_cert_md5", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ndpi_l7_proto": { + "path_match": "ipfix.cert_ndpi_l7_proto", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ndpi_l7_sub_proto": { + "path_match": "ipfix.cert_ndpi_l7_sub_proto", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rr_ipv4": { + "path_match": "ipfix.cert_rr_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cert_rr_ipv6": { + "path_match": "ipfix.cert_rr_ipv6", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cert_dns_key_proto_id": { + "path_match": "ipfix.cert_dns_key_proto_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_a_record": { + "path_match": "ipfix.cert_dns_a_record", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_aaaa_record": { + "path_match": "ipfix.cert_dns_aaaa_record", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_small_packets": { + "path_match": "ipfix.cert_small_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_nonempty_packets": { + "path_match": "ipfix.cert_nonempty_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_data_bytes": { + "path_match": "ipfix.cert_data_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_avg_interarrival_time": { + "path_match": "ipfix.cert_avg_interarrival_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_std_dev_interarrival_time": { + "path_match": "ipfix.cert_std_dev_interarrival_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_first_nonempty_packet_size": { + "path_match": "ipfix.cert_first_nonempty_packet_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_max_packet_size": { + "path_match": "ipfix.cert_max_packet_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_first_eight_nonempty_packet_dir": { + "path_match": "ipfix.cert_first_eight_nonempty_packet_dir", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_std_dev_payload_len": { + "path_match": "ipfix.cert_std_dev_payload_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_tcp_urgent_count": { + "path_match": "ipfix.cert_tcp_urgent_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_large_packets": { + "path_match": "ipfix.cert_large_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_tombstone_id": { + "path_match": "ipfix.cert_tombstone_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_exporter_config_id": { + "path_match": "ipfix.cert_exporter_config_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_exporter_unique_id": { + "path_match": "ipfix.cert_exporter_unique_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_rname": { + "path_match": "ipfix.cert_dns_rname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_hits": { + "path_match": "ipfix.cert_dns_hits", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_observed_data_total": { + "path_match": "ipfix.cert_observed_data_total", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_observed_data": { + "path_match": "ipfix.cert_observed_data", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_template": { + "path_match": "ipfix.cert_template", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_template_descr": { + "path_match": "ipfix.cert_template_descr", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_init_tcp_flags": { + "path_match": "ipfix.cert_rev_init_tcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_union_tcp_flags": { + "path_match": "ipfix.cert_rev_union_tcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_payload": { + "path_match": "ipfix.cert_rev_payload", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_payload_entropy": { + "path_match": "ipfix.cert_rev_payload_entropy", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_os": { + "path_match": "ipfix.cert_rev_os", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_os_ver": { + "path_match": "ipfix.cert_rev_os_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_first_packet_banner": { + "path_match": "ipfix.cert_rev_first_packet_banner", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_second_packet_banner": { + "path_match": "ipfix.cert_rev_second_packet_banner", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_flow_attr": { + "path_match": "ipfix.cert_rev_flow_attr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_os_fingerprint": { + "path_match": "ipfix.cert_rev_os_fingerprint", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_dhcp_fingerprint": { + "path_match": "ipfix.cert_rev_dhcp_fingerprint", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_dhcp_vendor_code": { + "path_match": "ipfix.cert_rev_dhcp_vendor_code", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_rtp_payload_type": { + "path_match": "ipfix.cert_rev_rtp_payload_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_small_packets": { + "path_match": "ipfix.cert_rev_small_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_nonempty_packets": { + "path_match": "ipfix.cert_rev_nonempty_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_data_bytes": { + "path_match": "ipfix.cert_rev_data_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_avg_interarrival_time": { + "path_match": "ipfix.cert_rev_avg_interarrival_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_std_dev_interarrival_time": { + "path_match": "ipfix.cert_rev_std_dev_interarrival_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_first_nonempty_packet_size": { + "path_match": "ipfix.cert_rev_first_nonempty_packet_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_max_packet_size": { + "path_match": "ipfix.cert_rev_max_packet_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_first_eight_nonempty_packet_dir": { + "path_match": "ipfix.cert_rev_first_eight_nonempty_packet_dir", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_std_dev_payload_len": { + "path_match": "ipfix.cert_rev_std_dev_payload_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_tcp_urgent_count": { + "path_match": "ipfix.cert_rev_tcp_urgent_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_large_packets": { + "path_match": "ipfix.cert_rev_large_packets", + "mapping": { + "type": "long" + } + } + }, - { - "ipfix.cisco_avc_p2p_tech": { - "path_match": "ipfix.cisco_avc_p2p_tech", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_tunnel_tech": { - "path_match": "ipfix.cisco_avc_tunnel_tech", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_encrypt_tech": { - "path_match": "ipfix.cisco_avc_encrypt_tech", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_ipt_dialing_phone": { - "path_match": "ipfix.cisco_ipt_dialing_phone", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_ipt_dialing_user": { - "path_match": "ipfix.cisco_ipt_dialing_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_ipt_dialed_phone": { - "path_match": "ipfix.cisco_ipt_dialed_phone", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_ipt_dialed_user": { - "path_match": "ipfix.cisco_ipt_dialed_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_ipt_call_duration": { - "path_match": "ipfix.cisco_ipt_call_duration", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_ipt_call_end_reason": { - "path_match": "ipfix.cisco_ipt_call_end_reason", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_ipt_calls_dialed": { - "path_match": "ipfix.cisco_ipt_calls_dialed", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_ipt_calls_connected": { - "path_match": "ipfix.cisco_ipt_calls_connected", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_ipt_calls_failed": { - "path_match": "ipfix.cisco_ipt_calls_failed", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_nexus_fastpath_src_addr": { - "path_match": "ipfix.cisco_nexus_fastpath_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_nexus_fastpath_src_port": { - "path_match": "ipfix.cisco_nexus_fastpath_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_nexus_fastpath_dst_addr": { - "path_match": "ipfix.cisco_nexus_fastpath_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_nexus_fastpath_dst_port": { - "path_match": "ipfix.cisco_nexus_fastpath_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_endpoint_process_user": { - "path_match": "ipfix.cisco_endpoint_process_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_endpoint_process_name": { - "path_match": "ipfix.cisco_endpoint_process_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_endpoint_process_hash": { - "path_match": "ipfix.cisco_endpoint_process_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_endpoint_process_parent_user": { - "path_match": "ipfix.cisco_endpoint_process_parent_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_endpoint_process_parent_name": { - "path_match": "ipfix.cisco_endpoint_process_parent_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_endpoint_process_parent_hash": { - "path_match": "ipfix.cisco_endpoint_process_parent_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_pfr_policy_id": { - "path_match": "ipfix.cisco_pfr_policy_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_map_name": { - "path_match": "ipfix.cisco_pfr_map_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_pfr_reason": { - "path_match": "ipfix.cisco_pfr_reason", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_ingress_acl_id": { - "path_match": "ipfix.cisco_fw_ingress_acl_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_egress_acl_id": { - "path_match": "ipfix.cisco_fw_egress_acl_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_ext_event": { - "path_match": "ipfix.cisco_fw_ext_event", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_event_level": { - "path_match": "ipfix.cisco_fw_event_level", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_event_level_id": { - "path_match": "ipfix.cisco_fw_event_level_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_config_value": { - "path_match": "ipfix.cisco_fw_config_value", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_erm_code": { - "path_match": "ipfix.cisco_fw_erm_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_erm_descr": { - "path_match": "ipfix.cisco_fw_erm_descr", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_trustsec_src_id": { - "path_match": "ipfix.cisco_trustsec_src_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_trustsec_dst_id": { - "path_match": "ipfix.cisco_trustsec_dst_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_trustsec_src_name": { - "path_match": "ipfix.cisco_trustsec_src_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_trustsec_dst_name": { - "path_match": "ipfix.cisco_trustsec_dst_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_trustsec_switch_derived_sgt": { - "path_match": "ipfix.cisco_trustsec_switch_derived_sgt", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_ext_event": { - "path_match": "ipfix.cisco_fw_ext_event", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_blackout_secs": { - "path_match": "ipfix.cisco_fw_blackout_secs", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_half_open_sessions_rate_1min_max": { - "path_match": "ipfix.cisco_fw_half_open_sessions_rate_1min_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_half_open_sessions_rate_1min": { - "path_match": "ipfix.cisco_fw_half_open_sessions_rate_1min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_zonepair_id": { - "path_match": "ipfix.cisco_fw_zonepair_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_sessions_max": { - "path_match": "ipfix.cisco_fw_sessions_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_zonepair": { - "path_match": "ipfix.cisco_fw_zonepair", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_ext_event_descr": { - "path_match": "ipfix.cisco_fw_ext_event_descr", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_drop_pass_summary_packets": { - "path_match": "ipfix.cisco_fw_drop_pass_summary_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_half_open_sessions": { - "path_match": "ipfix.cisco_fw_half_open_sessions", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_dre_input": { - "path_match": "ipfix.cisco_waas_dre_input", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_dre_output": { - "path_match": "ipfix.cisco_waas_dre_output", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_lz_input": { - "path_match": "ipfix.cisco_waas_lz_input", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_lz_output": { - "path_match": "ipfix.cisco_waas_lz_output", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_conn_mode": { - "path_match": "ipfix.cisco_waas_conn_mode", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_input_bytes": { - "path_match": "ipfix.cisco_waas_input_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_output_bytes": { - "path_match": "ipfix.cisco_waas_output_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_short_term_packets_drop": { - "path_match": "ipfix.cisco_avc_transport_short_term_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_long_term_packets_drop": { - "path_match": "ipfix.cisco_avc_transport_long_term_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_media_bytes": { - "path_match": "ipfix.cisco_avc_app_media_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_media_byte_rate": { - "path_match": "ipfix.cisco_avc_app_media_byte_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_media_packets": { - "path_match": "ipfix.cisco_avc_app_media_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_media_packet_rate": { - "path_match": "ipfix.cisco_avc_app_media_packet_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_media_packet_rate_variation": { - "path_match": "ipfix.cisco_avc_app_media_packet_rate_variation", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_media_event": { - "path_match": "ipfix.cisco_avc_app_media_event", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_monitor_event": { - "path_match": "ipfix.cisco_avc_app_monitor_event", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_packets_expected": { - "path_match": "ipfix.cisco_avc_transport_packets_expected", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtt": { - "path_match": "ipfix.cisco_avc_transport_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_packet_sets_lost": { - "path_match": "ipfix.cisco_avc_transport_packet_sets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_short_term_packets_lost": { - "path_match": "ipfix.cisco_avc_transport_short_term_packets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_long_term_packets_lost": { - "path_match": "ipfix.cisco_avc_transport_long_term_packets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_packet_loss_rate": { - "path_match": "ipfix.cisco_avc_transport_packet_loss_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtp_ssrc": { - "path_match": "ipfix.cisco_avc_transport_rtp_ssrc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtp_jitter_mean": { - "path_match": "ipfix.cisco_avc_transport_rtp_jitter_mean", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtp_jitter_min": { - "path_match": "ipfix.cisco_avc_transport_rtp_jitter_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtp_jitter_max": { - "path_match": "ipfix.cisco_avc_transport_rtp_jitter_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_controlled_tc": { - "path_match": "ipfix.cisco_avc_controlled_tc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_in_policy_tc": { - "path_match": "ipfix.cisco_avc_in_policy_tc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_media_packet_rate_variation_min": { - "path_match": "ipfix.cisco_avc_app_media_packet_rate_variation_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_media_packet_rate_variation_max": { - "path_match": "ipfix.cisco_avc_app_media_packet_rate_variation_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtp_flows": { - "path_match": "ipfix.cisco_avc_transport_rtp_flows", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtp_payload_type": { - "path_match": "ipfix.cisco_avc_transport_rtp_payload_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_packet_loss_rate_min": { - "path_match": "ipfix.cisco_avc_transport_packet_loss_rate_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_packet_loss_rate_max": { - "path_match": "ipfix.cisco_avc_transport_packet_loss_rate_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtt_sum": { - "path_match": "ipfix.cisco_avc_transport_rtt_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtt_min": { - "path_match": "ipfix.cisco_avc_transport_rtt_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtt_max": { - "path_match": "ipfix.cisco_avc_transport_rtt_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_metadata_global_session_id": { - "path_match": "ipfix.cisco_avc_metadata_global_session_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_metadata_multi_party_session_id": { - "path_match": "ipfix.cisco_avc_metadata_multi_party_session_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_metadata_clock_rate": { - "path_match": "ipfix.cisco_avc_metadata_clock_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_network_delay_avg": { - "path_match": "ipfix.cisco_avc_network_delay_avg", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_one_way_delay": { - "path_match": "ipfix.cisco_avc_one_way_delay", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_tcp_window_size_min": { - "path_match": "ipfix.cisco_avc_tcp_window_size_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_tcp_window_size_max": { - "path_match": "ipfix.cisco_avc_tcp_window_size_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_tcp_max_segment_size": { - "path_match": "ipfix.cisco_avc_tcp_max_segment_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_tcp_window_size_sum": { - "path_match": "ipfix.cisco_avc_tcp_window_size_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_rtp_jitter_interarrival_avg": { - "path_match": "ipfix.cisco_avc_rtp_jitter_interarrival_avg", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_src_site_id": { - "path_match": "ipfix.cisco_pfr_src_site_id", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_pfr_dst_site_id": { - "path_match": "ipfix.cisco_pfr_dst_site_id", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_avc_transport_byte_loss_rate": { - "path_match": "ipfix.cisco_avc_transport_byte_loss_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_event_tc_nomitigation_err_bw_count": { - "path_match": "ipfix.cisco_pfr_event_tc_nomitigation_err_bw_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_event_tc_nomitigation_err_perf_count": { - "path_match": "ipfix.cisco_pfr_event_tc_nomitigation_err_perf_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_dst_site_prefix": { - "path_match": "ipfix.cisco_pfr_dst_site_prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_pfr_dst_site_prefix_mask": { - "path_match": "ipfix.cisco_pfr_dst_site_prefix_mask", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_label_id": { - "path_match": "ipfix.cisco_pfr_label_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_br_addr": { - "path_match": "ipfix.cisco_pfr_br_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_pfr_state": { - "path_match": "ipfix.cisco_pfr_state", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_reason_id": { - "path_match": "ipfix.cisco_pfr_reason_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_threshold": { - "path_match": "ipfix.cisco_pfr_threshold", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_priority": { - "path_match": "ipfix.cisco_pfr_priority", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_long_term_rtt": { - "path_match": "ipfix.cisco_avc_long_term_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_mos_below_counts": { - "path_match": "ipfix.cisco_avc_mos_below_counts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_rsvp_bandwidth_pool": { - "path_match": "ipfix.cisco_avc_rsvp_bandwidth_pool", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_rollup_counter": { - "path_match": "ipfix.cisco_avc_rollup_counter", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_kth_tier_percent": { - "path_match": "ipfix.cisco_avc_kth_tier_percent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_kth_bw_fee": { - "path_match": "ipfix.cisco_avc_kth_bw_fee", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_src_port_min": { - "path_match": "ipfix.cisco_avc_src_port_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_src_port_max": { - "path_match": "ipfix.cisco_avc_src_port_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_dst_port_min": { - "path_match": "ipfix.cisco_avc_dst_port_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_dst_port_max": { - "path_match": "ipfix.cisco_avc_dst_port_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_link_capacity": { - "path_match": "ipfix.cisco_avc_link_capacity", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_ingress_bw": { - "path_match": "ipfix.cisco_avc_ingress_bw", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_ingress_bw_max": { - "path_match": "ipfix.cisco_avc_ingress_bw_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_egress_bw": { - "path_match": "ipfix.cisco_avc_egress_bw", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_egress_bw_max": { - "path_match": "ipfix.cisco_avc_egress_bw_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_ingress_rollup_bw": { - "path_match": "ipfix.cisco_avc_ingress_rollup_bw", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_egress_rollup_bw": { - "path_match": "ipfix.cisco_avc_egress_rollup_bw", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_kth_rollup_bw": { - "path_match": "ipfix.cisco_avc_kth_rollup_bw", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_link_group_name": { - "path_match": "ipfix.cisco_avc_link_group_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_bgp_community": { - "path_match": "ipfix.cisco_avc_bgp_community", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_avc_bgp_prepend": { - "path_match": "ipfix.cisco_avc_bgp_prepend", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_cost_discard_rollup_count": { - "path_match": "ipfix.cisco_avc_cost_discard_rollup_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_user": { - "path_match": "ipfix.cisco_fw_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_xlate_src_addr_ipv4": { - "path_match": "ipfix.cisco_fw_xlate_src_addr_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_fw_xlate_dst_addr_ipv4": { - "path_match": "ipfix.cisco_fw_xlate_dst_addr_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_fw_xlate_src_port": { - "path_match": "ipfix.cisco_fw_xlate_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_xlate_dst_port": { - "path_match": "ipfix.cisco_fw_xlate_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_event": { - "path_match": "ipfix.cisco_fw_event", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_client_long_lived_network_delay_max": { - "path_match": "ipfix.cisco_avc_client_long_lived_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_long_lived_network_delay_min": { - "path_match": "ipfix.cisco_avc_client_long_lived_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_long_lived_network_delay_max": { - "path_match": "ipfix.cisco_avc_server_long_lived_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_long_lived_network_delay_min": { - "path_match": "ipfix.cisco_avc_server_long_lived_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_policy_qos_class_hierarchy": { - "path_match": "ipfix.cisco_policy_qos_class_hierarchy", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_server_bytes": { - "path_match": "ipfix.cisco_avc_server_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_bytes": { - "path_match": "ipfix.cisco_avc_client_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_concurrent_sessions": { - "path_match": "ipfix.cisco_avc_concurrent_sessions", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_segment": { - "path_match": "ipfix.cisco_waas_segment", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_passthru_reason": { - "path_match": "ipfix.cisco_waas_passthru_reason", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_long_lived_network_delay_sum": { - "path_match": "ipfix.cisco_avc_server_long_lived_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_long_lived_network_delay_sum": { - "path_match": "ipfix.cisco_avc_client_long_lived_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_total_long_lived_network_delay_sum": { - "path_match": "ipfix.cisco_avc_total_long_lived_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_total_long_lived_network_delay_samples": { - "path_match": "ipfix.cisco_avc_total_long_lived_network_delay_samples", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_long_lived_network_delay_samples": { - "path_match": "ipfix.cisco_avc_server_long_lived_network_delay_samples", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_long_lived_network_delay_samples": { - "path_match": "ipfix.cisco_avc_client_long_lived_network_delay_samples", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_packets": { - "path_match": "ipfix.cisco_avc_client_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_packets": { - "path_match": "ipfix.cisco_avc_server_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_retrans_bytes": { - "path_match": "ipfix.cisco_avc_client_retrans_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_retrans_packets": { - "path_match": "ipfix.cisco_avc_client_retrans_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_retrans_bytes": { - "path_match": "ipfix.cisco_avc_server_retrans_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_retrans_packets": { - "path_match": "ipfix.cisco_avc_server_retrans_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transact_time_delta": { - "path_match": "ipfix.cisco_avc_transact_time_delta", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transact_time_total": { - "path_match": "ipfix.cisco_avc_transact_time_total", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transact_time_max": { - "path_match": "ipfix.cisco_avc_transact_time_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transact_time_min": { - "path_match": "ipfix.cisco_avc_transact_time_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_resps": { - "path_match": "ipfix.cisco_avc_server_resps", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_resp_histogram1": { - "path_match": "ipfix.cisco_avc_resp_histogram1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_resp_histogram2": { - "path_match": "ipfix.cisco_avc_resp_histogram2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_resp_histogram3": { - "path_match": "ipfix.cisco_avc_resp_histogram3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_resp_histogram4": { - "path_match": "ipfix.cisco_avc_resp_histogram4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_resp_histogram5": { - "path_match": "ipfix.cisco_avc_resp_histogram5", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_resp_histogram6": { - "path_match": "ipfix.cisco_avc_resp_histogram6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_resp_histogram7": { - "path_match": "ipfix.cisco_avc_resp_histogram7", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_late_resps": { - "path_match": "ipfix.cisco_avc_server_late_resps", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_resp_time_sum": { - "path_match": "ipfix.cisco_avc_server_resp_time_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_resp_time_max": { - "path_match": "ipfix.cisco_avc_server_resp_time_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_resp_time_min": { - "path_match": "ipfix.cisco_avc_server_resp_time_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_delay_sum": { - "path_match": "ipfix.cisco_avc_app_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_delay_max": { - "path_match": "ipfix.cisco_avc_app_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_delay_min": { - "path_match": "ipfix.cisco_avc_app_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_total_delay_sum": { - "path_match": "ipfix.cisco_avc_total_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_total_delay_max": { - "path_match": "ipfix.cisco_avc_total_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_total_delay_min": { - "path_match": "ipfix.cisco_avc_total_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_total_network_delay_sum": { - "path_match": "ipfix.cisco_avc_total_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_total_network_delay_max": { - "path_match": "ipfix.cisco_avc_total_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_total_network_delay_min": { - "path_match": "ipfix.cisco_avc_total_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_network_delay_sum": { - "path_match": "ipfix.cisco_avc_client_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_network_delay_max": { - "path_match": "ipfix.cisco_avc_client_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_network_delay_min": { - "path_match": "ipfix.cisco_avc_client_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_network_delay_sum": { - "path_match": "ipfix.cisco_avc_server_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_network_delay_max": { - "path_match": "ipfix.cisco_avc_server_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_network_delay_min": { - "path_match": "ipfix.cisco_avc_server_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_rtp_short_term_mos": { - "path_match": "ipfix.cisco_avc_rtp_short_term_mos", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_rtp_mos": { - "path_match": "ipfix.cisco_avc_rtp_mos", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_rtp_mos_total": { - "path_match": "ipfix.cisco_avc_rtp_mos_total", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_http_uri_stats": { - "path_match": "ipfix.cisco_avc_app_http_uri_stats", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_policy_qos_queue_id": { - "path_match": "ipfix.cisco_avc_policy_qos_queue_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_policy_qos_queue_drops": { - "path_match": "ipfix.cisco_avc_policy_qos_queue_drops", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_eta_idp_old": { - "path_match": "ipfix.cisco_eta_idp_old", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_eta_slpt_old": { - "path_match": "ipfix.cisco_eta_slpt_old", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_wlan_id": { - "path_match": "ipfix.cisco_wlan_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_category": { - "path_match": "ipfix.cisco_avc_app_category", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_app_sub_category": { - "path_match": "ipfix.cisco_avc_app_sub_category", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_app_group": { - "path_match": "ipfix.cisco_avc_app_group", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_app_http_host": { - "path_match": "ipfix.cisco_avc_app_http_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_client_ipv4_addr": { - "path_match": "ipfix.cisco_avc_client_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_avc_server_ipv4_addr": { - "path_match": "ipfix.cisco_avc_server_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_avc_client_ipv6_addr": { - "path_match": "ipfix.cisco_avc_client_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_avc_server_ipv6_addr": { - "path_match": "ipfix.cisco_avc_server_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_avc_client_l4_port": { - "path_match": "ipfix.cisco_avc_client_l4_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_l4_port": { - "path_match": "ipfix.cisco_avc_server_l4_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_conn_id": { - "path_match": "ipfix.cisco_avc_conn_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_traffic_class": { - "path_match": "ipfix.cisco_avc_app_traffic_class", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_app_business_relevance": { - "path_match": "ipfix.cisco_avc_app_business_relevance", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_udid": { - "path_match": "ipfix.cisco_nvzflow_udid", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_user": { - "path_match": "ipfix.cisco_nvzflow_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_os_name": { - "path_match": "ipfix.cisco_nvzflow_os_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_os_ver": { - "path_match": "ipfix.cisco_nvzflow_os_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_sys_vendor": { - "path_match": "ipfix.cisco_nvzflow_sys_vendor", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_sys_type": { - "path_match": "ipfix.cisco_nvzflow_sys_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_proc_acct": { - "path_match": "ipfix.cisco_nvzflow_proc_acct", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_parent_proc_acct": { - "path_match": "ipfix.cisco_nvzflow_parent_proc_acct", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_proc": { - "path_match": "ipfix.cisco_nvzflow_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_proc_hash": { - "path_match": "ipfix.cisco_nvzflow_proc_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_parent_proc": { - "path_match": "ipfix.cisco_nvzflow_parent_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_parent_proc_hash": { - "path_match": "ipfix.cisco_nvzflow_parent_proc_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_dns_suffix": { - "path_match": "ipfix.cisco_nvzflow_dns_suffix", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_dst_hostname": { - "path_match": "ipfix.cisco_nvzflow_dst_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_l4_bytes_in": { - "path_match": "ipfix.cisco_nvzflow_l4_bytes_in", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_nvzflow_l4_bytes_out": { - "path_match": "ipfix.cisco_nvzflow_l4_bytes_out", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_nvzflow_os_edition": { - "path_match": "ipfix.cisco_nvzflow_os_edition", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_module_list": { - "path_match": "ipfix.cisco_nvzflow_module_list", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_hash_list": { - "path_match": "ipfix.cisco_nvzflow_hash_list", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_coord_list": { - "path_match": "ipfix.cisco_nvzflow_coord_list", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_iface_info_uid": { - "path_match": "ipfix.cisco_nvzflow_iface_info_uid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_nvzflow_iface_index": { - "path_match": "ipfix.cisco_nvzflow_iface_index", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_nvzflow_iface_type": { - "path_match": "ipfix.cisco_nvzflow_iface_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_nvzflow_iface_name": { - "path_match": "ipfix.cisco_nvzflow_iface_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_iface_details_list": { - "path_match": "ipfix.cisco_nvzflow_iface_details_list", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_timestamp_abs_monitor_interval_start": { - "path_match": "ipfix.cisco_timestamp_abs_monitor_interval_start", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_timestamp_abs_monitor_interval_end": { - "path_match": "ipfix.cisco_timestamp_abs_monitor_interval_end", - "mapping": { - "type": "long" - } - } - }, + { + "ipfix.cisco_avc_p2p_tech": { + "path_match": "ipfix.cisco_avc_p2p_tech", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_tunnel_tech": { + "path_match": "ipfix.cisco_avc_tunnel_tech", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_encrypt_tech": { + "path_match": "ipfix.cisco_avc_encrypt_tech", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_ipt_dialing_phone": { + "path_match": "ipfix.cisco_ipt_dialing_phone", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_ipt_dialing_user": { + "path_match": "ipfix.cisco_ipt_dialing_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_ipt_dialed_phone": { + "path_match": "ipfix.cisco_ipt_dialed_phone", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_ipt_dialed_user": { + "path_match": "ipfix.cisco_ipt_dialed_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_ipt_call_duration": { + "path_match": "ipfix.cisco_ipt_call_duration", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_ipt_call_end_reason": { + "path_match": "ipfix.cisco_ipt_call_end_reason", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_ipt_calls_dialed": { + "path_match": "ipfix.cisco_ipt_calls_dialed", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_ipt_calls_connected": { + "path_match": "ipfix.cisco_ipt_calls_connected", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_ipt_calls_failed": { + "path_match": "ipfix.cisco_ipt_calls_failed", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_nexus_fastpath_src_addr": { + "path_match": "ipfix.cisco_nexus_fastpath_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_nexus_fastpath_src_port": { + "path_match": "ipfix.cisco_nexus_fastpath_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_nexus_fastpath_dst_addr": { + "path_match": "ipfix.cisco_nexus_fastpath_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_nexus_fastpath_dst_port": { + "path_match": "ipfix.cisco_nexus_fastpath_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_endpoint_process_user": { + "path_match": "ipfix.cisco_endpoint_process_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_endpoint_process_name": { + "path_match": "ipfix.cisco_endpoint_process_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_endpoint_process_hash": { + "path_match": "ipfix.cisco_endpoint_process_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_endpoint_process_parent_user": { + "path_match": "ipfix.cisco_endpoint_process_parent_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_endpoint_process_parent_name": { + "path_match": "ipfix.cisco_endpoint_process_parent_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_endpoint_process_parent_hash": { + "path_match": "ipfix.cisco_endpoint_process_parent_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_pfr_policy_id": { + "path_match": "ipfix.cisco_pfr_policy_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_map_name": { + "path_match": "ipfix.cisco_pfr_map_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_pfr_reason": { + "path_match": "ipfix.cisco_pfr_reason", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_ingress_acl_id": { + "path_match": "ipfix.cisco_fw_ingress_acl_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_egress_acl_id": { + "path_match": "ipfix.cisco_fw_egress_acl_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_ext_event": { + "path_match": "ipfix.cisco_fw_ext_event", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_event_level": { + "path_match": "ipfix.cisco_fw_event_level", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_event_level_id": { + "path_match": "ipfix.cisco_fw_event_level_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_config_value": { + "path_match": "ipfix.cisco_fw_config_value", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_erm_code": { + "path_match": "ipfix.cisco_fw_erm_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_erm_descr": { + "path_match": "ipfix.cisco_fw_erm_descr", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_trustsec_src_id": { + "path_match": "ipfix.cisco_trustsec_src_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_trustsec_dst_id": { + "path_match": "ipfix.cisco_trustsec_dst_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_trustsec_src_name": { + "path_match": "ipfix.cisco_trustsec_src_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_trustsec_dst_name": { + "path_match": "ipfix.cisco_trustsec_dst_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_trustsec_switch_derived_sgt": { + "path_match": "ipfix.cisco_trustsec_switch_derived_sgt", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_ext_event": { + "path_match": "ipfix.cisco_fw_ext_event", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_blackout_secs": { + "path_match": "ipfix.cisco_fw_blackout_secs", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_half_open_sessions_rate_1min_max": { + "path_match": "ipfix.cisco_fw_half_open_sessions_rate_1min_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_half_open_sessions_rate_1min": { + "path_match": "ipfix.cisco_fw_half_open_sessions_rate_1min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_zonepair_id": { + "path_match": "ipfix.cisco_fw_zonepair_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_sessions_max": { + "path_match": "ipfix.cisco_fw_sessions_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_zonepair": { + "path_match": "ipfix.cisco_fw_zonepair", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_ext_event_descr": { + "path_match": "ipfix.cisco_fw_ext_event_descr", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_drop_pass_summary_packets": { + "path_match": "ipfix.cisco_fw_drop_pass_summary_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_half_open_sessions": { + "path_match": "ipfix.cisco_fw_half_open_sessions", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_dre_input": { + "path_match": "ipfix.cisco_waas_dre_input", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_dre_output": { + "path_match": "ipfix.cisco_waas_dre_output", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_lz_input": { + "path_match": "ipfix.cisco_waas_lz_input", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_lz_output": { + "path_match": "ipfix.cisco_waas_lz_output", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_conn_mode": { + "path_match": "ipfix.cisco_waas_conn_mode", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_input_bytes": { + "path_match": "ipfix.cisco_waas_input_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_output_bytes": { + "path_match": "ipfix.cisco_waas_output_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_short_term_packets_drop": { + "path_match": "ipfix.cisco_avc_transport_short_term_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_long_term_packets_drop": { + "path_match": "ipfix.cisco_avc_transport_long_term_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_media_bytes": { + "path_match": "ipfix.cisco_avc_app_media_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_media_byte_rate": { + "path_match": "ipfix.cisco_avc_app_media_byte_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_media_packets": { + "path_match": "ipfix.cisco_avc_app_media_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_media_packet_rate": { + "path_match": "ipfix.cisco_avc_app_media_packet_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_media_packet_rate_variation": { + "path_match": "ipfix.cisco_avc_app_media_packet_rate_variation", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_media_event": { + "path_match": "ipfix.cisco_avc_app_media_event", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_monitor_event": { + "path_match": "ipfix.cisco_avc_app_monitor_event", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_packets_expected": { + "path_match": "ipfix.cisco_avc_transport_packets_expected", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtt": { + "path_match": "ipfix.cisco_avc_transport_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_packet_sets_lost": { + "path_match": "ipfix.cisco_avc_transport_packet_sets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_short_term_packets_lost": { + "path_match": "ipfix.cisco_avc_transport_short_term_packets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_long_term_packets_lost": { + "path_match": "ipfix.cisco_avc_transport_long_term_packets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_packet_loss_rate": { + "path_match": "ipfix.cisco_avc_transport_packet_loss_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtp_ssrc": { + "path_match": "ipfix.cisco_avc_transport_rtp_ssrc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtp_jitter_mean": { + "path_match": "ipfix.cisco_avc_transport_rtp_jitter_mean", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtp_jitter_min": { + "path_match": "ipfix.cisco_avc_transport_rtp_jitter_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtp_jitter_max": { + "path_match": "ipfix.cisco_avc_transport_rtp_jitter_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_controlled_tc": { + "path_match": "ipfix.cisco_avc_controlled_tc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_in_policy_tc": { + "path_match": "ipfix.cisco_avc_in_policy_tc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_media_packet_rate_variation_min": { + "path_match": "ipfix.cisco_avc_app_media_packet_rate_variation_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_media_packet_rate_variation_max": { + "path_match": "ipfix.cisco_avc_app_media_packet_rate_variation_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtp_flows": { + "path_match": "ipfix.cisco_avc_transport_rtp_flows", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtp_payload_type": { + "path_match": "ipfix.cisco_avc_transport_rtp_payload_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_packet_loss_rate_min": { + "path_match": "ipfix.cisco_avc_transport_packet_loss_rate_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_packet_loss_rate_max": { + "path_match": "ipfix.cisco_avc_transport_packet_loss_rate_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtt_sum": { + "path_match": "ipfix.cisco_avc_transport_rtt_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtt_min": { + "path_match": "ipfix.cisco_avc_transport_rtt_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtt_max": { + "path_match": "ipfix.cisco_avc_transport_rtt_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_metadata_global_session_id": { + "path_match": "ipfix.cisco_avc_metadata_global_session_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_metadata_multi_party_session_id": { + "path_match": "ipfix.cisco_avc_metadata_multi_party_session_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_metadata_clock_rate": { + "path_match": "ipfix.cisco_avc_metadata_clock_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_network_delay_avg": { + "path_match": "ipfix.cisco_avc_network_delay_avg", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_one_way_delay": { + "path_match": "ipfix.cisco_avc_one_way_delay", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_tcp_window_size_min": { + "path_match": "ipfix.cisco_avc_tcp_window_size_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_tcp_window_size_max": { + "path_match": "ipfix.cisco_avc_tcp_window_size_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_tcp_max_segment_size": { + "path_match": "ipfix.cisco_avc_tcp_max_segment_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_tcp_window_size_sum": { + "path_match": "ipfix.cisco_avc_tcp_window_size_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_rtp_jitter_interarrival_avg": { + "path_match": "ipfix.cisco_avc_rtp_jitter_interarrival_avg", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_src_site_id": { + "path_match": "ipfix.cisco_pfr_src_site_id", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_pfr_dst_site_id": { + "path_match": "ipfix.cisco_pfr_dst_site_id", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_avc_transport_byte_loss_rate": { + "path_match": "ipfix.cisco_avc_transport_byte_loss_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_event_tc_nomitigation_err_bw_count": { + "path_match": "ipfix.cisco_pfr_event_tc_nomitigation_err_bw_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_event_tc_nomitigation_err_perf_count": { + "path_match": "ipfix.cisco_pfr_event_tc_nomitigation_err_perf_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_dst_site_prefix": { + "path_match": "ipfix.cisco_pfr_dst_site_prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_pfr_dst_site_prefix_mask": { + "path_match": "ipfix.cisco_pfr_dst_site_prefix_mask", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_label_id": { + "path_match": "ipfix.cisco_pfr_label_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_br_addr": { + "path_match": "ipfix.cisco_pfr_br_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_pfr_state": { + "path_match": "ipfix.cisco_pfr_state", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_reason_id": { + "path_match": "ipfix.cisco_pfr_reason_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_threshold": { + "path_match": "ipfix.cisco_pfr_threshold", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_priority": { + "path_match": "ipfix.cisco_pfr_priority", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_long_term_rtt": { + "path_match": "ipfix.cisco_avc_long_term_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_mos_below_counts": { + "path_match": "ipfix.cisco_avc_mos_below_counts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_rsvp_bandwidth_pool": { + "path_match": "ipfix.cisco_avc_rsvp_bandwidth_pool", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_rollup_counter": { + "path_match": "ipfix.cisco_avc_rollup_counter", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_kth_tier_percent": { + "path_match": "ipfix.cisco_avc_kth_tier_percent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_kth_bw_fee": { + "path_match": "ipfix.cisco_avc_kth_bw_fee", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_src_port_min": { + "path_match": "ipfix.cisco_avc_src_port_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_src_port_max": { + "path_match": "ipfix.cisco_avc_src_port_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_dst_port_min": { + "path_match": "ipfix.cisco_avc_dst_port_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_dst_port_max": { + "path_match": "ipfix.cisco_avc_dst_port_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_link_capacity": { + "path_match": "ipfix.cisco_avc_link_capacity", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_ingress_bw": { + "path_match": "ipfix.cisco_avc_ingress_bw", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_ingress_bw_max": { + "path_match": "ipfix.cisco_avc_ingress_bw_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_egress_bw": { + "path_match": "ipfix.cisco_avc_egress_bw", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_egress_bw_max": { + "path_match": "ipfix.cisco_avc_egress_bw_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_ingress_rollup_bw": { + "path_match": "ipfix.cisco_avc_ingress_rollup_bw", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_egress_rollup_bw": { + "path_match": "ipfix.cisco_avc_egress_rollup_bw", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_kth_rollup_bw": { + "path_match": "ipfix.cisco_avc_kth_rollup_bw", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_link_group_name": { + "path_match": "ipfix.cisco_avc_link_group_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_bgp_community": { + "path_match": "ipfix.cisco_avc_bgp_community", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_avc_bgp_prepend": { + "path_match": "ipfix.cisco_avc_bgp_prepend", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_cost_discard_rollup_count": { + "path_match": "ipfix.cisco_avc_cost_discard_rollup_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_user": { + "path_match": "ipfix.cisco_fw_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_xlate_src_addr_ipv4": { + "path_match": "ipfix.cisco_fw_xlate_src_addr_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_fw_xlate_dst_addr_ipv4": { + "path_match": "ipfix.cisco_fw_xlate_dst_addr_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_fw_xlate_src_port": { + "path_match": "ipfix.cisco_fw_xlate_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_xlate_dst_port": { + "path_match": "ipfix.cisco_fw_xlate_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_event": { + "path_match": "ipfix.cisco_fw_event", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_client_long_lived_network_delay_max": { + "path_match": "ipfix.cisco_avc_client_long_lived_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_long_lived_network_delay_min": { + "path_match": "ipfix.cisco_avc_client_long_lived_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_long_lived_network_delay_max": { + "path_match": "ipfix.cisco_avc_server_long_lived_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_long_lived_network_delay_min": { + "path_match": "ipfix.cisco_avc_server_long_lived_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_policy_qos_class_hierarchy": { + "path_match": "ipfix.cisco_policy_qos_class_hierarchy", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_server_bytes": { + "path_match": "ipfix.cisco_avc_server_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_bytes": { + "path_match": "ipfix.cisco_avc_client_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_concurrent_sessions": { + "path_match": "ipfix.cisco_avc_concurrent_sessions", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_segment": { + "path_match": "ipfix.cisco_waas_segment", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_passthru_reason": { + "path_match": "ipfix.cisco_waas_passthru_reason", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_long_lived_network_delay_sum": { + "path_match": "ipfix.cisco_avc_server_long_lived_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_long_lived_network_delay_sum": { + "path_match": "ipfix.cisco_avc_client_long_lived_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_total_long_lived_network_delay_sum": { + "path_match": "ipfix.cisco_avc_total_long_lived_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_total_long_lived_network_delay_samples": { + "path_match": "ipfix.cisco_avc_total_long_lived_network_delay_samples", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_long_lived_network_delay_samples": { + "path_match": "ipfix.cisco_avc_server_long_lived_network_delay_samples", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_long_lived_network_delay_samples": { + "path_match": "ipfix.cisco_avc_client_long_lived_network_delay_samples", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_packets": { + "path_match": "ipfix.cisco_avc_client_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_packets": { + "path_match": "ipfix.cisco_avc_server_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_retrans_bytes": { + "path_match": "ipfix.cisco_avc_client_retrans_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_retrans_packets": { + "path_match": "ipfix.cisco_avc_client_retrans_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_retrans_bytes": { + "path_match": "ipfix.cisco_avc_server_retrans_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_retrans_packets": { + "path_match": "ipfix.cisco_avc_server_retrans_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transact_time_delta": { + "path_match": "ipfix.cisco_avc_transact_time_delta", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transact_time_total": { + "path_match": "ipfix.cisco_avc_transact_time_total", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transact_time_max": { + "path_match": "ipfix.cisco_avc_transact_time_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transact_time_min": { + "path_match": "ipfix.cisco_avc_transact_time_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_resps": { + "path_match": "ipfix.cisco_avc_server_resps", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_resp_histogram1": { + "path_match": "ipfix.cisco_avc_resp_histogram1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_resp_histogram2": { + "path_match": "ipfix.cisco_avc_resp_histogram2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_resp_histogram3": { + "path_match": "ipfix.cisco_avc_resp_histogram3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_resp_histogram4": { + "path_match": "ipfix.cisco_avc_resp_histogram4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_resp_histogram5": { + "path_match": "ipfix.cisco_avc_resp_histogram5", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_resp_histogram6": { + "path_match": "ipfix.cisco_avc_resp_histogram6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_resp_histogram7": { + "path_match": "ipfix.cisco_avc_resp_histogram7", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_late_resps": { + "path_match": "ipfix.cisco_avc_server_late_resps", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_resp_time_sum": { + "path_match": "ipfix.cisco_avc_server_resp_time_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_resp_time_max": { + "path_match": "ipfix.cisco_avc_server_resp_time_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_resp_time_min": { + "path_match": "ipfix.cisco_avc_server_resp_time_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_delay_sum": { + "path_match": "ipfix.cisco_avc_app_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_delay_max": { + "path_match": "ipfix.cisco_avc_app_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_delay_min": { + "path_match": "ipfix.cisco_avc_app_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_total_delay_sum": { + "path_match": "ipfix.cisco_avc_total_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_total_delay_max": { + "path_match": "ipfix.cisco_avc_total_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_total_delay_min": { + "path_match": "ipfix.cisco_avc_total_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_total_network_delay_sum": { + "path_match": "ipfix.cisco_avc_total_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_total_network_delay_max": { + "path_match": "ipfix.cisco_avc_total_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_total_network_delay_min": { + "path_match": "ipfix.cisco_avc_total_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_network_delay_sum": { + "path_match": "ipfix.cisco_avc_client_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_network_delay_max": { + "path_match": "ipfix.cisco_avc_client_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_network_delay_min": { + "path_match": "ipfix.cisco_avc_client_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_network_delay_sum": { + "path_match": "ipfix.cisco_avc_server_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_network_delay_max": { + "path_match": "ipfix.cisco_avc_server_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_network_delay_min": { + "path_match": "ipfix.cisco_avc_server_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_rtp_short_term_mos": { + "path_match": "ipfix.cisco_avc_rtp_short_term_mos", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_rtp_mos": { + "path_match": "ipfix.cisco_avc_rtp_mos", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_rtp_mos_total": { + "path_match": "ipfix.cisco_avc_rtp_mos_total", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_http_uri_stats": { + "path_match": "ipfix.cisco_avc_app_http_uri_stats", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_policy_qos_queue_id": { + "path_match": "ipfix.cisco_avc_policy_qos_queue_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_policy_qos_queue_drops": { + "path_match": "ipfix.cisco_avc_policy_qos_queue_drops", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_eta_idp_old": { + "path_match": "ipfix.cisco_eta_idp_old", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_eta_slpt_old": { + "path_match": "ipfix.cisco_eta_slpt_old", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_wlan_id": { + "path_match": "ipfix.cisco_wlan_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_category": { + "path_match": "ipfix.cisco_avc_app_category", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_app_sub_category": { + "path_match": "ipfix.cisco_avc_app_sub_category", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_app_group": { + "path_match": "ipfix.cisco_avc_app_group", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_app_http_host": { + "path_match": "ipfix.cisco_avc_app_http_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_client_ipv4_addr": { + "path_match": "ipfix.cisco_avc_client_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_avc_server_ipv4_addr": { + "path_match": "ipfix.cisco_avc_server_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_avc_client_ipv6_addr": { + "path_match": "ipfix.cisco_avc_client_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_avc_server_ipv6_addr": { + "path_match": "ipfix.cisco_avc_server_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_avc_client_l4_port": { + "path_match": "ipfix.cisco_avc_client_l4_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_l4_port": { + "path_match": "ipfix.cisco_avc_server_l4_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_conn_id": { + "path_match": "ipfix.cisco_avc_conn_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_traffic_class": { + "path_match": "ipfix.cisco_avc_app_traffic_class", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_app_business_relevance": { + "path_match": "ipfix.cisco_avc_app_business_relevance", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_udid": { + "path_match": "ipfix.cisco_nvzflow_udid", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_user": { + "path_match": "ipfix.cisco_nvzflow_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_os_name": { + "path_match": "ipfix.cisco_nvzflow_os_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_os_ver": { + "path_match": "ipfix.cisco_nvzflow_os_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_sys_vendor": { + "path_match": "ipfix.cisco_nvzflow_sys_vendor", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_sys_type": { + "path_match": "ipfix.cisco_nvzflow_sys_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_proc_acct": { + "path_match": "ipfix.cisco_nvzflow_proc_acct", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_parent_proc_acct": { + "path_match": "ipfix.cisco_nvzflow_parent_proc_acct", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_proc": { + "path_match": "ipfix.cisco_nvzflow_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_proc_hash": { + "path_match": "ipfix.cisco_nvzflow_proc_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_parent_proc": { + "path_match": "ipfix.cisco_nvzflow_parent_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_parent_proc_hash": { + "path_match": "ipfix.cisco_nvzflow_parent_proc_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_dns_suffix": { + "path_match": "ipfix.cisco_nvzflow_dns_suffix", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_dst_hostname": { + "path_match": "ipfix.cisco_nvzflow_dst_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_l4_bytes_in": { + "path_match": "ipfix.cisco_nvzflow_l4_bytes_in", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_nvzflow_l4_bytes_out": { + "path_match": "ipfix.cisco_nvzflow_l4_bytes_out", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_nvzflow_os_edition": { + "path_match": "ipfix.cisco_nvzflow_os_edition", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_module_list": { + "path_match": "ipfix.cisco_nvzflow_module_list", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_hash_list": { + "path_match": "ipfix.cisco_nvzflow_hash_list", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_coord_list": { + "path_match": "ipfix.cisco_nvzflow_coord_list", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_iface_info_uid": { + "path_match": "ipfix.cisco_nvzflow_iface_info_uid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_nvzflow_iface_index": { + "path_match": "ipfix.cisco_nvzflow_iface_index", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_nvzflow_iface_type": { + "path_match": "ipfix.cisco_nvzflow_iface_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_nvzflow_iface_name": { + "path_match": "ipfix.cisco_nvzflow_iface_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_iface_details_list": { + "path_match": "ipfix.cisco_nvzflow_iface_details_list", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_timestamp_abs_monitor_interval_start": { + "path_match": "ipfix.cisco_timestamp_abs_monitor_interval_start", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_timestamp_abs_monitor_interval_end": { + "path_match": "ipfix.cisco_timestamp_abs_monitor_interval_end", + "mapping": { + "type": "long" + } + } + }, - { - "ipfix.f5_msg_sev": { - "path_match": "ipfix.f5_msg_sev", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_partition": { - "path_match": "ipfix.f5_partition", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_err_defs_msg_num": { - "path_match": "ipfix.f5_err_defs_msg_num", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_bigip_mgmt_ipv4_addr": { - "path_match": "ipfix.f5_bigip_mgmt_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.f5_bigip_mgmt_ipv6_addr": { - "path_match": "ipfix.f5_bigip_mgmt_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.f5_query_name": { - "path_match": "ipfix.f5_query_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_dns_query_type": { - "path_match": "ipfix.f5_dns_query_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_context_name": { - "path_match": "ipfix.f5_context_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_bigip_hostname": { - "path_match": "ipfix.f5_bigip_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_device_vendor": { - "path_match": "ipfix.f5_device_vendor", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_device_product": { - "path_match": "ipfix.f5_device_product", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_device_ver": { - "path_match": "ipfix.f5_device_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_msg": { - "path_match": "ipfix.f5_msg", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_vlan": { - "path_match": "ipfix.f5_vlan", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_ipfix_msg_no": { - "path_match": "ipfix.f5_ipfix_msg_no", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_attack_id": { - "path_match": "ipfix.f5_attack_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_attack": { - "path_match": "ipfix.f5_attack", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_packets_rcvd": { - "path_match": "ipfix.f5_packets_rcvd", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_packets_drop": { - "path_match": "ipfix.f5_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_context_type": { - "path_match": "ipfix.f5_context_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_acl_policy_type": { - "path_match": "ipfix.f5_acl_policy_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_acl_policy": { - "path_match": "ipfix.f5_acl_policy", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_trans_ip_proto": { - "path_match": "ipfix.f5_trans_ip_proto", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_trans_src_ipv4_addr": { - "path_match": "ipfix.f5_trans_src_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.f5_trans_src_ipv6_addr": { - "path_match": "ipfix.f5_trans_src_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.f5_trans_src_port": { - "path_match": "ipfix.f5_trans_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_trans_dst_ipv4_addr": { - "path_match": "ipfix.f5_trans_dst_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.f5_trans_dst_ipv6_addr": { - "path_match": "ipfix.f5_trans_dst_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.f5_trans_dst_port": { - "path_match": "ipfix.f5_trans_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_trans_vlan": { - "path_match": "ipfix.f5_trans_vlan", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_trans_route_domain": { - "path_match": "ipfix.f5_trans_route_domain", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_sa_trans_type": { - "path_match": "ipfix.f5_sa_trans_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_sa_trans_pool": { - "path_match": "ipfix.f5_sa_trans_pool", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_acl_rule": { - "path_match": "ipfix.f5_acl_rule", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_action": { - "path_match": "ipfix.f5_action", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_drop_reason": { - "path_match": "ipfix.f5_drop_reason", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_attack_event": { - "path_match": "ipfix.f5_attack_event", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_ip_intel_threat_name": { - "path_match": "ipfix.f5_ip_intel_threat_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_destination_geo": { - "path_match": "ipfix.f5_destination_geo", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_source_geo": { - "path_match": "ipfix.f5_source_geo", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_ip_intel_policy_name": { - "path_match": "ipfix.f5_ip_intel_policy_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_attack_type": { - "path_match": "ipfix.f5_attack_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_app_category": { - "path_match": "ipfix.f5_app_category", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_classification": { - "path_match": "ipfix.f5_classification", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_flow_start_millis": { - "path_match": "ipfix.f5_flow_start_millis", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_flow_start_secs": { - "path_match": "ipfix.f5_flow_start_secs", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_flow_stop_millis": { - "path_match": "ipfix.f5_flow_stop_millis", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_flow_stop_secs": { - "path_match": "ipfix.f5_flow_stop_secs", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_record_type": { - "path_match": "ipfix.f5_record_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_report_id": { - "path_match": "ipfix.f5_report_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_report_ver": { - "path_match": "ipfix.f5_report_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_3gpp_params": { - "path_match": "ipfix.f5_3gpp_params", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_concurrent_flows": { - "path_match": "ipfix.f5_concurrent_flows", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_duration_secs": { - "path_match": "ipfix.f5_duration_secs", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_last_record_sent": { - "path_match": "ipfix.f5_last_record_sent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_new_flows": { - "path_match": "ipfix.f5_new_flows", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_record_reason": { - "path_match": "ipfix.f5_record_reason", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_success_transacts": { - "path_match": "ipfix.f5_success_transacts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_terminated_flows": { - "path_match": "ipfix.f5_terminated_flows", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_subscriber_id": { - "path_match": "ipfix.f5_subscriber_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_subscriber_id_type": { - "path_match": "ipfix.f5_subscriber_id_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_total_transacts": { - "path_match": "ipfix.f5_total_transacts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_http_hostname": { - "path_match": "ipfix.f5_http_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_http_hostname_trunc": { - "path_match": "ipfix.f5_http_hostname_trunc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_http_resp_code": { - "path_match": "ipfix.f5_http_resp_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_http_url": { - "path_match": "ipfix.f5_http_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_http_url_trunc": { - "path_match": "ipfix.f5_http_url_trunc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_http_user_agent": { - "path_match": "ipfix.f5_http_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_http_user_agent_trunc": { - "path_match": "ipfix.f5_http_user_agent_trunc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_transacts": { - "path_match": "ipfix.f5_transacts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_skipped_transacts": { - "path_match": "ipfix.f5_skipped_transacts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_transact_start_millis": { - "path_match": "ipfix.f5_transact_start_millis", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_transact_start_secs": { - "path_match": "ipfix.f5_transact_start_secs", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_transact_stop_millis": { - "path_match": "ipfix.f5_transact_stop_millis", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_transact_stop_secs": { - "path_match": "ipfix.f5_transact_stop_secs", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_url_category": { - "path_match": "ipfix.f5_url_category", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_downlink_volume": { - "path_match": "ipfix.f5_downlink_volume", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_uplink_volume": { - "path_match": "ipfix.f5_uplink_volume", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_observation_time_secs": { - "path_match": "ipfix.f5_observation_time_secs", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_timestamp_millis": { - "path_match": "ipfix.f5_timestamp_millis", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_vlan_id": { - "path_match": "ipfix.f5_vlan_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_source_user": { - "path_match": "ipfix.f5_source_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_log_profile": { - "path_match": "ipfix.f5_log_profile", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_log_msg_drops": { - "path_match": "ipfix.f5_log_msg_drops", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_log_msg_name": { - "path_match": "ipfix.f5_log_msg_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_src_fqdn": { - "path_match": "ipfix.f5_src_fqdn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_dst_fqdn": { - "path_match": "ipfix.f5_dst_fqdn", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.f5_msg_sev": { + "path_match": "ipfix.f5_msg_sev", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_partition": { + "path_match": "ipfix.f5_partition", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_err_defs_msg_num": { + "path_match": "ipfix.f5_err_defs_msg_num", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_bigip_mgmt_ipv4_addr": { + "path_match": "ipfix.f5_bigip_mgmt_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.f5_bigip_mgmt_ipv6_addr": { + "path_match": "ipfix.f5_bigip_mgmt_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.f5_query_name": { + "path_match": "ipfix.f5_query_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_dns_query_type": { + "path_match": "ipfix.f5_dns_query_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_context_name": { + "path_match": "ipfix.f5_context_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_bigip_hostname": { + "path_match": "ipfix.f5_bigip_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_device_vendor": { + "path_match": "ipfix.f5_device_vendor", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_device_product": { + "path_match": "ipfix.f5_device_product", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_device_ver": { + "path_match": "ipfix.f5_device_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_msg": { + "path_match": "ipfix.f5_msg", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_vlan": { + "path_match": "ipfix.f5_vlan", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_ipfix_msg_no": { + "path_match": "ipfix.f5_ipfix_msg_no", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_attack_id": { + "path_match": "ipfix.f5_attack_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_attack": { + "path_match": "ipfix.f5_attack", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_packets_rcvd": { + "path_match": "ipfix.f5_packets_rcvd", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_packets_drop": { + "path_match": "ipfix.f5_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_context_type": { + "path_match": "ipfix.f5_context_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_acl_policy_type": { + "path_match": "ipfix.f5_acl_policy_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_acl_policy": { + "path_match": "ipfix.f5_acl_policy", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_trans_ip_proto": { + "path_match": "ipfix.f5_trans_ip_proto", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_trans_src_ipv4_addr": { + "path_match": "ipfix.f5_trans_src_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.f5_trans_src_ipv6_addr": { + "path_match": "ipfix.f5_trans_src_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.f5_trans_src_port": { + "path_match": "ipfix.f5_trans_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_trans_dst_ipv4_addr": { + "path_match": "ipfix.f5_trans_dst_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.f5_trans_dst_ipv6_addr": { + "path_match": "ipfix.f5_trans_dst_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.f5_trans_dst_port": { + "path_match": "ipfix.f5_trans_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_trans_vlan": { + "path_match": "ipfix.f5_trans_vlan", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_trans_route_domain": { + "path_match": "ipfix.f5_trans_route_domain", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_sa_trans_type": { + "path_match": "ipfix.f5_sa_trans_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_sa_trans_pool": { + "path_match": "ipfix.f5_sa_trans_pool", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_acl_rule": { + "path_match": "ipfix.f5_acl_rule", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_action": { + "path_match": "ipfix.f5_action", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_drop_reason": { + "path_match": "ipfix.f5_drop_reason", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_attack_event": { + "path_match": "ipfix.f5_attack_event", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_ip_intel_threat_name": { + "path_match": "ipfix.f5_ip_intel_threat_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_destination_geo": { + "path_match": "ipfix.f5_destination_geo", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_source_geo": { + "path_match": "ipfix.f5_source_geo", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_ip_intel_policy_name": { + "path_match": "ipfix.f5_ip_intel_policy_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_attack_type": { + "path_match": "ipfix.f5_attack_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_app_category": { + "path_match": "ipfix.f5_app_category", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_classification": { + "path_match": "ipfix.f5_classification", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_flow_start_millis": { + "path_match": "ipfix.f5_flow_start_millis", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_flow_start_secs": { + "path_match": "ipfix.f5_flow_start_secs", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_flow_stop_millis": { + "path_match": "ipfix.f5_flow_stop_millis", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_flow_stop_secs": { + "path_match": "ipfix.f5_flow_stop_secs", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_record_type": { + "path_match": "ipfix.f5_record_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_report_id": { + "path_match": "ipfix.f5_report_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_report_ver": { + "path_match": "ipfix.f5_report_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_3gpp_params": { + "path_match": "ipfix.f5_3gpp_params", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_concurrent_flows": { + "path_match": "ipfix.f5_concurrent_flows", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_duration_secs": { + "path_match": "ipfix.f5_duration_secs", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_last_record_sent": { + "path_match": "ipfix.f5_last_record_sent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_new_flows": { + "path_match": "ipfix.f5_new_flows", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_record_reason": { + "path_match": "ipfix.f5_record_reason", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_success_transacts": { + "path_match": "ipfix.f5_success_transacts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_terminated_flows": { + "path_match": "ipfix.f5_terminated_flows", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_subscriber_id": { + "path_match": "ipfix.f5_subscriber_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_subscriber_id_type": { + "path_match": "ipfix.f5_subscriber_id_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_total_transacts": { + "path_match": "ipfix.f5_total_transacts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_http_hostname": { + "path_match": "ipfix.f5_http_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_http_hostname_trunc": { + "path_match": "ipfix.f5_http_hostname_trunc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_http_resp_code": { + "path_match": "ipfix.f5_http_resp_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_http_url": { + "path_match": "ipfix.f5_http_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_http_url_trunc": { + "path_match": "ipfix.f5_http_url_trunc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_http_user_agent": { + "path_match": "ipfix.f5_http_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_http_user_agent_trunc": { + "path_match": "ipfix.f5_http_user_agent_trunc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_transacts": { + "path_match": "ipfix.f5_transacts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_skipped_transacts": { + "path_match": "ipfix.f5_skipped_transacts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_transact_start_millis": { + "path_match": "ipfix.f5_transact_start_millis", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_transact_start_secs": { + "path_match": "ipfix.f5_transact_start_secs", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_transact_stop_millis": { + "path_match": "ipfix.f5_transact_stop_millis", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_transact_stop_secs": { + "path_match": "ipfix.f5_transact_stop_secs", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_url_category": { + "path_match": "ipfix.f5_url_category", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_downlink_volume": { + "path_match": "ipfix.f5_downlink_volume", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_uplink_volume": { + "path_match": "ipfix.f5_uplink_volume", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_observation_time_secs": { + "path_match": "ipfix.f5_observation_time_secs", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_timestamp_millis": { + "path_match": "ipfix.f5_timestamp_millis", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_vlan_id": { + "path_match": "ipfix.f5_vlan_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_source_user": { + "path_match": "ipfix.f5_source_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_log_profile": { + "path_match": "ipfix.f5_log_profile", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_log_msg_drops": { + "path_match": "ipfix.f5_log_msg_drops", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_log_msg_name": { + "path_match": "ipfix.f5_log_msg_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_src_fqdn": { + "path_match": "ipfix.f5_src_fqdn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_dst_fqdn": { + "path_match": "ipfix.f5_dst_fqdn", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.flowmon_http_hostname": { - "path_match": "ipfix.flowmon_http_hostname", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.flowmon_http_hostname": { + "path_match": "ipfix.flowmon_http_hostname", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.gigamon_http_req_url": { - "path_match": "ipfix.gigamon_http_req_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_http_resp_status": { - "path_match": "ipfix.gigamon_http_resp_status", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_ssl_cert_issuer_common": { - "path_match": "ipfix.gigamon_ssl_cert_issuer_common", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_subj_common": { - "path_match": "ipfix.gigamon_ssl_cert_subj_common", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_issuer": { - "path_match": "ipfix.gigamon_ssl_cert_issuer", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_subj": { - "path_match": "ipfix.gigamon_ssl_cert_subj", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_valid_not_before": { - "path_match": "ipfix.gigamon_ssl_cert_valid_not_before", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_valid_not_after": { - "path_match": "ipfix.gigamon_ssl_cert_valid_not_after", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_serial_num": { - "path_match": "ipfix.gigamon_ssl_cert_serial_num", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_sig_algo": { - "path_match": "ipfix.gigamon_ssl_cert_sig_algo", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_subj_pub_algo": { - "path_match": "ipfix.gigamon_ssl_cert_subj_pub_algo", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_subj_pubkey_size": { - "path_match": "ipfix.gigamon_ssl_cert_subj_pubkey_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_ssl_cert_subj_alt_name": { - "path_match": "ipfix.gigamon_ssl_cert_subj_alt_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_server_name_ind": { - "path_match": "ipfix.gigamon_ssl_server_name_ind", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_server_ver": { - "path_match": "ipfix.gigamon_ssl_server_ver", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_ssl_server_cipher": { - "path_match": "ipfix.gigamon_ssl_server_cipher", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_ssl_server_compress_method": { - "path_match": "ipfix.gigamon_ssl_server_compress_method", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_ssl_server_sess_id": { - "path_match": "ipfix.gigamon_ssl_server_sess_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_dns_id": { - "path_match": "ipfix.gigamon_dns_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_op_code": { - "path_match": "ipfix.gigamon_dns_op_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_resp_code": { - "path_match": "ipfix.gigamon_dns_resp_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_query": { - "path_match": "ipfix.gigamon_dns_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_dns_resp": { - "path_match": "ipfix.gigamon_dns_resp", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_dns_resp_ttl": { - "path_match": "ipfix.gigamon_dns_resp_ttl", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_resp_ipv4_addr": { - "path_match": "ipfix.gigamon_dns_resp_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.gigamon_dns_resp_ipv6_addr": { - "path_match": "ipfix.gigamon_dns_resp_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.gigamon_dns_bits": { - "path_match": "ipfix.gigamon_dns_bits", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_dns_qd_count": { - "path_match": "ipfix.gigamon_dns_qd_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_an_count": { - "path_match": "ipfix.gigamon_dns_an_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_ns_count": { - "path_match": "ipfix.gigamon_dns_ns_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_ar_count": { - "path_match": "ipfix.gigamon_dns_ar_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_query_type": { - "path_match": "ipfix.gigamon_dns_query_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_query_class": { - "path_match": "ipfix.gigamon_dns_query_class", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_resp_type": { - "path_match": "ipfix.gigamon_dns_resp_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_resp_class": { - "path_match": "ipfix.gigamon_dns_resp_class", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_resp_rd_len": { - "path_match": "ipfix.gigamon_dns_resp_rd_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_resp_rdata": { - "path_match": "ipfix.gigamon_dns_resp_rdata", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_dns_auth_name": { - "path_match": "ipfix.gigamon_dns_auth_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_dns_auth_type": { - "path_match": "ipfix.gigamon_dns_auth_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_auth_class": { - "path_match": "ipfix.gigamon_dns_auth_class", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_auth_ttl": { - "path_match": "ipfix.gigamon_dns_auth_ttl", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_auth_rd_len": { - "path_match": "ipfix.gigamon_dns_auth_rd_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_authority_rdata": { - "path_match": "ipfix.gigamon_dns_authority_rdata", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_dns_addl_name": { - "path_match": "ipfix.gigamon_dns_addl_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_dns_addl_type": { - "path_match": "ipfix.gigamon_dns_addl_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_addl_class": { - "path_match": "ipfix.gigamon_dns_addl_class", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_addl_ttl": { - "path_match": "ipfix.gigamon_dns_addl_ttl", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_addl_rd_len": { - "path_match": "ipfix.gigamon_dns_addl_rd_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_addl_rdata": { - "path_match": "ipfix.gigamon_dns_addl_rdata", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.gigamon_http_req_url": { + "path_match": "ipfix.gigamon_http_req_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_http_resp_status": { + "path_match": "ipfix.gigamon_http_resp_status", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_ssl_cert_issuer_common": { + "path_match": "ipfix.gigamon_ssl_cert_issuer_common", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_subj_common": { + "path_match": "ipfix.gigamon_ssl_cert_subj_common", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_issuer": { + "path_match": "ipfix.gigamon_ssl_cert_issuer", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_subj": { + "path_match": "ipfix.gigamon_ssl_cert_subj", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_valid_not_before": { + "path_match": "ipfix.gigamon_ssl_cert_valid_not_before", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_valid_not_after": { + "path_match": "ipfix.gigamon_ssl_cert_valid_not_after", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_serial_num": { + "path_match": "ipfix.gigamon_ssl_cert_serial_num", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_sig_algo": { + "path_match": "ipfix.gigamon_ssl_cert_sig_algo", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_subj_pub_algo": { + "path_match": "ipfix.gigamon_ssl_cert_subj_pub_algo", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_subj_pubkey_size": { + "path_match": "ipfix.gigamon_ssl_cert_subj_pubkey_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_ssl_cert_subj_alt_name": { + "path_match": "ipfix.gigamon_ssl_cert_subj_alt_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_server_name_ind": { + "path_match": "ipfix.gigamon_ssl_server_name_ind", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_server_ver": { + "path_match": "ipfix.gigamon_ssl_server_ver", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_ssl_server_cipher": { + "path_match": "ipfix.gigamon_ssl_server_cipher", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_ssl_server_compress_method": { + "path_match": "ipfix.gigamon_ssl_server_compress_method", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_ssl_server_sess_id": { + "path_match": "ipfix.gigamon_ssl_server_sess_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_dns_id": { + "path_match": "ipfix.gigamon_dns_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_op_code": { + "path_match": "ipfix.gigamon_dns_op_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_resp_code": { + "path_match": "ipfix.gigamon_dns_resp_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_query": { + "path_match": "ipfix.gigamon_dns_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_dns_resp": { + "path_match": "ipfix.gigamon_dns_resp", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_dns_resp_ttl": { + "path_match": "ipfix.gigamon_dns_resp_ttl", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_resp_ipv4_addr": { + "path_match": "ipfix.gigamon_dns_resp_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.gigamon_dns_resp_ipv6_addr": { + "path_match": "ipfix.gigamon_dns_resp_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.gigamon_dns_bits": { + "path_match": "ipfix.gigamon_dns_bits", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_dns_qd_count": { + "path_match": "ipfix.gigamon_dns_qd_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_an_count": { + "path_match": "ipfix.gigamon_dns_an_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_ns_count": { + "path_match": "ipfix.gigamon_dns_ns_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_ar_count": { + "path_match": "ipfix.gigamon_dns_ar_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_query_type": { + "path_match": "ipfix.gigamon_dns_query_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_query_class": { + "path_match": "ipfix.gigamon_dns_query_class", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_resp_type": { + "path_match": "ipfix.gigamon_dns_resp_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_resp_class": { + "path_match": "ipfix.gigamon_dns_resp_class", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_resp_rd_len": { + "path_match": "ipfix.gigamon_dns_resp_rd_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_resp_rdata": { + "path_match": "ipfix.gigamon_dns_resp_rdata", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_dns_auth_name": { + "path_match": "ipfix.gigamon_dns_auth_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_dns_auth_type": { + "path_match": "ipfix.gigamon_dns_auth_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_auth_class": { + "path_match": "ipfix.gigamon_dns_auth_class", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_auth_ttl": { + "path_match": "ipfix.gigamon_dns_auth_ttl", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_auth_rd_len": { + "path_match": "ipfix.gigamon_dns_auth_rd_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_authority_rdata": { + "path_match": "ipfix.gigamon_dns_authority_rdata", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_dns_addl_name": { + "path_match": "ipfix.gigamon_dns_addl_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_dns_addl_type": { + "path_match": "ipfix.gigamon_dns_addl_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_addl_class": { + "path_match": "ipfix.gigamon_dns_addl_class", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_addl_ttl": { + "path_match": "ipfix.gigamon_dns_addl_ttl", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_addl_rd_len": { + "path_match": "ipfix.gigamon_dns_addl_rd_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_addl_rdata": { + "path_match": "ipfix.gigamon_dns_addl_rdata", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.ipt_mark": { - "path_match": "ipfix.ipt_mark", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipt_conntrack_id": { - "path_match": "ipfix.ipt_conntrack_id", - "mapping": { - "type": "long" - } - } - }, + { + "ipfix.ipt_mark": { + "path_match": "ipfix.ipt_mark", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipt_conntrack_id": { + "path_match": "ipfix.ipt_conntrack_id", + "mapping": { + "type": "long" + } + } + }, - - { - "ipfix.ixia_l7_app_id": { - "path_match": "ipfix.ixia_l7_app_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ixia_l7_app": { - "path_match": "ipfix.ixia_l7_app", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_src_country_code": { - "path_match": "ipfix.ixia_src_country_code", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_src_country": { - "path_match": "ipfix.ixia_src_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_src_region_code": { - "path_match": "ipfix.ixia_src_region_code", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_src_region": { - "path_match": "ipfix.ixia_src_region", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_src_city": { - "path_match": "ipfix.ixia_src_city", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_src_latitude": { - "path_match": "ipfix.ixia_src_latitude", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.ixia_src_longitude": { - "path_match": "ipfix.ixia_src_longitude", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.ixia_dst_country_code": { - "path_match": "ipfix.ixia_dst_country_code", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dst_country": { - "path_match": "ipfix.ixia_dst_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dst_region_code": { - "path_match": "ipfix.ixia_dst_region_code", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dst_region": { - "path_match": "ipfix.ixia_dst_region", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dst_city": { - "path_match": "ipfix.ixia_dst_city", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dst_latitude": { - "path_match": "ipfix.ixia_dst_latitude", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.ixia_dst_longitude": { - "path_match": "ipfix.ixia_dst_longitude", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.ixia_device_id": { - "path_match": "ipfix.ixia_device_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ixia_device": { - "path_match": "ipfix.ixia_device", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_browser_id": { - "path_match": "ipfix.ixia_browser_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ixia_browser": { - "path_match": "ipfix.ixia_browser", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_rev_bytes_delta": { - "path_match": "ipfix.ixia_rev_bytes_delta", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ixia_rev_packets_delta": { - "path_match": "ipfix.ixia_rev_packets_delta", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ixia_encrypt_type": { - "path_match": "ipfix.ixia_encrypt_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_encrypt_cipher": { - "path_match": "ipfix.ixia_encrypt_cipher", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_encrypt_key_len": { - "path_match": "ipfix.ixia_encrypt_key_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ixia_imsi_subscriber": { - "path_match": "ipfix.ixia_imsi_subscriber", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_http_user_agent": { - "path_match": "ipfix.ixia_http_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_http_hostname": { - "path_match": "ipfix.ixia_http_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_http_uri": { - "path_match": "ipfix.ixia_http_uri", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dns_record_txt": { - "path_match": "ipfix.ixia_dns_record_txt", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_src_as": { - "path_match": "ipfix.ixia_src_as", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dst_as": { - "path_match": "ipfix.ixia_dst_as", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_latency": { - "path_match": "ipfix.ixia_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ixia_dns_query": { - "path_match": "ipfix.ixia_dns_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dns_answer": { - "path_match": "ipfix.ixia_dns_answer", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dns_classes": { - "path_match": "ipfix.ixia_dns_classes", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_threat_type": { - "path_match": "ipfix.ixia_threat_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_threat_ipv4": { - "path_match": "ipfix.ixia_threat_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ixia_threat_ipv6": { - "path_match": "ipfix.ixia_threat_ipv6", - "mapping": { - "type": "ip" - } - } - }, + + { + "ipfix.ixia_l7_app_id": { + "path_match": "ipfix.ixia_l7_app_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ixia_l7_app": { + "path_match": "ipfix.ixia_l7_app", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_src_country_code": { + "path_match": "ipfix.ixia_src_country_code", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_src_country": { + "path_match": "ipfix.ixia_src_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_src_region_code": { + "path_match": "ipfix.ixia_src_region_code", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_src_region": { + "path_match": "ipfix.ixia_src_region", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_src_city": { + "path_match": "ipfix.ixia_src_city", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_src_latitude": { + "path_match": "ipfix.ixia_src_latitude", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.ixia_src_longitude": { + "path_match": "ipfix.ixia_src_longitude", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.ixia_dst_country_code": { + "path_match": "ipfix.ixia_dst_country_code", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dst_country": { + "path_match": "ipfix.ixia_dst_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dst_region_code": { + "path_match": "ipfix.ixia_dst_region_code", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dst_region": { + "path_match": "ipfix.ixia_dst_region", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dst_city": { + "path_match": "ipfix.ixia_dst_city", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dst_latitude": { + "path_match": "ipfix.ixia_dst_latitude", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.ixia_dst_longitude": { + "path_match": "ipfix.ixia_dst_longitude", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.ixia_device_id": { + "path_match": "ipfix.ixia_device_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ixia_device": { + "path_match": "ipfix.ixia_device", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_browser_id": { + "path_match": "ipfix.ixia_browser_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ixia_browser": { + "path_match": "ipfix.ixia_browser", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_rev_bytes_delta": { + "path_match": "ipfix.ixia_rev_bytes_delta", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ixia_rev_packets_delta": { + "path_match": "ipfix.ixia_rev_packets_delta", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ixia_encrypt_type": { + "path_match": "ipfix.ixia_encrypt_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_encrypt_cipher": { + "path_match": "ipfix.ixia_encrypt_cipher", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_encrypt_key_len": { + "path_match": "ipfix.ixia_encrypt_key_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ixia_imsi_subscriber": { + "path_match": "ipfix.ixia_imsi_subscriber", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_http_user_agent": { + "path_match": "ipfix.ixia_http_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_http_hostname": { + "path_match": "ipfix.ixia_http_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_http_uri": { + "path_match": "ipfix.ixia_http_uri", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dns_record_txt": { + "path_match": "ipfix.ixia_dns_record_txt", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_src_as": { + "path_match": "ipfix.ixia_src_as", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dst_as": { + "path_match": "ipfix.ixia_dst_as", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_latency": { + "path_match": "ipfix.ixia_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ixia_dns_query": { + "path_match": "ipfix.ixia_dns_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dns_answer": { + "path_match": "ipfix.ixia_dns_answer", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dns_classes": { + "path_match": "ipfix.ixia_dns_classes", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_threat_type": { + "path_match": "ipfix.ixia_threat_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_threat_ipv4": { + "path_match": "ipfix.ixia_threat_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ixia_threat_ipv6": { + "path_match": "ipfix.ixia_threat_ipv6", + "mapping": { + "type": "ip" + } + } + }, - { - "ipfix.netscaler_rtt": { - "path_match": "ipfix.netscaler_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_trans_id": { - "path_match": "ipfix.netscaler_trans_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_req_url": { - "path_match": "ipfix.netscaler_http_req_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_req_cookie": { - "path_match": "ipfix.netscaler_http_req_cookie", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_flow_flags": { - "path_match": "ipfix.netscaler_flow_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_conn_id": { - "path_match": "ipfix.netscaler_conn_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_syslog_pri": { - "path_match": "ipfix.netscaler_syslog_pri", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_syslog_msg": { - "path_match": "ipfix.netscaler_syslog_msg", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_syslog_timestamp": { - "path_match": "ipfix.netscaler_syslog_timestamp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_req_referrer": { - "path_match": "ipfix.netscaler_http_req_referrer", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_req_method": { - "path_match": "ipfix.netscaler_http_req_method", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_req_host": { - "path_match": "ipfix.netscaler_http_req_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_req_user_agent": { - "path_match": "ipfix.netscaler_http_req_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_resp_status": { - "path_match": "ipfix.netscaler_http_resp_status", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_resp_len": { - "path_match": "ipfix.netscaler_http_resp_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_server_ttfb": { - "path_match": "ipfix.netscaler_server_ttfb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_server_ttlb": { - "path_match": "ipfix.netscaler_server_ttlb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_app_incarnations": { - "path_match": "ipfix.netscaler_app_incarnations", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_app_id": { - "path_match": "ipfix.netscaler_app_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_app": { - "path_match": "ipfix.netscaler_app", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_req_rcv_fb": { - "path_match": "ipfix.netscaler_http_req_rcv_fb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_req_forw_fb": { - "path_match": "ipfix.netscaler_http_req_forw_fb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_res_rcv_fb": { - "path_match": "ipfix.netscaler_http_res_rcv_fb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_res_forw_fb": { - "path_match": "ipfix.netscaler_http_res_forw_fb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_req_rcv_lb": { - "path_match": "ipfix.netscaler_http_req_rcv_lb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_req_forw_lb": { - "path_match": "ipfix.netscaler_http_req_forw_lb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_main_page_id": { - "path_match": "ipfix.netscaler_main_page_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_main_page_core_id": { - "path_match": "ipfix.netscaler_main_page_core_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_client_interact_start_time": { - "path_match": "ipfix.netscaler_http_client_interact_start_time", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_client_render_end_time": { - "path_match": "ipfix.netscaler_http_client_render_end_time", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_client_render_start_time": { - "path_match": "ipfix.netscaler_http_client_render_start_time", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_app_template": { - "path_match": "ipfix.netscaler_app_template", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_client_interact_end_time": { - "path_match": "ipfix.netscaler_http_client_interact_end_time", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_res_rcv_lb": { - "path_match": "ipfix.netscaler_http_res_rcv_lb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_res_forw_lb": { - "path_match": "ipfix.netscaler_http_res_forw_lb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_app_unit_app_id": { - "path_match": "ipfix.netscaler_app_unit_app_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_db_login_flags": { - "path_match": "ipfix.netscaler_db_login_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_db_req_type": { - "path_match": "ipfix.netscaler_db_req_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_db_proto": { - "path_match": "ipfix.netscaler_db_proto", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_db_user": { - "path_match": "ipfix.netscaler_db_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_db_database": { - "path_match": "ipfix.netscaler_db_database", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_db_client_hostname": { - "path_match": "ipfix.netscaler_db_client_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_db_req_string": { - "path_match": "ipfix.netscaler_db_req_string", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_db_resp_status_string": { - "path_match": "ipfix.netscaler_db_resp_status_string", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_db_resp_status": { - "path_match": "ipfix.netscaler_db_resp_status", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_db_resp_len": { - "path_match": "ipfix.netscaler_db_resp_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_client_rtt": { - "path_match": "ipfix.netscaler_client_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_content_type": { - "path_match": "ipfix.netscaler_http_content_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_req_auth": { - "path_match": "ipfix.netscaler_http_req_auth", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_req_via": { - "path_match": "ipfix.netscaler_http_req_via", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_res_location": { - "path_match": "ipfix.netscaler_http_res_location", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_res_set_cookie": { - "path_match": "ipfix.netscaler_http_res_set_cookie", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_res_set_cookie2": { - "path_match": "ipfix.netscaler_http_res_set_cookie2", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_req_x_forwarded_for": { - "path_match": "ipfix.netscaler_http_req_x_forwarded_for", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_conn_chain_id": { - "path_match": "ipfix.netscaler_conn_chain_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_conn_chain_hop_count": { - "path_match": "ipfix.netscaler_conn_chain_hop_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_sess_guid": { - "path_match": "ipfix.netscaler_ica_sess_guid", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_ica_client_ver": { - "path_match": "ipfix.netscaler_ica_client_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_ica_client_type": { - "path_match": "ipfix.netscaler_ica_client_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_client_ip": { - "path_match": "ipfix.netscaler_ica_client_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.netscaler_ica_client_hostname": { - "path_match": "ipfix.netscaler_ica_client_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_aaa_user": { - "path_match": "ipfix.netscaler_aaa_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_ica_domain": { - "path_match": "ipfix.netscaler_ica_domain", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_ica_client_launcher": { - "path_match": "ipfix.netscaler_ica_client_launcher", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_sess_setup_time": { - "path_match": "ipfix.netscaler_ica_sess_setup_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_server": { - "path_match": "ipfix.netscaler_ica_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_ica_sess_reconnects": { - "path_match": "ipfix.netscaler_ica_sess_reconnects", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_rtt": { - "path_match": "ipfix.netscaler_ica_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_rx_bytes": { - "path_match": "ipfix.netscaler_ica_clientside_rx_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_tx_bytes": { - "path_match": "ipfix.netscaler_ica_clientside_tx_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_packets_retrans": { - "path_match": "ipfix.netscaler_ica_clientside_packets_retrans", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_serverside_packets_retrans": { - "path_match": "ipfix.netscaler_ica_serverside_packets_retrans", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_rtt": { - "path_match": "ipfix.netscaler_ica_clientside_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_serverside_rtt": { - "path_match": "ipfix.netscaler_ica_serverside_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_sess_update_begin_sec": { - "path_match": "ipfix.netscaler_ica_sess_update_begin_sec", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_sess_update_end_sec": { - "path_match": "ipfix.netscaler_ica_sess_update_end_sec", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id1": { - "path_match": "ipfix.netscaler_ica_channel_id1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id1_bytes": { - "path_match": "ipfix.netscaler_ica_channel_id1_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id2": { - "path_match": "ipfix.netscaler_ica_channel_id2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id2_bytes": { - "path_match": "ipfix.netscaler_ica_channel_id2_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id3": { - "path_match": "ipfix.netscaler_ica_channel_id3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id3_bytes": { - "path_match": "ipfix.netscaler_ica_channel_id3_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id4": { - "path_match": "ipfix.netscaler_ica_channel_id4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id4_bytes": { - "path_match": "ipfix.netscaler_ica_channel_id4_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id5": { - "path_match": "ipfix.netscaler_ica_channel_id5", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id5_bytes": { - "path_match": "ipfix.netscaler_ica_channel_id5_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_conn_pri": { - "path_match": "ipfix.netscaler_ica_conn_pri", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_app_start_duration": { - "path_match": "ipfix.netscaler_app_start_duration", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_launch_mechanism": { - "path_match": "ipfix.netscaler_ica_launch_mechanism", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_app": { - "path_match": "ipfix.netscaler_ica_app", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_app_start_time": { - "path_match": "ipfix.netscaler_app_start_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_app_term_type": { - "path_match": "ipfix.netscaler_ica_app_term_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_app_term_time": { - "path_match": "ipfix.netscaler_ica_app_term_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_sess_end_time": { - "path_match": "ipfix.netscaler_ica_sess_end_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_jitter": { - "path_match": "ipfix.netscaler_ica_clientside_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_serverside_jitter": { - "path_match": "ipfix.netscaler_ica_serverside_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_app_pid": { - "path_match": "ipfix.netscaler_ica_app_pid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_app_module_path": { - "path_match": "ipfix.netscaler_ica_app_module_path", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_ica_device_serial_no": { - "path_match": "ipfix.netscaler_ica_device_serial_no", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_msi_client_cookie": { - "path_match": "ipfix.netscaler_msi_client_cookie", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_ica_flags": { - "path_match": "ipfix.netscaler_ica_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_user": { - "path_match": "ipfix.netscaler_ica_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_license_type": { - "path_match": "ipfix.netscaler_license_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_max_licenses": { - "path_match": "ipfix.netscaler_max_licenses", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_licenses_used": { - "path_match": "ipfix.netscaler_licenses_used", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_network_update_start_time": { - "path_match": "ipfix.netscaler_ica_network_update_start_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_network_update_end_time": { - "path_match": "ipfix.netscaler_ica_network_update_end_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_srtt": { - "path_match": "ipfix.netscaler_ica_clientside_srtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_serverside_srtt": { - "path_match": "ipfix.netscaler_ica_serverside_srtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_delay": { - "path_match": "ipfix.netscaler_ica_clientside_delay", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_serverside_delay": { - "path_match": "ipfix.netscaler_ica_serverside_delay", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_host_delay": { - "path_match": "ipfix.netscaler_ica_host_delay", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_window_size": { - "path_match": "ipfix.netscaler_ica_clientside_window_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_serverside_window_size": { - "path_match": "ipfix.netscaler_ica_serverside_window_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_rto_count": { - "path_match": "ipfix.netscaler_ica_clientside_rto_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_serverside_rto_count": { - "path_match": "ipfix.netscaler_ica_serverside_rto_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_l7_client_latency": { - "path_match": "ipfix.netscaler_ica_l7_client_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_l7_server_latency": { - "path_match": "ipfix.netscaler_ica_l7_server_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_domain": { - "path_match": "ipfix.netscaler_http_domain", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_cache_redir_client_conn_core_id": { - "path_match": "ipfix.netscaler_cache_redir_client_conn_core_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_cache_redir_client_conn_trans_id": { - "path_match": "ipfix.netscaler_cache_redir_client_conn_trans_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_270": { - "path_match": "ipfix.netscaler_unk_270", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_271": { - "path_match": "ipfix.netscaler_unk_271", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_272": { - "path_match": "ipfix.netscaler_unk_272", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_273": { - "path_match": "ipfix.netscaler_unk_273", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_274": { - "path_match": "ipfix.netscaler_unk_274", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_275": { - "path_match": "ipfix.netscaler_unk_275", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_276": { - "path_match": "ipfix.netscaler_unk_276", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_277": { - "path_match": "ipfix.netscaler_unk_277", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_278": { - "path_match": "ipfix.netscaler_unk_278", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_279": { - "path_match": "ipfix.netscaler_unk_279", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_280": { - "path_match": "ipfix.netscaler_unk_280", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_281": { - "path_match": "ipfix.netscaler_unk_281", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_282": { - "path_match": "ipfix.netscaler_unk_282", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_283": { - "path_match": "ipfix.netscaler_unk_283", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_284": { - "path_match": "ipfix.netscaler_unk_284", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_285": { - "path_match": "ipfix.netscaler_unk_285", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_286": { - "path_match": "ipfix.netscaler_unk_286", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_287": { - "path_match": "ipfix.netscaler_unk_287", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_288": { - "path_match": "ipfix.netscaler_unk_288", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_289": { - "path_match": "ipfix.netscaler_unk_289", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_290": { - "path_match": "ipfix.netscaler_unk_290", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_291": { - "path_match": "ipfix.netscaler_unk_291", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_292": { - "path_match": "ipfix.netscaler_unk_292", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_293": { - "path_match": "ipfix.netscaler_unk_293", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_294": { - "path_match": "ipfix.netscaler_unk_294", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_295": { - "path_match": "ipfix.netscaler_unk_295", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_296": { - "path_match": "ipfix.netscaler_unk_296", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_297": { - "path_match": "ipfix.netscaler_unk_297", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_298": { - "path_match": "ipfix.netscaler_unk_298", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_299": { - "path_match": "ipfix.netscaler_unk_299", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_300": { - "path_match": "ipfix.netscaler_unk_300", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_301": { - "path_match": "ipfix.netscaler_unk_301", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_302": { - "path_match": "ipfix.netscaler_unk_302", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_303": { - "path_match": "ipfix.netscaler_unk_303", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_304": { - "path_match": "ipfix.netscaler_unk_304", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_305": { - "path_match": "ipfix.netscaler_unk_305", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_306": { - "path_match": "ipfix.netscaler_unk_306", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_307": { - "path_match": "ipfix.netscaler_unk_307", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_308": { - "path_match": "ipfix.netscaler_unk_308", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_309": { - "path_match": "ipfix.netscaler_unk_309", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_310": { - "path_match": "ipfix.netscaler_unk_310", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_311": { - "path_match": "ipfix.netscaler_unk_311", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_312": { - "path_match": "ipfix.netscaler_unk_312", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_313": { - "path_match": "ipfix.netscaler_unk_313", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_314": { - "path_match": "ipfix.netscaler_unk_314", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_315": { - "path_match": "ipfix.netscaler_unk_315", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_316": { - "path_match": "ipfix.netscaler_unk_316", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_317": { - "path_match": "ipfix.netscaler_unk_317", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_318": { - "path_match": "ipfix.netscaler_unk_318", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_319": { - "path_match": "ipfix.netscaler_unk_319", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_320": { - "path_match": "ipfix.netscaler_unk_320", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_321": { - "path_match": "ipfix.netscaler_unk_321", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_322": { - "path_match": "ipfix.netscaler_unk_322", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_323": { - "path_match": "ipfix.netscaler_unk_323", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_324": { - "path_match": "ipfix.netscaler_unk_324", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_325": { - "path_match": "ipfix.netscaler_unk_325", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_326": { - "path_match": "ipfix.netscaler_unk_326", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_327": { - "path_match": "ipfix.netscaler_unk_327", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_328": { - "path_match": "ipfix.netscaler_unk_328", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_329": { - "path_match": "ipfix.netscaler_unk_329", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_330": { - "path_match": "ipfix.netscaler_unk_330", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_331": { - "path_match": "ipfix.netscaler_unk_331", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_332": { - "path_match": "ipfix.netscaler_unk_332", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_333": { - "path_match": "ipfix.netscaler_unk_333", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_334": { - "path_match": "ipfix.netscaler_unk_334", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_335": { - "path_match": "ipfix.netscaler_unk_335", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_336": { - "path_match": "ipfix.netscaler_unk_336", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_337": { - "path_match": "ipfix.netscaler_unk_337", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_338": { - "path_match": "ipfix.netscaler_unk_338", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_339": { - "path_match": "ipfix.netscaler_unk_339", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_340": { - "path_match": "ipfix.netscaler_unk_340", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_341": { - "path_match": "ipfix.netscaler_unk_341", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_342": { - "path_match": "ipfix.netscaler_unk_342", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_343": { - "path_match": "ipfix.netscaler_unk_343", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_344": { - "path_match": "ipfix.netscaler_unk_344", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_345": { - "path_match": "ipfix.netscaler_unk_345", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_346": { - "path_match": "ipfix.netscaler_unk_346", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_347": { - "path_match": "ipfix.netscaler_unk_347", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_348": { - "path_match": "ipfix.netscaler_unk_348", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_349": { - "path_match": "ipfix.netscaler_unk_349", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_350": { - "path_match": "ipfix.netscaler_unk_350", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_351": { - "path_match": "ipfix.netscaler_unk_351", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_352": { - "path_match": "ipfix.netscaler_unk_352", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_353": { - "path_match": "ipfix.netscaler_unk_353", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_354": { - "path_match": "ipfix.netscaler_unk_354", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_355": { - "path_match": "ipfix.netscaler_unk_355", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_356": { - "path_match": "ipfix.netscaler_unk_356", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_357": { - "path_match": "ipfix.netscaler_unk_357", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_358": { - "path_match": "ipfix.netscaler_unk_358", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_359": { - "path_match": "ipfix.netscaler_unk_359", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_360": { - "path_match": "ipfix.netscaler_unk_360", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_361": { - "path_match": "ipfix.netscaler_unk_361", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_362": { - "path_match": "ipfix.netscaler_unk_362", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_363": { - "path_match": "ipfix.netscaler_unk_363", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_364": { - "path_match": "ipfix.netscaler_unk_364", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_365": { - "path_match": "ipfix.netscaler_unk_365", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_366": { - "path_match": "ipfix.netscaler_unk_366", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_367": { - "path_match": "ipfix.netscaler_unk_367", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_377": { - "path_match": "ipfix.netscaler_unk_377", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_380": { - "path_match": "ipfix.netscaler_unk_380", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_383": { - "path_match": "ipfix.netscaler_unk_383", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_384": { - "path_match": "ipfix.netscaler_unk_384", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_385": { - "path_match": "ipfix.netscaler_unk_385", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_386": { - "path_match": "ipfix.netscaler_unk_386", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_387": { - "path_match": "ipfix.netscaler_unk_387", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_388": { - "path_match": "ipfix.netscaler_unk_388", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_389": { - "path_match": "ipfix.netscaler_unk_389", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_391": { - "path_match": "ipfix.netscaler_unk_391", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_392": { - "path_match": "ipfix.netscaler_unk_392", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_393": { - "path_match": "ipfix.netscaler_unk_393", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_394": { - "path_match": "ipfix.netscaler_unk_394", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_398": { - "path_match": "ipfix.netscaler_unk_398", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_399": { - "path_match": "ipfix.netscaler_unk_399", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_400": { - "path_match": "ipfix.netscaler_unk_400", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_401": { - "path_match": "ipfix.netscaler_unk_401", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_402": { - "path_match": "ipfix.netscaler_unk_402", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_403": { - "path_match": "ipfix.netscaler_unk_403", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_404": { - "path_match": "ipfix.netscaler_unk_404", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_405": { - "path_match": "ipfix.netscaler_unk_405", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_408": { - "path_match": "ipfix.netscaler_unk_408", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_427": { - "path_match": "ipfix.netscaler_unk_427", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_429": { - "path_match": "ipfix.netscaler_unk_429", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_432": { - "path_match": "ipfix.netscaler_unk_432", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_433": { - "path_match": "ipfix.netscaler_unk_433", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_434": { - "path_match": "ipfix.netscaler_unk_434", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_435": { - "path_match": "ipfix.netscaler_unk_435", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_447": { - "path_match": "ipfix.netscaler_unk_447", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_448": { - "path_match": "ipfix.netscaler_unk_448", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_451": { - "path_match": "ipfix.netscaler_unk_451", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_452": { - "path_match": "ipfix.netscaler_unk_452", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_453": { - "path_match": "ipfix.netscaler_unk_453", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_455": { - "path_match": "ipfix.netscaler_unk_455", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_458": { - "path_match": "ipfix.netscaler_unk_458", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_459": { - "path_match": "ipfix.netscaler_unk_459", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_460": { - "path_match": "ipfix.netscaler_unk_460", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_461": { - "path_match": "ipfix.netscaler_unk_461", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_463": { - "path_match": "ipfix.netscaler_unk_463", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_464": { - "path_match": "ipfix.netscaler_unk_464", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_465": { - "path_match": "ipfix.netscaler_unk_465", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_466": { - "path_match": "ipfix.netscaler_unk_466", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_467": { - "path_match": "ipfix.netscaler_unk_467", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_468": { - "path_match": "ipfix.netscaler_unk_468", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_475": { - "path_match": "ipfix.netscaler_unk_475", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_476": { - "path_match": "ipfix.netscaler_unk_476", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_477": { - "path_match": "ipfix.netscaler_unk_477", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_478": { - "path_match": "ipfix.netscaler_unk_478", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_479": { - "path_match": "ipfix.netscaler_unk_479", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_480": { - "path_match": "ipfix.netscaler_unk_480", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_481": { - "path_match": "ipfix.netscaler_unk_481", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_487": { - "path_match": "ipfix.netscaler_unk_487", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_488": { - "path_match": "ipfix.netscaler_unk_488", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_489": { - "path_match": "ipfix.netscaler_unk_489", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_491": { - "path_match": "ipfix.netscaler_unk_491", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_492": { - "path_match": "ipfix.netscaler_unk_492", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_493": { - "path_match": "ipfix.netscaler_unk_493", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_494": { - "path_match": "ipfix.netscaler_unk_494", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_507": { - "path_match": "ipfix.netscaler_unk_507", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_508": { - "path_match": "ipfix.netscaler_unk_508", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_509": { - "path_match": "ipfix.netscaler_unk_509", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_510": { - "path_match": "ipfix.netscaler_unk_510", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_511": { - "path_match": "ipfix.netscaler_unk_511", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_512": { - "path_match": "ipfix.netscaler_unk_512", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_513": { - "path_match": "ipfix.netscaler_unk_513", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_514": { - "path_match": "ipfix.netscaler_unk_514", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_518": { - "path_match": "ipfix.netscaler_unk_518", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_519": { - "path_match": "ipfix.netscaler_unk_519", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_520": { - "path_match": "ipfix.netscaler_unk_520", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_521": { - "path_match": "ipfix.netscaler_unk_521", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_522": { - "path_match": "ipfix.netscaler_unk_522", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_523": { - "path_match": "ipfix.netscaler_unk_523", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_532": { - "path_match": "ipfix.netscaler_unk_532", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_533": { - "path_match": "ipfix.netscaler_unk_533", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_534": { - "path_match": "ipfix.netscaler_unk_534", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_535": { - "path_match": "ipfix.netscaler_unk_535", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_536": { - "path_match": "ipfix.netscaler_unk_536", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_537": { - "path_match": "ipfix.netscaler_unk_537", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_538": { - "path_match": "ipfix.netscaler_unk_538", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_541": { - "path_match": "ipfix.netscaler_unk_541", - "mapping": { - "type": "long" - } - } - }, + { + "ipfix.netscaler_rtt": { + "path_match": "ipfix.netscaler_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_trans_id": { + "path_match": "ipfix.netscaler_trans_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_req_url": { + "path_match": "ipfix.netscaler_http_req_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_req_cookie": { + "path_match": "ipfix.netscaler_http_req_cookie", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_flow_flags": { + "path_match": "ipfix.netscaler_flow_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_conn_id": { + "path_match": "ipfix.netscaler_conn_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_syslog_pri": { + "path_match": "ipfix.netscaler_syslog_pri", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_syslog_msg": { + "path_match": "ipfix.netscaler_syslog_msg", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_syslog_timestamp": { + "path_match": "ipfix.netscaler_syslog_timestamp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_req_referrer": { + "path_match": "ipfix.netscaler_http_req_referrer", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_req_method": { + "path_match": "ipfix.netscaler_http_req_method", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_req_host": { + "path_match": "ipfix.netscaler_http_req_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_req_user_agent": { + "path_match": "ipfix.netscaler_http_req_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_resp_status": { + "path_match": "ipfix.netscaler_http_resp_status", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_resp_len": { + "path_match": "ipfix.netscaler_http_resp_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_server_ttfb": { + "path_match": "ipfix.netscaler_server_ttfb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_server_ttlb": { + "path_match": "ipfix.netscaler_server_ttlb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_app_incarnations": { + "path_match": "ipfix.netscaler_app_incarnations", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_app_id": { + "path_match": "ipfix.netscaler_app_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_app": { + "path_match": "ipfix.netscaler_app", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_req_rcv_fb": { + "path_match": "ipfix.netscaler_http_req_rcv_fb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_req_forw_fb": { + "path_match": "ipfix.netscaler_http_req_forw_fb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_res_rcv_fb": { + "path_match": "ipfix.netscaler_http_res_rcv_fb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_res_forw_fb": { + "path_match": "ipfix.netscaler_http_res_forw_fb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_req_rcv_lb": { + "path_match": "ipfix.netscaler_http_req_rcv_lb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_req_forw_lb": { + "path_match": "ipfix.netscaler_http_req_forw_lb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_main_page_id": { + "path_match": "ipfix.netscaler_main_page_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_main_page_core_id": { + "path_match": "ipfix.netscaler_main_page_core_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_client_interact_start_time": { + "path_match": "ipfix.netscaler_http_client_interact_start_time", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_client_render_end_time": { + "path_match": "ipfix.netscaler_http_client_render_end_time", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_client_render_start_time": { + "path_match": "ipfix.netscaler_http_client_render_start_time", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_app_template": { + "path_match": "ipfix.netscaler_app_template", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_client_interact_end_time": { + "path_match": "ipfix.netscaler_http_client_interact_end_time", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_res_rcv_lb": { + "path_match": "ipfix.netscaler_http_res_rcv_lb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_res_forw_lb": { + "path_match": "ipfix.netscaler_http_res_forw_lb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_app_unit_app_id": { + "path_match": "ipfix.netscaler_app_unit_app_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_db_login_flags": { + "path_match": "ipfix.netscaler_db_login_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_db_req_type": { + "path_match": "ipfix.netscaler_db_req_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_db_proto": { + "path_match": "ipfix.netscaler_db_proto", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_db_user": { + "path_match": "ipfix.netscaler_db_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_db_database": { + "path_match": "ipfix.netscaler_db_database", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_db_client_hostname": { + "path_match": "ipfix.netscaler_db_client_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_db_req_string": { + "path_match": "ipfix.netscaler_db_req_string", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_db_resp_status_string": { + "path_match": "ipfix.netscaler_db_resp_status_string", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_db_resp_status": { + "path_match": "ipfix.netscaler_db_resp_status", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_db_resp_len": { + "path_match": "ipfix.netscaler_db_resp_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_client_rtt": { + "path_match": "ipfix.netscaler_client_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_content_type": { + "path_match": "ipfix.netscaler_http_content_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_req_auth": { + "path_match": "ipfix.netscaler_http_req_auth", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_req_via": { + "path_match": "ipfix.netscaler_http_req_via", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_res_location": { + "path_match": "ipfix.netscaler_http_res_location", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_res_set_cookie": { + "path_match": "ipfix.netscaler_http_res_set_cookie", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_res_set_cookie2": { + "path_match": "ipfix.netscaler_http_res_set_cookie2", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_req_x_forwarded_for": { + "path_match": "ipfix.netscaler_http_req_x_forwarded_for", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_conn_chain_id": { + "path_match": "ipfix.netscaler_conn_chain_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_conn_chain_hop_count": { + "path_match": "ipfix.netscaler_conn_chain_hop_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_sess_guid": { + "path_match": "ipfix.netscaler_ica_sess_guid", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_ica_client_ver": { + "path_match": "ipfix.netscaler_ica_client_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_ica_client_type": { + "path_match": "ipfix.netscaler_ica_client_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_client_ip": { + "path_match": "ipfix.netscaler_ica_client_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.netscaler_ica_client_hostname": { + "path_match": "ipfix.netscaler_ica_client_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_aaa_user": { + "path_match": "ipfix.netscaler_aaa_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_ica_domain": { + "path_match": "ipfix.netscaler_ica_domain", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_ica_client_launcher": { + "path_match": "ipfix.netscaler_ica_client_launcher", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_sess_setup_time": { + "path_match": "ipfix.netscaler_ica_sess_setup_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_server": { + "path_match": "ipfix.netscaler_ica_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_ica_sess_reconnects": { + "path_match": "ipfix.netscaler_ica_sess_reconnects", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_rtt": { + "path_match": "ipfix.netscaler_ica_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_rx_bytes": { + "path_match": "ipfix.netscaler_ica_clientside_rx_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_tx_bytes": { + "path_match": "ipfix.netscaler_ica_clientside_tx_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_packets_retrans": { + "path_match": "ipfix.netscaler_ica_clientside_packets_retrans", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_serverside_packets_retrans": { + "path_match": "ipfix.netscaler_ica_serverside_packets_retrans", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_rtt": { + "path_match": "ipfix.netscaler_ica_clientside_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_serverside_rtt": { + "path_match": "ipfix.netscaler_ica_serverside_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_sess_update_begin_sec": { + "path_match": "ipfix.netscaler_ica_sess_update_begin_sec", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_sess_update_end_sec": { + "path_match": "ipfix.netscaler_ica_sess_update_end_sec", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id1": { + "path_match": "ipfix.netscaler_ica_channel_id1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id1_bytes": { + "path_match": "ipfix.netscaler_ica_channel_id1_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id2": { + "path_match": "ipfix.netscaler_ica_channel_id2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id2_bytes": { + "path_match": "ipfix.netscaler_ica_channel_id2_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id3": { + "path_match": "ipfix.netscaler_ica_channel_id3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id3_bytes": { + "path_match": "ipfix.netscaler_ica_channel_id3_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id4": { + "path_match": "ipfix.netscaler_ica_channel_id4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id4_bytes": { + "path_match": "ipfix.netscaler_ica_channel_id4_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id5": { + "path_match": "ipfix.netscaler_ica_channel_id5", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id5_bytes": { + "path_match": "ipfix.netscaler_ica_channel_id5_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_conn_pri": { + "path_match": "ipfix.netscaler_ica_conn_pri", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_app_start_duration": { + "path_match": "ipfix.netscaler_app_start_duration", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_launch_mechanism": { + "path_match": "ipfix.netscaler_ica_launch_mechanism", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_app": { + "path_match": "ipfix.netscaler_ica_app", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_app_start_time": { + "path_match": "ipfix.netscaler_app_start_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_app_term_type": { + "path_match": "ipfix.netscaler_ica_app_term_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_app_term_time": { + "path_match": "ipfix.netscaler_ica_app_term_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_sess_end_time": { + "path_match": "ipfix.netscaler_ica_sess_end_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_jitter": { + "path_match": "ipfix.netscaler_ica_clientside_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_serverside_jitter": { + "path_match": "ipfix.netscaler_ica_serverside_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_app_pid": { + "path_match": "ipfix.netscaler_ica_app_pid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_app_module_path": { + "path_match": "ipfix.netscaler_ica_app_module_path", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_ica_device_serial_no": { + "path_match": "ipfix.netscaler_ica_device_serial_no", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_msi_client_cookie": { + "path_match": "ipfix.netscaler_msi_client_cookie", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_ica_flags": { + "path_match": "ipfix.netscaler_ica_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_user": { + "path_match": "ipfix.netscaler_ica_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_license_type": { + "path_match": "ipfix.netscaler_license_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_max_licenses": { + "path_match": "ipfix.netscaler_max_licenses", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_licenses_used": { + "path_match": "ipfix.netscaler_licenses_used", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_network_update_start_time": { + "path_match": "ipfix.netscaler_ica_network_update_start_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_network_update_end_time": { + "path_match": "ipfix.netscaler_ica_network_update_end_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_srtt": { + "path_match": "ipfix.netscaler_ica_clientside_srtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_serverside_srtt": { + "path_match": "ipfix.netscaler_ica_serverside_srtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_delay": { + "path_match": "ipfix.netscaler_ica_clientside_delay", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_serverside_delay": { + "path_match": "ipfix.netscaler_ica_serverside_delay", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_host_delay": { + "path_match": "ipfix.netscaler_ica_host_delay", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_window_size": { + "path_match": "ipfix.netscaler_ica_clientside_window_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_serverside_window_size": { + "path_match": "ipfix.netscaler_ica_serverside_window_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_rto_count": { + "path_match": "ipfix.netscaler_ica_clientside_rto_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_serverside_rto_count": { + "path_match": "ipfix.netscaler_ica_serverside_rto_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_l7_client_latency": { + "path_match": "ipfix.netscaler_ica_l7_client_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_l7_server_latency": { + "path_match": "ipfix.netscaler_ica_l7_server_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_domain": { + "path_match": "ipfix.netscaler_http_domain", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_cache_redir_client_conn_core_id": { + "path_match": "ipfix.netscaler_cache_redir_client_conn_core_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_cache_redir_client_conn_trans_id": { + "path_match": "ipfix.netscaler_cache_redir_client_conn_trans_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_270": { + "path_match": "ipfix.netscaler_unk_270", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_271": { + "path_match": "ipfix.netscaler_unk_271", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_272": { + "path_match": "ipfix.netscaler_unk_272", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_273": { + "path_match": "ipfix.netscaler_unk_273", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_274": { + "path_match": "ipfix.netscaler_unk_274", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_275": { + "path_match": "ipfix.netscaler_unk_275", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_276": { + "path_match": "ipfix.netscaler_unk_276", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_277": { + "path_match": "ipfix.netscaler_unk_277", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_278": { + "path_match": "ipfix.netscaler_unk_278", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_279": { + "path_match": "ipfix.netscaler_unk_279", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_280": { + "path_match": "ipfix.netscaler_unk_280", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_281": { + "path_match": "ipfix.netscaler_unk_281", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_282": { + "path_match": "ipfix.netscaler_unk_282", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_283": { + "path_match": "ipfix.netscaler_unk_283", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_284": { + "path_match": "ipfix.netscaler_unk_284", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_285": { + "path_match": "ipfix.netscaler_unk_285", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_286": { + "path_match": "ipfix.netscaler_unk_286", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_287": { + "path_match": "ipfix.netscaler_unk_287", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_288": { + "path_match": "ipfix.netscaler_unk_288", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_289": { + "path_match": "ipfix.netscaler_unk_289", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_290": { + "path_match": "ipfix.netscaler_unk_290", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_291": { + "path_match": "ipfix.netscaler_unk_291", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_292": { + "path_match": "ipfix.netscaler_unk_292", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_293": { + "path_match": "ipfix.netscaler_unk_293", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_294": { + "path_match": "ipfix.netscaler_unk_294", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_295": { + "path_match": "ipfix.netscaler_unk_295", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_296": { + "path_match": "ipfix.netscaler_unk_296", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_297": { + "path_match": "ipfix.netscaler_unk_297", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_298": { + "path_match": "ipfix.netscaler_unk_298", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_299": { + "path_match": "ipfix.netscaler_unk_299", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_300": { + "path_match": "ipfix.netscaler_unk_300", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_301": { + "path_match": "ipfix.netscaler_unk_301", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_302": { + "path_match": "ipfix.netscaler_unk_302", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_303": { + "path_match": "ipfix.netscaler_unk_303", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_304": { + "path_match": "ipfix.netscaler_unk_304", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_305": { + "path_match": "ipfix.netscaler_unk_305", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_306": { + "path_match": "ipfix.netscaler_unk_306", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_307": { + "path_match": "ipfix.netscaler_unk_307", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_308": { + "path_match": "ipfix.netscaler_unk_308", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_309": { + "path_match": "ipfix.netscaler_unk_309", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_310": { + "path_match": "ipfix.netscaler_unk_310", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_311": { + "path_match": "ipfix.netscaler_unk_311", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_312": { + "path_match": "ipfix.netscaler_unk_312", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_313": { + "path_match": "ipfix.netscaler_unk_313", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_314": { + "path_match": "ipfix.netscaler_unk_314", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_315": { + "path_match": "ipfix.netscaler_unk_315", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_316": { + "path_match": "ipfix.netscaler_unk_316", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_317": { + "path_match": "ipfix.netscaler_unk_317", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_318": { + "path_match": "ipfix.netscaler_unk_318", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_319": { + "path_match": "ipfix.netscaler_unk_319", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_320": { + "path_match": "ipfix.netscaler_unk_320", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_321": { + "path_match": "ipfix.netscaler_unk_321", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_322": { + "path_match": "ipfix.netscaler_unk_322", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_323": { + "path_match": "ipfix.netscaler_unk_323", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_324": { + "path_match": "ipfix.netscaler_unk_324", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_325": { + "path_match": "ipfix.netscaler_unk_325", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_326": { + "path_match": "ipfix.netscaler_unk_326", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_327": { + "path_match": "ipfix.netscaler_unk_327", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_328": { + "path_match": "ipfix.netscaler_unk_328", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_329": { + "path_match": "ipfix.netscaler_unk_329", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_330": { + "path_match": "ipfix.netscaler_unk_330", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_331": { + "path_match": "ipfix.netscaler_unk_331", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_332": { + "path_match": "ipfix.netscaler_unk_332", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_333": { + "path_match": "ipfix.netscaler_unk_333", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_334": { + "path_match": "ipfix.netscaler_unk_334", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_335": { + "path_match": "ipfix.netscaler_unk_335", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_336": { + "path_match": "ipfix.netscaler_unk_336", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_337": { + "path_match": "ipfix.netscaler_unk_337", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_338": { + "path_match": "ipfix.netscaler_unk_338", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_339": { + "path_match": "ipfix.netscaler_unk_339", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_340": { + "path_match": "ipfix.netscaler_unk_340", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_341": { + "path_match": "ipfix.netscaler_unk_341", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_342": { + "path_match": "ipfix.netscaler_unk_342", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_343": { + "path_match": "ipfix.netscaler_unk_343", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_344": { + "path_match": "ipfix.netscaler_unk_344", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_345": { + "path_match": "ipfix.netscaler_unk_345", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_346": { + "path_match": "ipfix.netscaler_unk_346", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_347": { + "path_match": "ipfix.netscaler_unk_347", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_348": { + "path_match": "ipfix.netscaler_unk_348", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_349": { + "path_match": "ipfix.netscaler_unk_349", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_350": { + "path_match": "ipfix.netscaler_unk_350", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_351": { + "path_match": "ipfix.netscaler_unk_351", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_352": { + "path_match": "ipfix.netscaler_unk_352", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_353": { + "path_match": "ipfix.netscaler_unk_353", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_354": { + "path_match": "ipfix.netscaler_unk_354", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_355": { + "path_match": "ipfix.netscaler_unk_355", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_356": { + "path_match": "ipfix.netscaler_unk_356", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_357": { + "path_match": "ipfix.netscaler_unk_357", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_358": { + "path_match": "ipfix.netscaler_unk_358", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_359": { + "path_match": "ipfix.netscaler_unk_359", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_360": { + "path_match": "ipfix.netscaler_unk_360", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_361": { + "path_match": "ipfix.netscaler_unk_361", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_362": { + "path_match": "ipfix.netscaler_unk_362", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_363": { + "path_match": "ipfix.netscaler_unk_363", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_364": { + "path_match": "ipfix.netscaler_unk_364", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_365": { + "path_match": "ipfix.netscaler_unk_365", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_366": { + "path_match": "ipfix.netscaler_unk_366", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_367": { + "path_match": "ipfix.netscaler_unk_367", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_377": { + "path_match": "ipfix.netscaler_unk_377", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_380": { + "path_match": "ipfix.netscaler_unk_380", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_383": { + "path_match": "ipfix.netscaler_unk_383", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_384": { + "path_match": "ipfix.netscaler_unk_384", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_385": { + "path_match": "ipfix.netscaler_unk_385", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_386": { + "path_match": "ipfix.netscaler_unk_386", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_387": { + "path_match": "ipfix.netscaler_unk_387", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_388": { + "path_match": "ipfix.netscaler_unk_388", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_389": { + "path_match": "ipfix.netscaler_unk_389", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_391": { + "path_match": "ipfix.netscaler_unk_391", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_392": { + "path_match": "ipfix.netscaler_unk_392", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_393": { + "path_match": "ipfix.netscaler_unk_393", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_394": { + "path_match": "ipfix.netscaler_unk_394", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_398": { + "path_match": "ipfix.netscaler_unk_398", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_399": { + "path_match": "ipfix.netscaler_unk_399", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_400": { + "path_match": "ipfix.netscaler_unk_400", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_401": { + "path_match": "ipfix.netscaler_unk_401", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_402": { + "path_match": "ipfix.netscaler_unk_402", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_403": { + "path_match": "ipfix.netscaler_unk_403", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_404": { + "path_match": "ipfix.netscaler_unk_404", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_405": { + "path_match": "ipfix.netscaler_unk_405", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_408": { + "path_match": "ipfix.netscaler_unk_408", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_427": { + "path_match": "ipfix.netscaler_unk_427", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_429": { + "path_match": "ipfix.netscaler_unk_429", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_432": { + "path_match": "ipfix.netscaler_unk_432", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_433": { + "path_match": "ipfix.netscaler_unk_433", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_434": { + "path_match": "ipfix.netscaler_unk_434", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_435": { + "path_match": "ipfix.netscaler_unk_435", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_447": { + "path_match": "ipfix.netscaler_unk_447", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_448": { + "path_match": "ipfix.netscaler_unk_448", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_451": { + "path_match": "ipfix.netscaler_unk_451", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_452": { + "path_match": "ipfix.netscaler_unk_452", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_453": { + "path_match": "ipfix.netscaler_unk_453", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_455": { + "path_match": "ipfix.netscaler_unk_455", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_458": { + "path_match": "ipfix.netscaler_unk_458", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_459": { + "path_match": "ipfix.netscaler_unk_459", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_460": { + "path_match": "ipfix.netscaler_unk_460", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_461": { + "path_match": "ipfix.netscaler_unk_461", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_463": { + "path_match": "ipfix.netscaler_unk_463", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_464": { + "path_match": "ipfix.netscaler_unk_464", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_465": { + "path_match": "ipfix.netscaler_unk_465", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_466": { + "path_match": "ipfix.netscaler_unk_466", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_467": { + "path_match": "ipfix.netscaler_unk_467", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_468": { + "path_match": "ipfix.netscaler_unk_468", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_475": { + "path_match": "ipfix.netscaler_unk_475", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_476": { + "path_match": "ipfix.netscaler_unk_476", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_477": { + "path_match": "ipfix.netscaler_unk_477", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_478": { + "path_match": "ipfix.netscaler_unk_478", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_479": { + "path_match": "ipfix.netscaler_unk_479", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_480": { + "path_match": "ipfix.netscaler_unk_480", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_481": { + "path_match": "ipfix.netscaler_unk_481", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_487": { + "path_match": "ipfix.netscaler_unk_487", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_488": { + "path_match": "ipfix.netscaler_unk_488", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_489": { + "path_match": "ipfix.netscaler_unk_489", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_491": { + "path_match": "ipfix.netscaler_unk_491", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_492": { + "path_match": "ipfix.netscaler_unk_492", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_493": { + "path_match": "ipfix.netscaler_unk_493", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_494": { + "path_match": "ipfix.netscaler_unk_494", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_507": { + "path_match": "ipfix.netscaler_unk_507", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_508": { + "path_match": "ipfix.netscaler_unk_508", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_509": { + "path_match": "ipfix.netscaler_unk_509", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_510": { + "path_match": "ipfix.netscaler_unk_510", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_511": { + "path_match": "ipfix.netscaler_unk_511", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_512": { + "path_match": "ipfix.netscaler_unk_512", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_513": { + "path_match": "ipfix.netscaler_unk_513", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_514": { + "path_match": "ipfix.netscaler_unk_514", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_518": { + "path_match": "ipfix.netscaler_unk_518", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_519": { + "path_match": "ipfix.netscaler_unk_519", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_520": { + "path_match": "ipfix.netscaler_unk_520", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_521": { + "path_match": "ipfix.netscaler_unk_521", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_522": { + "path_match": "ipfix.netscaler_unk_522", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_523": { + "path_match": "ipfix.netscaler_unk_523", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_532": { + "path_match": "ipfix.netscaler_unk_532", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_533": { + "path_match": "ipfix.netscaler_unk_533", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_534": { + "path_match": "ipfix.netscaler_unk_534", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_535": { + "path_match": "ipfix.netscaler_unk_535", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_536": { + "path_match": "ipfix.netscaler_unk_536", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_537": { + "path_match": "ipfix.netscaler_unk_537", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_538": { + "path_match": "ipfix.netscaler_unk_538", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_541": { + "path_match": "ipfix.netscaler_unk_541", + "mapping": { + "type": "long" + } + } + }, - - { - "ipfix.ntop_src_frags": { - "path_match": "ipfix.ntop_src_frags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_frags": { - "path_match": "ipfix.ntop_dst_frags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_to_dst_max_throughput": { - "path_match": "ipfix.ntop_src_to_dst_max_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_to_dst_min_throughput": { - "path_match": "ipfix.ntop_src_to_dst_min_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_to_dst_avg_throughput": { - "path_match": "ipfix.ntop_src_to_dst_avg_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_to_src_max_throughput": { - "path_match": "ipfix.ntop_dst_to_src_max_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_to_src_min_throughput": { - "path_match": "ipfix.ntop_dst_to_src_min_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_to_src_avg_throughput": { - "path_match": "ipfix.ntop_dst_to_src_avg_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_upto_128_bytes": { - "path_match": "ipfix.ntop_packets_upto_128_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_128_to_256_bytes": { - "path_match": "ipfix.ntop_packets_128_to_256_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_256_to_512_bytes": { - "path_match": "ipfix.ntop_packets_256_to_512_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_512_to_1024_bytes": { - "path_match": "ipfix.ntop_packets_512_to_1024_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_1024_to_1514_bytes": { - "path_match": "ipfix.ntop_packets_1024_to_1514_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_over_1514_bytes": { - "path_match": "ipfix.ntop_packets_over_1514_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_cumulative_icmp_type": { - "path_match": "ipfix.ntop_cumulative_icmp_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_country": { - "path_match": "ipfix.ntop_src_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_src_city": { - "path_match": "ipfix.ntop_src_city", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dst_country": { - "path_match": "ipfix.ntop_dst_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dst_city": { - "path_match": "ipfix.ntop_dst_city", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_flow_proto_port": { - "path_match": "ipfix.ntop_flow_proto_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tunnel_id": { - "path_match": "ipfix.ntop_tunnel_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_longest_flow_packet": { - "path_match": "ipfix.ntop_longest_flow_packet", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_shortest_flow_packet": { - "path_match": "ipfix.ntop_shortest_flow_packet", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_retrans_in_packets": { - "path_match": "ipfix.ntop_retrans_in_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_retrans_out_packets": { - "path_match": "ipfix.ntop_retrans_out_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_ooorder_in_packets": { - "path_match": "ipfix.ntop_ooorder_in_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_ooorder_out_packets": { - "path_match": "ipfix.ntop_ooorder_out_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_untunneled_protocol": { - "path_match": "ipfix.ntop_untunneled_protocol", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_untunneled_ipv4_src_addr": { - "path_match": "ipfix.ntop_untunneled_ipv4_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_untunneled_l4_src_port": { - "path_match": "ipfix.ntop_untunneled_l4_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_untunneled_ipv4_dst_addr": { - "path_match": "ipfix.ntop_untunneled_ipv4_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_untunneled_l4_dst_port": { - "path_match": "ipfix.ntop_untunneled_l4_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_l7_proto": { - "path_match": "ipfix.ntop_l7_proto", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_l7_proto_name": { - "path_match": "ipfix.ntop_l7_proto_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_downstram_tunnel_id": { - "path_match": "ipfix.ntop_downstram_tunnel_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_flow_user": { - "path_match": "ipfix.ntop_flow_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_flow_server": { - "path_match": "ipfix.ntop_flow_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_client_nw_latency_ms": { - "path_match": "ipfix.ntop_client_nw_latency_ms", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_server_nw_latency_ms": { - "path_match": "ipfix.ntop_server_nw_latency_ms", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_appl_latency_ms": { - "path_match": "ipfix.ntop_appl_latency_ms", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_plugin": { - "path_match": "ipfix.ntop_plugin", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_retrans_in_bytes": { - "path_match": "ipfix.ntop_retrans_in_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_retrans_out_bytes": { - "path_match": "ipfix.ntop_retrans_out_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_call_id": { - "path_match": "ipfix.ntop_sip_call_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_sip_calling_party": { - "path_match": "ipfix.ntop_sip_calling_party", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_sip_called_party": { - "path_match": "ipfix.ntop_sip_called_party", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_sip_rtp_codecs": { - "path_match": "ipfix.ntop_sip_rtp_codecs", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_sip_invite_time": { - "path_match": "ipfix.ntop_sip_invite_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_trying_time": { - "path_match": "ipfix.ntop_sip_trying_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_ringing_time": { - "path_match": "ipfix.ntop_sip_ringing_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_ok_time": { - "path_match": "ipfix.ntop_sip_ok_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_invite_failure_time": { - "path_match": "ipfix.ntop_sip_invite_failure_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_bye_time": { - "path_match": "ipfix.ntop_sip_bye_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_bye_ok_time": { - "path_match": "ipfix.ntop_sip_bye_ok_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_cancel_time": { - "path_match": "ipfix.ntop_sip_cancel_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_cancel_ok_time": { - "path_match": "ipfix.ntop_sip_cancel_ok_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_rtp_ipv4_src_addr": { - "path_match": "ipfix.ntop_sip_rtp_ipv4_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_sip_rtp_l4_src_port": { - "path_match": "ipfix.ntop_sip_rtp_l4_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_rtp_ipv4_dst_addr": { - "path_match": "ipfix.ntop_sip_rtp_ipv4_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_sip_rtp_l4_dst_port": { - "path_match": "ipfix.ntop_sip_rtp_l4_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_resp_code": { - "path_match": "ipfix.ntop_sip_resp_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_reason_cause": { - "path_match": "ipfix.ntop_sip_reason_cause", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_first_seq": { - "path_match": "ipfix.ntop_rtp_first_seq", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_first_ts": { - "path_match": "ipfix.ntop_rtp_first_ts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_last_seq": { - "path_match": "ipfix.ntop_rtp_last_seq", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_last_ts": { - "path_match": "ipfix.ntop_rtp_last_ts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_in_jitter": { - "path_match": "ipfix.ntop_rtp_in_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_out_jitter": { - "path_match": "ipfix.ntop_rtp_out_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_in_packets_lost": { - "path_match": "ipfix.ntop_rtp_in_packets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_out_packets_lost": { - "path_match": "ipfix.ntop_rtp_out_packets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_out_payload_type": { - "path_match": "ipfix.ntop_rtp_out_payload_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_in_max_delta": { - "path_match": "ipfix.ntop_rtp_in_max_delta", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_out_max_delta": { - "path_match": "ipfix.ntop_rtp_out_max_delta", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_in_payload_type": { - "path_match": "ipfix.ntop_rtp_in_payload_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_proc_id": { - "path_match": "ipfix.ntop_src_proc_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_proc": { - "path_match": "ipfix.ntop_src_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_http_url": { - "path_match": "ipfix.ntop_http_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_http_ret_code": { - "path_match": "ipfix.ntop_http_ret_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_http_referrer": { - "path_match": "ipfix.ntop_http_referrer", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_http_user_agent": { - "path_match": "ipfix.ntop_http_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_http_mime": { - "path_match": "ipfix.ntop_http_mime", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_smtp_mail_from": { - "path_match": "ipfix.ntop_smtp_mail_from", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_smtp_rcpt_to": { - "path_match": "ipfix.ntop_smtp_rcpt_to", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_http_host": { - "path_match": "ipfix.ntop_http_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ssl_server": { - "path_match": "ipfix.ntop_ssl_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_bittorrent_hash": { - "path_match": "ipfix.ntop_bittorrent_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_mysql_server_ver": { - "path_match": "ipfix.ntop_mysql_server_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_mysql_user": { - "path_match": "ipfix.ntop_mysql_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_mysql_db": { - "path_match": "ipfix.ntop_mysql_db", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_mysql_query": { - "path_match": "ipfix.ntop_mysql_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_mysql_resp": { - "path_match": "ipfix.ntop_mysql_resp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_oracle_user": { - "path_match": "ipfix.ntop_oracle_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_oracle_query": { - "path_match": "ipfix.ntop_oracle_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_oracle_resp_code": { - "path_match": "ipfix.ntop_oracle_resp_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_oracle_resp_string": { - "path_match": "ipfix.ntop_oracle_resp_string", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_oracle_query_duration": { - "path_match": "ipfix.ntop_oracle_query_duration", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dns_query": { - "path_match": "ipfix.ntop_dns_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dns_query_id": { - "path_match": "ipfix.ntop_dns_query_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dns_query_type": { - "path_match": "ipfix.ntop_dns_query_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dns_ret_code": { - "path_match": "ipfix.ntop_dns_ret_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dns_answers": { - "path_match": "ipfix.ntop_dns_answers", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_pop_user": { - "path_match": "ipfix.ntop_pop_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv1_req_msg_type": { - "path_match": "ipfix.ntop_gtpv1_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_resp_msg_type": { - "path_match": "ipfix.ntop_gtpv1_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_c2s_teid_data": { - "path_match": "ipfix.ntop_gtpv1_c2s_teid_data", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_c2s_teid_ctrl": { - "path_match": "ipfix.ntop_gtpv1_c2s_teid_ctrl", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_s2c_teid_data": { - "path_match": "ipfix.ntop_gtpv1_s2c_teid_data", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_s2c_teid_ctrl": { - "path_match": "ipfix.ntop_gtpv1_s2c_teid_ctrl", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_end_user_ip": { - "path_match": "ipfix.ntop_gtpv1_end_user_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv1_end_user_imsi": { - "path_match": "ipfix.ntop_gtpv1_end_user_imsi", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv1_end_user_msisdn": { - "path_match": "ipfix.ntop_gtpv1_end_user_msisdn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv1_end_user_imei": { - "path_match": "ipfix.ntop_gtpv1_end_user_imei", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv1_apn": { - "path_match": "ipfix.ntop_gtpv1_apn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv1_rai_mcc": { - "path_match": "ipfix.ntop_gtpv1_rai_mcc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_rai_mnc": { - "path_match": "ipfix.ntop_gtpv1_rai_mnc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_uli_cell_lac": { - "path_match": "ipfix.ntop_gtpv1_uli_cell_lac", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_uli_cell_ci": { - "path_match": "ipfix.ntop_gtpv1_uli_cell_ci", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_uli_sac": { - "path_match": "ipfix.ntop_gtpv1_uli_sac", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_rai_type": { - "path_match": "ipfix.ntop_gtpv1_rai_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_radius_req_msg_type": { - "path_match": "ipfix.ntop_radius_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_radius_resp_msg_type": { - "path_match": "ipfix.ntop_radius_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_radius_user": { - "path_match": "ipfix.ntop_radius_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_radius_calling_station_id": { - "path_match": "ipfix.ntop_radius_calling_station_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_radius_called_station_id": { - "path_match": "ipfix.ntop_radius_called_station_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_radius_nas_ip": { - "path_match": "ipfix.ntop_radius_nas_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_radius_nas_id": { - "path_match": "ipfix.ntop_radius_nas_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_radius_user_imsi": { - "path_match": "ipfix.ntop_radius_user_imsi", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_radius_user_imei": { - "path_match": "ipfix.ntop_radius_user_imei", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_radius_framed_ip": { - "path_match": "ipfix.ntop_radius_framed_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_radius_acct_sess_id": { - "path_match": "ipfix.ntop_radius_acct_sess_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_radius_acct_status_type": { - "path_match": "ipfix.ntop_radius_acct_status_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_radius_acct_in_octets": { - "path_match": "ipfix.ntop_radius_acct_in_octets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_radius_acct_out_octets": { - "path_match": "ipfix.ntop_radius_acct_out_octets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_radius_acct_in_packets": { - "path_match": "ipfix.ntop_radius_acct_in_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_radius_acct_out_packets": { - "path_match": "ipfix.ntop_radius_acct_out_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_imap_login": { - "path_match": "ipfix.ntop_imap_login", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv2_req_msg_type": { - "path_match": "ipfix.ntop_gtpv2_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_resp_msg_type": { - "path_match": "ipfix.ntop_gtpv2_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_c2s_s1u_gtpu_teid": { - "path_match": "ipfix.ntop_gtpv2_c2s_s1u_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_c2s_s1u_gtpu_ip": { - "path_match": "ipfix.ntop_gtpv2_c2s_s1u_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv2_s2c_s1u_gtpu_teid": { - "path_match": "ipfix.ntop_gtpv2_s2c_s1u_gtpu_teid", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv2_s2c_s1u_gtpu_ip": { - "path_match": "ipfix.ntop_gtpv2_s2c_s1u_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv2_end_user_imsi": { - "path_match": "ipfix.ntop_gtpv2_end_user_imsi", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv2_and_user_msisdn": { - "path_match": "ipfix.ntop_gtpv2_and_user_msisdn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv2_apn": { - "path_match": "ipfix.ntop_gtpv2_apn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv2_uli_mcc": { - "path_match": "ipfix.ntop_gtpv2_uli_mcc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_uli_mnc": { - "path_match": "ipfix.ntop_gtpv2_uli_mnc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_uli_cell_tac": { - "path_match": "ipfix.ntop_gtpv2_uli_cell_tac", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_uli_cell_id": { - "path_match": "ipfix.ntop_gtpv2_uli_cell_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_rat_type": { - "path_match": "ipfix.ntop_gtpv2_rat_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_pdn_ip": { - "path_match": "ipfix.ntop_gtpv2_pdn_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv2_end_user_imei": { - "path_match": "ipfix.ntop_gtpv2_end_user_imei", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_src_as_path_1": { - "path_match": "ipfix.ntop_src_as_path_1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_2": { - "path_match": "ipfix.ntop_src_as_path_2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_3": { - "path_match": "ipfix.ntop_src_as_path_3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_4": { - "path_match": "ipfix.ntop_src_as_path_4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_5": { - "path_match": "ipfix.ntop_src_as_path_5", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_6": { - "path_match": "ipfix.ntop_src_as_path_6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_7": { - "path_match": "ipfix.ntop_src_as_path_7", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_8": { - "path_match": "ipfix.ntop_src_as_path_8", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_9": { - "path_match": "ipfix.ntop_src_as_path_9", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_10": { - "path_match": "ipfix.ntop_src_as_path_10", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_1": { - "path_match": "ipfix.ntop_dst_as_path_1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_2": { - "path_match": "ipfix.ntop_dst_as_path_2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_3": { - "path_match": "ipfix.ntop_dst_as_path_3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_4": { - "path_match": "ipfix.ntop_dst_as_path_4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_5": { - "path_match": "ipfix.ntop_dst_as_path_5", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_6": { - "path_match": "ipfix.ntop_dst_as_path_6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_7": { - "path_match": "ipfix.ntop_dst_as_path_7", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_8": { - "path_match": "ipfix.ntop_dst_as_path_8", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_9": { - "path_match": "ipfix.ntop_dst_as_path_9", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_10": { - "path_match": "ipfix.ntop_dst_as_path_10", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_mysql_appl_latency_usec": { - "path_match": "ipfix.ntop_mysql_appl_latency_usec", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv0_req_msg_type": { - "path_match": "ipfix.ntop_gtpv0_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv0_resp_msg_type": { - "path_match": "ipfix.ntop_gtpv0_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv0_tid": { - "path_match": "ipfix.ntop_gtpv0_tid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv0_end_user_ip": { - "path_match": "ipfix.ntop_gtpv0_end_user_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv0_end_user_msisdn": { - "path_match": "ipfix.ntop_gtpv0_end_user_msisdn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv0_apn": { - "path_match": "ipfix.ntop_gtpv0_apn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv0_rai_mcc": { - "path_match": "ipfix.ntop_gtpv0_rai_mcc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv0_rai_mnc": { - "path_match": "ipfix.ntop_gtpv0_rai_mnc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv0_rai_cell_lac": { - "path_match": "ipfix.ntop_gtpv0_rai_cell_lac", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv0_rai_cell_rac": { - "path_match": "ipfix.ntop_gtpv0_rai_cell_rac", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv0_resp_cause": { - "path_match": "ipfix.ntop_gtpv0_resp_cause", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_resp_cause": { - "path_match": "ipfix.ntop_gtpv1_resp_cause", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_resp_cause": { - "path_match": "ipfix.ntop_gtpv2_resp_cause", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_5_32": { - "path_match": "ipfix.ntop_packets_ttl_5_32", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_32_64": { - "path_match": "ipfix.ntop_packets_ttl_32_64", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_64_96": { - "path_match": "ipfix.ntop_packets_ttl_64_96", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_96_128": { - "path_match": "ipfix.ntop_packets_ttl_96_128", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_128_160": { - "path_match": "ipfix.ntop_packets_ttl_128_160", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_160_192": { - "path_match": "ipfix.ntop_packets_ttl_160_192", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_192_224": { - "path_match": "ipfix.ntop_packets_ttl_192_224", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_224_225": { - "path_match": "ipfix.ntop_packets_ttl_224_225", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_rai_lac": { - "path_match": "ipfix.ntop_gtpv1_rai_lac", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_rai_rac": { - "path_match": "ipfix.ntop_gtpv1_rai_rac", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_uli_mcc": { - "path_match": "ipfix.ntop_gtpv1_uli_mcc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_uli_mnc": { - "path_match": "ipfix.ntop_gtpv1_uli_mnc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_2_5": { - "path_match": "ipfix.ntop_packets_ttl_2_5", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_eq_1": { - "path_match": "ipfix.ntop_packets_ttl_eq_1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_sip_call_id": { - "path_match": "ipfix.ntop_rtp_sip_call_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_in_src_osi_sap": { - "path_match": "ipfix.ntop_in_src_osi_sap", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_out_dst_osi_sap": { - "path_match": "ipfix.ntop_out_dst_osi_sap", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_whois_das_domain": { - "path_match": "ipfix.ntop_whois_das_domain", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dns_ttl_answer": { - "path_match": "ipfix.ntop_dns_ttl_answer", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dhcp_client_mac": { - "path_match": "ipfix.ntop_dhcp_client_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dhcp_client_ip": { - "path_match": "ipfix.ntop_dhcp_client_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_dhcp_client": { - "path_match": "ipfix.ntop_dhcp_client", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ftp_login": { - "path_match": "ipfix.ntop_ftp_login", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ftp_password": { - "path_match": "ipfix.ntop_ftp_password", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ftp_command": { - "path_match": "ipfix.ntop_ftp_command", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ftp_command_ret_code": { - "path_match": "ipfix.ntop_ftp_command_ret_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_http_method": { - "path_match": "ipfix.ntop_http_method", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_http_site": { - "path_match": "ipfix.ntop_http_site", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_sip_c_ip": { - "path_match": "ipfix.ntop_sip_c_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_sip_call_state": { - "path_match": "ipfix.ntop_sip_call_state", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_rtp_in_mos": { - "path_match": "ipfix.ntop_rtp_in_mos", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_in_r_factor": { - "path_match": "ipfix.ntop_rtp_in_r_factor", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_proc_user": { - "path_match": "ipfix.ntop_src_proc_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_src_father_proc_pid": { - "path_match": "ipfix.ntop_src_father_proc_pid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_father_proc": { - "path_match": "ipfix.ntop_src_father_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dst_proc_pid": { - "path_match": "ipfix.ntop_dst_proc_pid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_proc": { - "path_match": "ipfix.ntop_dst_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dst_proc_user": { - "path_match": "ipfix.ntop_dst_proc_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dst_father_proc_pid": { - "path_match": "ipfix.ntop_dst_father_proc_pid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_father_proc": { - "path_match": "ipfix.ntop_dst_father_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_rtp_rtt": { - "path_match": "ipfix.ntop_rtp_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_in_transit": { - "path_match": "ipfix.ntop_rtp_in_transit", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_out_transit": { - "path_match": "ipfix.ntop_rtp_out_transit", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_proc_actual_memory": { - "path_match": "ipfix.ntop_src_proc_actual_memory", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_proc_peak_memory": { - "path_match": "ipfix.ntop_src_proc_peak_memory", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_proc_avg_cpu_load": { - "path_match": "ipfix.ntop_src_proc_avg_cpu_load", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_proc_page_faults": { - "path_match": "ipfix.ntop_src_proc_page_faults", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_proc_actual_memory": { - "path_match": "ipfix.ntop_dst_proc_actual_memory", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_proc_peak_memory": { - "path_match": "ipfix.ntop_dst_proc_peak_memory", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_proc_avg_cpu_load": { - "path_match": "ipfix.ntop_dst_proc_avg_cpu_load", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_proc_page_faults": { - "path_match": "ipfix.ntop_dst_proc_page_faults", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_duration_in": { - "path_match": "ipfix.ntop_duration_in", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_duration_out": { - "path_match": "ipfix.ntop_duration_out", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_proc_pctg_iowait": { - "path_match": "ipfix.ntop_src_proc_pctg_iowait", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_proc_pctg_iowait": { - "path_match": "ipfix.ntop_dst_proc_pctg_iowait", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_dtmf_tones": { - "path_match": "ipfix.ntop_rtp_dtmf_tones", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_untunneled_ipv6_src_addr": { - "path_match": "ipfix.ntop_untunneled_ipv6_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_untunneled_ipv6_dst_addr": { - "path_match": "ipfix.ntop_untunneled_ipv6_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_dns_resp": { - "path_match": "ipfix.ntop_dns_resp", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_diameter_req_msg_type": { - "path_match": "ipfix.ntop_diameter_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_diameter_resp_msg_type": { - "path_match": "ipfix.ntop_diameter_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_diameter_req_origin_host": { - "path_match": "ipfix.ntop_diameter_req_origin_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_diameter_resp_origin_host": { - "path_match": "ipfix.ntop_diameter_resp_origin_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_diameter_req_user": { - "path_match": "ipfix.ntop_diameter_req_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_diameter_resp_result_code": { - "path_match": "ipfix.ntop_diameter_resp_result_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_diameter_exp_res_vendor_id": { - "path_match": "ipfix.ntop_diameter_exp_res_vendor_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_diameter_exp_res_result_code": { - "path_match": "ipfix.ntop_diameter_exp_res_result_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_s1ap_enb_ue_s1ap_id": { - "path_match": "ipfix.ntop_s1ap_enb_ue_s1ap_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_s1ap_mme_ue_s1ap_id": { - "path_match": "ipfix.ntop_s1ap_mme_ue_s1ap_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_s1ap_msg_emm_type_mme_to_enb": { - "path_match": "ipfix.ntop_s1ap_msg_emm_type_mme_to_enb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_s1ap_msg_esm_type_mme_to_enb": { - "path_match": "ipfix.ntop_s1ap_msg_esm_type_mme_to_enb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_s1ap_msg_emm_type_enb_to_mme": { - "path_match": "ipfix.ntop_s1ap_msg_emm_type_enb_to_mme", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_s1ap_msg_esm_type_enb_to_mme": { - "path_match": "ipfix.ntop_s1ap_msg_esm_type_enb_to_mme", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_s1ap_cause_enb_to_mme": { - "path_match": "ipfix.ntop_s1ap_cause_enb_to_mme", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_s1ap_detailed_cause_enb_to_mme": { - "path_match": "ipfix.ntop_s1ap_detailed_cause_enb_to_mme", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tcp_win_min_in": { - "path_match": "ipfix.ntop_tcp_win_min_in", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tcp_win_max_in": { - "path_match": "ipfix.ntop_tcp_win_max_in", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tcp_win_mss_in": { - "path_match": "ipfix.ntop_tcp_win_mss_in", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tcp_win_scale_in": { - "path_match": "ipfix.ntop_tcp_win_scale_in", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tcp_win_min_out": { - "path_match": "ipfix.ntop_tcp_win_min_out", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tcp_win_max_out": { - "path_match": "ipfix.ntop_tcp_win_max_out", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tcp_win_mss_out": { - "path_match": "ipfix.ntop_tcp_win_mss_out", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tcp_win_scale_out": { - "path_match": "ipfix.ntop_tcp_win_scale_out", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dhcp_remote_id": { - "path_match": "ipfix.ntop_dhcp_remote_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dhcp_subscriber_id": { - "path_match": "ipfix.ntop_dhcp_subscriber_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_src_proc_uid": { - "path_match": "ipfix.ntop_src_proc_uid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_proc_uid": { - "path_match": "ipfix.ntop_dst_proc_uid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_application": { - "path_match": "ipfix.ntop_application", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_user": { - "path_match": "ipfix.ntop_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dhcp_message_type": { - "path_match": "ipfix.ntop_dhcp_message_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_rtp_in_packets_drop": { - "path_match": "ipfix.ntop_rtp_in_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_out_packets_drop": { - "path_match": "ipfix.ntop_rtp_out_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_out_mos": { - "path_match": "ipfix.ntop_rtp_out_mos", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_out_r_factor": { - "path_match": "ipfix.ntop_rtp_out_r_factor", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_mos": { - "path_match": "ipfix.ntop_rtp_mos", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gptv2_s5_s8_gtpc_teid": { - "path_match": "ipfix.ntop_gptv2_s5_s8_gtpc_teid", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_rtp_r_factor": { - "path_match": "ipfix.ntop_rtp_r_factor", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_ssrc": { - "path_match": "ipfix.ntop_rtp_ssrc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_payload_hash": { - "path_match": "ipfix.ntop_payload_hash", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_teid": { - "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_teid": { - "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_ip": { - "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_ip": { - "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_src_as_map": { - "path_match": "ipfix.ntop_src_as_map", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dst_as_map": { - "path_match": "ipfix.ntop_dst_as_map", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_diameter_hop_by_hop_id": { - "path_match": "ipfix.ntop_diameter_hop_by_hop_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_upstream_sess_id": { - "path_match": "ipfix.ntop_upstream_sess_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_downstream_sess_id": { - "path_match": "ipfix.ntop_downstream_sess_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_long": { - "path_match": "ipfix.ntop_src_long", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.ntop_src_lat": { - "path_match": "ipfix.ntop_src_lat", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.ntop_dst_long": { - "path_match": "ipfix.ntop_dst_long", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.ntop_dst_lat": { - "path_match": "ipfix.ntop_dst_lat", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.ntop_diameter_clr_cancel_type": { - "path_match": "ipfix.ntop_diameter_clr_cancel_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_diameter_clr_flags": { - "path_match": "ipfix.ntop_diameter_clr_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_c2s_s5_s8_gtpc_ip": { - "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_gtpc_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv2_s2c_s5_s8_gtpc_ip": { - "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_gtpc_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid": { - "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid": { - "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip": { - "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip": { - "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_http_x_forwarded_for": { - "path_match": "ipfix.ntop_http_x_forwarded_for", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_http_via": { - "path_match": "ipfix.ntop_http_via", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ssdp_host": { - "path_match": "ipfix.ntop_ssdp_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ssdp_usn": { - "path_match": "ipfix.ntop_ssdp_usn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_netbios_query": { - "path_match": "ipfix.ntop_netbios_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_netbios_query_type": { - "path_match": "ipfix.ntop_netbios_query_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_netbios_resp": { - "path_match": "ipfix.ntop_netbios_resp", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_netbios_query_os": { - "path_match": "ipfix.ntop_netbios_query_os", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ssdp_server": { - "path_match": "ipfix.ntop_ssdp_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ssdp_type": { - "path_match": "ipfix.ntop_ssdp_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ssdp_method": { - "path_match": "ipfix.ntop_ssdp_method", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_nprobe_ipv4_addr": { - "path_match": "ipfix.ntop_nprobe_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, + + { + "ipfix.ntop_src_frags": { + "path_match": "ipfix.ntop_src_frags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_frags": { + "path_match": "ipfix.ntop_dst_frags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_to_dst_max_throughput": { + "path_match": "ipfix.ntop_src_to_dst_max_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_to_dst_min_throughput": { + "path_match": "ipfix.ntop_src_to_dst_min_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_to_dst_avg_throughput": { + "path_match": "ipfix.ntop_src_to_dst_avg_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_to_src_max_throughput": { + "path_match": "ipfix.ntop_dst_to_src_max_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_to_src_min_throughput": { + "path_match": "ipfix.ntop_dst_to_src_min_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_to_src_avg_throughput": { + "path_match": "ipfix.ntop_dst_to_src_avg_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_upto_128_bytes": { + "path_match": "ipfix.ntop_packets_upto_128_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_128_to_256_bytes": { + "path_match": "ipfix.ntop_packets_128_to_256_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_256_to_512_bytes": { + "path_match": "ipfix.ntop_packets_256_to_512_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_512_to_1024_bytes": { + "path_match": "ipfix.ntop_packets_512_to_1024_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_1024_to_1514_bytes": { + "path_match": "ipfix.ntop_packets_1024_to_1514_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_over_1514_bytes": { + "path_match": "ipfix.ntop_packets_over_1514_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_cumulative_icmp_type": { + "path_match": "ipfix.ntop_cumulative_icmp_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_country": { + "path_match": "ipfix.ntop_src_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_src_city": { + "path_match": "ipfix.ntop_src_city", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dst_country": { + "path_match": "ipfix.ntop_dst_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dst_city": { + "path_match": "ipfix.ntop_dst_city", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_flow_proto_port": { + "path_match": "ipfix.ntop_flow_proto_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tunnel_id": { + "path_match": "ipfix.ntop_tunnel_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_longest_flow_packet": { + "path_match": "ipfix.ntop_longest_flow_packet", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_shortest_flow_packet": { + "path_match": "ipfix.ntop_shortest_flow_packet", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_retrans_in_packets": { + "path_match": "ipfix.ntop_retrans_in_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_retrans_out_packets": { + "path_match": "ipfix.ntop_retrans_out_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_ooorder_in_packets": { + "path_match": "ipfix.ntop_ooorder_in_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_ooorder_out_packets": { + "path_match": "ipfix.ntop_ooorder_out_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_untunneled_protocol": { + "path_match": "ipfix.ntop_untunneled_protocol", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_untunneled_ipv4_src_addr": { + "path_match": "ipfix.ntop_untunneled_ipv4_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_untunneled_l4_src_port": { + "path_match": "ipfix.ntop_untunneled_l4_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_untunneled_ipv4_dst_addr": { + "path_match": "ipfix.ntop_untunneled_ipv4_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_untunneled_l4_dst_port": { + "path_match": "ipfix.ntop_untunneled_l4_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_l7_proto": { + "path_match": "ipfix.ntop_l7_proto", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_l7_proto_name": { + "path_match": "ipfix.ntop_l7_proto_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_downstram_tunnel_id": { + "path_match": "ipfix.ntop_downstram_tunnel_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_flow_user": { + "path_match": "ipfix.ntop_flow_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_flow_server": { + "path_match": "ipfix.ntop_flow_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_client_nw_latency_ms": { + "path_match": "ipfix.ntop_client_nw_latency_ms", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_server_nw_latency_ms": { + "path_match": "ipfix.ntop_server_nw_latency_ms", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_appl_latency_ms": { + "path_match": "ipfix.ntop_appl_latency_ms", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_plugin": { + "path_match": "ipfix.ntop_plugin", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_retrans_in_bytes": { + "path_match": "ipfix.ntop_retrans_in_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_retrans_out_bytes": { + "path_match": "ipfix.ntop_retrans_out_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_call_id": { + "path_match": "ipfix.ntop_sip_call_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_sip_calling_party": { + "path_match": "ipfix.ntop_sip_calling_party", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_sip_called_party": { + "path_match": "ipfix.ntop_sip_called_party", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_sip_rtp_codecs": { + "path_match": "ipfix.ntop_sip_rtp_codecs", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_sip_invite_time": { + "path_match": "ipfix.ntop_sip_invite_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_trying_time": { + "path_match": "ipfix.ntop_sip_trying_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_ringing_time": { + "path_match": "ipfix.ntop_sip_ringing_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_ok_time": { + "path_match": "ipfix.ntop_sip_ok_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_invite_failure_time": { + "path_match": "ipfix.ntop_sip_invite_failure_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_bye_time": { + "path_match": "ipfix.ntop_sip_bye_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_bye_ok_time": { + "path_match": "ipfix.ntop_sip_bye_ok_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_cancel_time": { + "path_match": "ipfix.ntop_sip_cancel_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_cancel_ok_time": { + "path_match": "ipfix.ntop_sip_cancel_ok_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_rtp_ipv4_src_addr": { + "path_match": "ipfix.ntop_sip_rtp_ipv4_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_sip_rtp_l4_src_port": { + "path_match": "ipfix.ntop_sip_rtp_l4_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_rtp_ipv4_dst_addr": { + "path_match": "ipfix.ntop_sip_rtp_ipv4_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_sip_rtp_l4_dst_port": { + "path_match": "ipfix.ntop_sip_rtp_l4_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_resp_code": { + "path_match": "ipfix.ntop_sip_resp_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_reason_cause": { + "path_match": "ipfix.ntop_sip_reason_cause", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_first_seq": { + "path_match": "ipfix.ntop_rtp_first_seq", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_first_ts": { + "path_match": "ipfix.ntop_rtp_first_ts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_last_seq": { + "path_match": "ipfix.ntop_rtp_last_seq", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_last_ts": { + "path_match": "ipfix.ntop_rtp_last_ts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_in_jitter": { + "path_match": "ipfix.ntop_rtp_in_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_out_jitter": { + "path_match": "ipfix.ntop_rtp_out_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_in_packets_lost": { + "path_match": "ipfix.ntop_rtp_in_packets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_out_packets_lost": { + "path_match": "ipfix.ntop_rtp_out_packets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_out_payload_type": { + "path_match": "ipfix.ntop_rtp_out_payload_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_in_max_delta": { + "path_match": "ipfix.ntop_rtp_in_max_delta", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_out_max_delta": { + "path_match": "ipfix.ntop_rtp_out_max_delta", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_in_payload_type": { + "path_match": "ipfix.ntop_rtp_in_payload_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_proc_id": { + "path_match": "ipfix.ntop_src_proc_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_proc": { + "path_match": "ipfix.ntop_src_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_http_url": { + "path_match": "ipfix.ntop_http_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_http_ret_code": { + "path_match": "ipfix.ntop_http_ret_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_http_referrer": { + "path_match": "ipfix.ntop_http_referrer", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_http_user_agent": { + "path_match": "ipfix.ntop_http_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_http_mime": { + "path_match": "ipfix.ntop_http_mime", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_smtp_mail_from": { + "path_match": "ipfix.ntop_smtp_mail_from", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_smtp_rcpt_to": { + "path_match": "ipfix.ntop_smtp_rcpt_to", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_http_host": { + "path_match": "ipfix.ntop_http_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ssl_server": { + "path_match": "ipfix.ntop_ssl_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_bittorrent_hash": { + "path_match": "ipfix.ntop_bittorrent_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_mysql_server_ver": { + "path_match": "ipfix.ntop_mysql_server_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_mysql_user": { + "path_match": "ipfix.ntop_mysql_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_mysql_db": { + "path_match": "ipfix.ntop_mysql_db", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_mysql_query": { + "path_match": "ipfix.ntop_mysql_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_mysql_resp": { + "path_match": "ipfix.ntop_mysql_resp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_oracle_user": { + "path_match": "ipfix.ntop_oracle_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_oracle_query": { + "path_match": "ipfix.ntop_oracle_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_oracle_resp_code": { + "path_match": "ipfix.ntop_oracle_resp_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_oracle_resp_string": { + "path_match": "ipfix.ntop_oracle_resp_string", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_oracle_query_duration": { + "path_match": "ipfix.ntop_oracle_query_duration", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dns_query": { + "path_match": "ipfix.ntop_dns_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dns_query_id": { + "path_match": "ipfix.ntop_dns_query_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dns_query_type": { + "path_match": "ipfix.ntop_dns_query_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dns_ret_code": { + "path_match": "ipfix.ntop_dns_ret_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dns_answers": { + "path_match": "ipfix.ntop_dns_answers", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_pop_user": { + "path_match": "ipfix.ntop_pop_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv1_req_msg_type": { + "path_match": "ipfix.ntop_gtpv1_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_resp_msg_type": { + "path_match": "ipfix.ntop_gtpv1_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_c2s_teid_data": { + "path_match": "ipfix.ntop_gtpv1_c2s_teid_data", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_c2s_teid_ctrl": { + "path_match": "ipfix.ntop_gtpv1_c2s_teid_ctrl", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_s2c_teid_data": { + "path_match": "ipfix.ntop_gtpv1_s2c_teid_data", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_s2c_teid_ctrl": { + "path_match": "ipfix.ntop_gtpv1_s2c_teid_ctrl", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_end_user_ip": { + "path_match": "ipfix.ntop_gtpv1_end_user_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv1_end_user_imsi": { + "path_match": "ipfix.ntop_gtpv1_end_user_imsi", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv1_end_user_msisdn": { + "path_match": "ipfix.ntop_gtpv1_end_user_msisdn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv1_end_user_imei": { + "path_match": "ipfix.ntop_gtpv1_end_user_imei", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv1_apn": { + "path_match": "ipfix.ntop_gtpv1_apn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv1_rai_mcc": { + "path_match": "ipfix.ntop_gtpv1_rai_mcc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_rai_mnc": { + "path_match": "ipfix.ntop_gtpv1_rai_mnc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_uli_cell_lac": { + "path_match": "ipfix.ntop_gtpv1_uli_cell_lac", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_uli_cell_ci": { + "path_match": "ipfix.ntop_gtpv1_uli_cell_ci", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_uli_sac": { + "path_match": "ipfix.ntop_gtpv1_uli_sac", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_rai_type": { + "path_match": "ipfix.ntop_gtpv1_rai_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_radius_req_msg_type": { + "path_match": "ipfix.ntop_radius_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_radius_resp_msg_type": { + "path_match": "ipfix.ntop_radius_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_radius_user": { + "path_match": "ipfix.ntop_radius_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_radius_calling_station_id": { + "path_match": "ipfix.ntop_radius_calling_station_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_radius_called_station_id": { + "path_match": "ipfix.ntop_radius_called_station_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_radius_nas_ip": { + "path_match": "ipfix.ntop_radius_nas_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_radius_nas_id": { + "path_match": "ipfix.ntop_radius_nas_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_radius_user_imsi": { + "path_match": "ipfix.ntop_radius_user_imsi", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_radius_user_imei": { + "path_match": "ipfix.ntop_radius_user_imei", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_radius_framed_ip": { + "path_match": "ipfix.ntop_radius_framed_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_radius_acct_sess_id": { + "path_match": "ipfix.ntop_radius_acct_sess_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_radius_acct_status_type": { + "path_match": "ipfix.ntop_radius_acct_status_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_radius_acct_in_octets": { + "path_match": "ipfix.ntop_radius_acct_in_octets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_radius_acct_out_octets": { + "path_match": "ipfix.ntop_radius_acct_out_octets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_radius_acct_in_packets": { + "path_match": "ipfix.ntop_radius_acct_in_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_radius_acct_out_packets": { + "path_match": "ipfix.ntop_radius_acct_out_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_imap_login": { + "path_match": "ipfix.ntop_imap_login", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv2_req_msg_type": { + "path_match": "ipfix.ntop_gtpv2_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_resp_msg_type": { + "path_match": "ipfix.ntop_gtpv2_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_c2s_s1u_gtpu_teid": { + "path_match": "ipfix.ntop_gtpv2_c2s_s1u_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_c2s_s1u_gtpu_ip": { + "path_match": "ipfix.ntop_gtpv2_c2s_s1u_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv2_s2c_s1u_gtpu_teid": { + "path_match": "ipfix.ntop_gtpv2_s2c_s1u_gtpu_teid", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv2_s2c_s1u_gtpu_ip": { + "path_match": "ipfix.ntop_gtpv2_s2c_s1u_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv2_end_user_imsi": { + "path_match": "ipfix.ntop_gtpv2_end_user_imsi", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv2_and_user_msisdn": { + "path_match": "ipfix.ntop_gtpv2_and_user_msisdn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv2_apn": { + "path_match": "ipfix.ntop_gtpv2_apn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv2_uli_mcc": { + "path_match": "ipfix.ntop_gtpv2_uli_mcc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_uli_mnc": { + "path_match": "ipfix.ntop_gtpv2_uli_mnc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_uli_cell_tac": { + "path_match": "ipfix.ntop_gtpv2_uli_cell_tac", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_uli_cell_id": { + "path_match": "ipfix.ntop_gtpv2_uli_cell_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_rat_type": { + "path_match": "ipfix.ntop_gtpv2_rat_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_pdn_ip": { + "path_match": "ipfix.ntop_gtpv2_pdn_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv2_end_user_imei": { + "path_match": "ipfix.ntop_gtpv2_end_user_imei", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_src_as_path_1": { + "path_match": "ipfix.ntop_src_as_path_1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_2": { + "path_match": "ipfix.ntop_src_as_path_2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_3": { + "path_match": "ipfix.ntop_src_as_path_3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_4": { + "path_match": "ipfix.ntop_src_as_path_4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_5": { + "path_match": "ipfix.ntop_src_as_path_5", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_6": { + "path_match": "ipfix.ntop_src_as_path_6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_7": { + "path_match": "ipfix.ntop_src_as_path_7", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_8": { + "path_match": "ipfix.ntop_src_as_path_8", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_9": { + "path_match": "ipfix.ntop_src_as_path_9", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_10": { + "path_match": "ipfix.ntop_src_as_path_10", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_1": { + "path_match": "ipfix.ntop_dst_as_path_1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_2": { + "path_match": "ipfix.ntop_dst_as_path_2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_3": { + "path_match": "ipfix.ntop_dst_as_path_3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_4": { + "path_match": "ipfix.ntop_dst_as_path_4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_5": { + "path_match": "ipfix.ntop_dst_as_path_5", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_6": { + "path_match": "ipfix.ntop_dst_as_path_6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_7": { + "path_match": "ipfix.ntop_dst_as_path_7", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_8": { + "path_match": "ipfix.ntop_dst_as_path_8", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_9": { + "path_match": "ipfix.ntop_dst_as_path_9", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_10": { + "path_match": "ipfix.ntop_dst_as_path_10", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_mysql_appl_latency_usec": { + "path_match": "ipfix.ntop_mysql_appl_latency_usec", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv0_req_msg_type": { + "path_match": "ipfix.ntop_gtpv0_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv0_resp_msg_type": { + "path_match": "ipfix.ntop_gtpv0_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv0_tid": { + "path_match": "ipfix.ntop_gtpv0_tid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv0_end_user_ip": { + "path_match": "ipfix.ntop_gtpv0_end_user_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv0_end_user_msisdn": { + "path_match": "ipfix.ntop_gtpv0_end_user_msisdn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv0_apn": { + "path_match": "ipfix.ntop_gtpv0_apn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv0_rai_mcc": { + "path_match": "ipfix.ntop_gtpv0_rai_mcc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv0_rai_mnc": { + "path_match": "ipfix.ntop_gtpv0_rai_mnc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv0_rai_cell_lac": { + "path_match": "ipfix.ntop_gtpv0_rai_cell_lac", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv0_rai_cell_rac": { + "path_match": "ipfix.ntop_gtpv0_rai_cell_rac", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv0_resp_cause": { + "path_match": "ipfix.ntop_gtpv0_resp_cause", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_resp_cause": { + "path_match": "ipfix.ntop_gtpv1_resp_cause", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_resp_cause": { + "path_match": "ipfix.ntop_gtpv2_resp_cause", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_5_32": { + "path_match": "ipfix.ntop_packets_ttl_5_32", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_32_64": { + "path_match": "ipfix.ntop_packets_ttl_32_64", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_64_96": { + "path_match": "ipfix.ntop_packets_ttl_64_96", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_96_128": { + "path_match": "ipfix.ntop_packets_ttl_96_128", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_128_160": { + "path_match": "ipfix.ntop_packets_ttl_128_160", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_160_192": { + "path_match": "ipfix.ntop_packets_ttl_160_192", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_192_224": { + "path_match": "ipfix.ntop_packets_ttl_192_224", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_224_225": { + "path_match": "ipfix.ntop_packets_ttl_224_225", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_rai_lac": { + "path_match": "ipfix.ntop_gtpv1_rai_lac", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_rai_rac": { + "path_match": "ipfix.ntop_gtpv1_rai_rac", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_uli_mcc": { + "path_match": "ipfix.ntop_gtpv1_uli_mcc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_uli_mnc": { + "path_match": "ipfix.ntop_gtpv1_uli_mnc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_2_5": { + "path_match": "ipfix.ntop_packets_ttl_2_5", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_eq_1": { + "path_match": "ipfix.ntop_packets_ttl_eq_1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_sip_call_id": { + "path_match": "ipfix.ntop_rtp_sip_call_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_in_src_osi_sap": { + "path_match": "ipfix.ntop_in_src_osi_sap", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_out_dst_osi_sap": { + "path_match": "ipfix.ntop_out_dst_osi_sap", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_whois_das_domain": { + "path_match": "ipfix.ntop_whois_das_domain", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dns_ttl_answer": { + "path_match": "ipfix.ntop_dns_ttl_answer", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dhcp_client_mac": { + "path_match": "ipfix.ntop_dhcp_client_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dhcp_client_ip": { + "path_match": "ipfix.ntop_dhcp_client_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_dhcp_client": { + "path_match": "ipfix.ntop_dhcp_client", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ftp_login": { + "path_match": "ipfix.ntop_ftp_login", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ftp_password": { + "path_match": "ipfix.ntop_ftp_password", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ftp_command": { + "path_match": "ipfix.ntop_ftp_command", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ftp_command_ret_code": { + "path_match": "ipfix.ntop_ftp_command_ret_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_http_method": { + "path_match": "ipfix.ntop_http_method", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_http_site": { + "path_match": "ipfix.ntop_http_site", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_sip_c_ip": { + "path_match": "ipfix.ntop_sip_c_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_sip_call_state": { + "path_match": "ipfix.ntop_sip_call_state", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_rtp_in_mos": { + "path_match": "ipfix.ntop_rtp_in_mos", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_in_r_factor": { + "path_match": "ipfix.ntop_rtp_in_r_factor", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_proc_user": { + "path_match": "ipfix.ntop_src_proc_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_src_father_proc_pid": { + "path_match": "ipfix.ntop_src_father_proc_pid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_father_proc": { + "path_match": "ipfix.ntop_src_father_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dst_proc_pid": { + "path_match": "ipfix.ntop_dst_proc_pid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_proc": { + "path_match": "ipfix.ntop_dst_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dst_proc_user": { + "path_match": "ipfix.ntop_dst_proc_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dst_father_proc_pid": { + "path_match": "ipfix.ntop_dst_father_proc_pid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_father_proc": { + "path_match": "ipfix.ntop_dst_father_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_rtp_rtt": { + "path_match": "ipfix.ntop_rtp_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_in_transit": { + "path_match": "ipfix.ntop_rtp_in_transit", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_out_transit": { + "path_match": "ipfix.ntop_rtp_out_transit", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_proc_actual_memory": { + "path_match": "ipfix.ntop_src_proc_actual_memory", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_proc_peak_memory": { + "path_match": "ipfix.ntop_src_proc_peak_memory", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_proc_avg_cpu_load": { + "path_match": "ipfix.ntop_src_proc_avg_cpu_load", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_proc_page_faults": { + "path_match": "ipfix.ntop_src_proc_page_faults", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_proc_actual_memory": { + "path_match": "ipfix.ntop_dst_proc_actual_memory", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_proc_peak_memory": { + "path_match": "ipfix.ntop_dst_proc_peak_memory", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_proc_avg_cpu_load": { + "path_match": "ipfix.ntop_dst_proc_avg_cpu_load", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_proc_page_faults": { + "path_match": "ipfix.ntop_dst_proc_page_faults", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_duration_in": { + "path_match": "ipfix.ntop_duration_in", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_duration_out": { + "path_match": "ipfix.ntop_duration_out", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_proc_pctg_iowait": { + "path_match": "ipfix.ntop_src_proc_pctg_iowait", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_proc_pctg_iowait": { + "path_match": "ipfix.ntop_dst_proc_pctg_iowait", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_dtmf_tones": { + "path_match": "ipfix.ntop_rtp_dtmf_tones", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_untunneled_ipv6_src_addr": { + "path_match": "ipfix.ntop_untunneled_ipv6_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_untunneled_ipv6_dst_addr": { + "path_match": "ipfix.ntop_untunneled_ipv6_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_dns_resp": { + "path_match": "ipfix.ntop_dns_resp", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_diameter_req_msg_type": { + "path_match": "ipfix.ntop_diameter_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_diameter_resp_msg_type": { + "path_match": "ipfix.ntop_diameter_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_diameter_req_origin_host": { + "path_match": "ipfix.ntop_diameter_req_origin_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_diameter_resp_origin_host": { + "path_match": "ipfix.ntop_diameter_resp_origin_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_diameter_req_user": { + "path_match": "ipfix.ntop_diameter_req_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_diameter_resp_result_code": { + "path_match": "ipfix.ntop_diameter_resp_result_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_diameter_exp_res_vendor_id": { + "path_match": "ipfix.ntop_diameter_exp_res_vendor_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_diameter_exp_res_result_code": { + "path_match": "ipfix.ntop_diameter_exp_res_result_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_s1ap_enb_ue_s1ap_id": { + "path_match": "ipfix.ntop_s1ap_enb_ue_s1ap_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_s1ap_mme_ue_s1ap_id": { + "path_match": "ipfix.ntop_s1ap_mme_ue_s1ap_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_s1ap_msg_emm_type_mme_to_enb": { + "path_match": "ipfix.ntop_s1ap_msg_emm_type_mme_to_enb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_s1ap_msg_esm_type_mme_to_enb": { + "path_match": "ipfix.ntop_s1ap_msg_esm_type_mme_to_enb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_s1ap_msg_emm_type_enb_to_mme": { + "path_match": "ipfix.ntop_s1ap_msg_emm_type_enb_to_mme", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_s1ap_msg_esm_type_enb_to_mme": { + "path_match": "ipfix.ntop_s1ap_msg_esm_type_enb_to_mme", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_s1ap_cause_enb_to_mme": { + "path_match": "ipfix.ntop_s1ap_cause_enb_to_mme", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_s1ap_detailed_cause_enb_to_mme": { + "path_match": "ipfix.ntop_s1ap_detailed_cause_enb_to_mme", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tcp_win_min_in": { + "path_match": "ipfix.ntop_tcp_win_min_in", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tcp_win_max_in": { + "path_match": "ipfix.ntop_tcp_win_max_in", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tcp_win_mss_in": { + "path_match": "ipfix.ntop_tcp_win_mss_in", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tcp_win_scale_in": { + "path_match": "ipfix.ntop_tcp_win_scale_in", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tcp_win_min_out": { + "path_match": "ipfix.ntop_tcp_win_min_out", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tcp_win_max_out": { + "path_match": "ipfix.ntop_tcp_win_max_out", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tcp_win_mss_out": { + "path_match": "ipfix.ntop_tcp_win_mss_out", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tcp_win_scale_out": { + "path_match": "ipfix.ntop_tcp_win_scale_out", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dhcp_remote_id": { + "path_match": "ipfix.ntop_dhcp_remote_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dhcp_subscriber_id": { + "path_match": "ipfix.ntop_dhcp_subscriber_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_src_proc_uid": { + "path_match": "ipfix.ntop_src_proc_uid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_proc_uid": { + "path_match": "ipfix.ntop_dst_proc_uid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_application": { + "path_match": "ipfix.ntop_application", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_user": { + "path_match": "ipfix.ntop_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dhcp_message_type": { + "path_match": "ipfix.ntop_dhcp_message_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_rtp_in_packets_drop": { + "path_match": "ipfix.ntop_rtp_in_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_out_packets_drop": { + "path_match": "ipfix.ntop_rtp_out_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_out_mos": { + "path_match": "ipfix.ntop_rtp_out_mos", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_out_r_factor": { + "path_match": "ipfix.ntop_rtp_out_r_factor", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_mos": { + "path_match": "ipfix.ntop_rtp_mos", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gptv2_s5_s8_gtpc_teid": { + "path_match": "ipfix.ntop_gptv2_s5_s8_gtpc_teid", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_rtp_r_factor": { + "path_match": "ipfix.ntop_rtp_r_factor", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_ssrc": { + "path_match": "ipfix.ntop_rtp_ssrc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_payload_hash": { + "path_match": "ipfix.ntop_payload_hash", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_teid": { + "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_teid": { + "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_ip": { + "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_ip": { + "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_src_as_map": { + "path_match": "ipfix.ntop_src_as_map", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dst_as_map": { + "path_match": "ipfix.ntop_dst_as_map", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_diameter_hop_by_hop_id": { + "path_match": "ipfix.ntop_diameter_hop_by_hop_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_upstream_sess_id": { + "path_match": "ipfix.ntop_upstream_sess_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_downstream_sess_id": { + "path_match": "ipfix.ntop_downstream_sess_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_long": { + "path_match": "ipfix.ntop_src_long", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.ntop_src_lat": { + "path_match": "ipfix.ntop_src_lat", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.ntop_dst_long": { + "path_match": "ipfix.ntop_dst_long", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.ntop_dst_lat": { + "path_match": "ipfix.ntop_dst_lat", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.ntop_diameter_clr_cancel_type": { + "path_match": "ipfix.ntop_diameter_clr_cancel_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_diameter_clr_flags": { + "path_match": "ipfix.ntop_diameter_clr_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_c2s_s5_s8_gtpc_ip": { + "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_gtpc_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv2_s2c_s5_s8_gtpc_ip": { + "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_gtpc_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid": { + "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid": { + "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip": { + "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip": { + "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_http_x_forwarded_for": { + "path_match": "ipfix.ntop_http_x_forwarded_for", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_http_via": { + "path_match": "ipfix.ntop_http_via", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ssdp_host": { + "path_match": "ipfix.ntop_ssdp_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ssdp_usn": { + "path_match": "ipfix.ntop_ssdp_usn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_netbios_query": { + "path_match": "ipfix.ntop_netbios_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_netbios_query_type": { + "path_match": "ipfix.ntop_netbios_query_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_netbios_resp": { + "path_match": "ipfix.ntop_netbios_resp", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_netbios_query_os": { + "path_match": "ipfix.ntop_netbios_query_os", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ssdp_server": { + "path_match": "ipfix.ntop_ssdp_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ssdp_type": { + "path_match": "ipfix.ntop_ssdp_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ssdp_method": { + "path_match": "ipfix.ntop_ssdp_method", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_nprobe_ipv4_addr": { + "path_match": "ipfix.ntop_nprobe_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, - { - "ipfix.pan_app": { - "path_match": "ipfix.pan_app", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.pan_user": { - "path_match": "ipfix.pan_user", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.pan_app": { + "path_match": "ipfix.pan_app", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.pan_user": { + "path_match": "ipfix.pan_user", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.plixer_client_ipv4_addr": { - "path_match": "ipfix.plixer_client_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.plixer_client_hostname": { - "path_match": "ipfix.plixer_client_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_partner": { - "path_match": "ipfix.plixer_partner", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_server_hostname": { - "path_match": "ipfix.plixer_server_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_server_ipv4_addr": { - "path_match": "ipfix.plixer_server_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.plixer_recipient_addr": { - "path_match": "ipfix.plixer_recipient_addr", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_event_id": { - "path_match": "ipfix.plixer_event_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.plixer_msg_id": { - "path_match": "ipfix.plixer_msg_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_priority": { - "path_match": "ipfix.plixer_priority", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.plixer_recipient_report_status": { - "path_match": "ipfix.plixer_recipient_report_status", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.plixer_recipients": { - "path_match": "ipfix.plixer_recipients", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.plixer_origination_time": { - "path_match": "ipfix.plixer_origination_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.plixer_encryption": { - "path_match": "ipfix.plixer_encryption", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.plixer_service_ver": { - "path_match": "ipfix.plixer_service_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_linked_msg_id": { - "path_match": "ipfix.plixer_linked_msg_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_msg_subject": { - "path_match": "ipfix.plixer_msg_subject", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_sender_addr": { - "path_match": "ipfix.plixer_sender_addr", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_date_time": { - "path_match": "ipfix.plixer_date_time", - "mapping": { - "type": "long" - } - } - }, + { + "ipfix.plixer_client_ipv4_addr": { + "path_match": "ipfix.plixer_client_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.plixer_client_hostname": { + "path_match": "ipfix.plixer_client_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_partner": { + "path_match": "ipfix.plixer_partner", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_server_hostname": { + "path_match": "ipfix.plixer_server_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_server_ipv4_addr": { + "path_match": "ipfix.plixer_server_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.plixer_recipient_addr": { + "path_match": "ipfix.plixer_recipient_addr", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_event_id": { + "path_match": "ipfix.plixer_event_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.plixer_msg_id": { + "path_match": "ipfix.plixer_msg_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_priority": { + "path_match": "ipfix.plixer_priority", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.plixer_recipient_report_status": { + "path_match": "ipfix.plixer_recipient_report_status", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.plixer_recipients": { + "path_match": "ipfix.plixer_recipients", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.plixer_origination_time": { + "path_match": "ipfix.plixer_origination_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.plixer_encryption": { + "path_match": "ipfix.plixer_encryption", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.plixer_service_ver": { + "path_match": "ipfix.plixer_service_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_linked_msg_id": { + "path_match": "ipfix.plixer_linked_msg_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_msg_subject": { + "path_match": "ipfix.plixer_msg_subject", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_sender_addr": { + "path_match": "ipfix.plixer_sender_addr", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_date_time": { + "path_match": "ipfix.plixer_date_time", + "mapping": { + "type": "long" + } + } + }, - { - "ipfix.pluribus_latency_usec": { - "path_match": "ipfix.pluribus_latency_usec", - "mapping": { - "type": "long" - } - } - }, - - - - { - "ipfix.procera_service": { - "path_match": "ipfix.procera_service", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_base_service": { - "path_match": "ipfix.procera_base_service", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_in_bytes": { - "path_match": "ipfix.procera_in_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_bytes": { - "path_match": "ipfix.procera_out_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_packets": { - "path_match": "ipfix.procera_in_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_packets": { - "path_match": "ipfix.procera_out_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_shaping_latency": { - "path_match": "ipfix.procera_in_shaping_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_shaping_latency": { - "path_match": "ipfix.procera_out_shaping_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_shaping_drops": { - "path_match": "ipfix.procera_in_shaping_drops", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_shaping_drops": { - "path_match": "ipfix.procera_out_shaping_drops", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_int_rtt": { - "path_match": "ipfix.procera_int_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_ext_rtt": { - "path_match": "ipfix.procera_ext_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_flow_behavior": { - "path_match": "ipfix.procera_flow_behavior", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_content_cat": { - "path_match": "ipfix.procera_content_cat", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_property": { - "path_match": "ipfix.procera_property", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_server_hostname": { - "path_match": "ipfix.procera_server_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_http_req_method": { - "path_match": "ipfix.procera_http_req_method", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_http_user_agent": { - "path_match": "ipfix.procera_http_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_http_content_type": { - "path_match": "ipfix.procera_http_content_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_http_url": { - "path_match": "ipfix.procera_http_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_http_referrer": { - "path_match": "ipfix.procera_http_referrer", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_http_resp_status": { - "path_match": "ipfix.procera_http_resp_status", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_http_file_len": { - "path_match": "ipfix.procera_http_file_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_http_location": { - "path_match": "ipfix.procera_http_location", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_http_lang": { - "path_match": "ipfix.procera_http_lang", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_subscriber": { - "path_match": "ipfix.procera_subscriber", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_msisdn": { - "path_match": "ipfix.procera_msisdn", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_imsi": { - "path_match": "ipfix.procera_imsi", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_rat": { - "path_match": "ipfix.procera_rat", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_device": { - "path_match": "ipfix.procera_device", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_sgsn": { - "path_match": "ipfix.procera_sgsn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_rnc": { - "path_match": "ipfix.procera_rnc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_apn": { - "path_match": "ipfix.procera_apn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_user_location_info": { - "path_match": "ipfix.procera_user_location_info", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_ggsn": { - "path_match": "ipfix.procera_ggsn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_qoe_in_int": { - "path_match": "ipfix.procera_qoe_in_int", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.procera_qoe_in_ext": { - "path_match": "ipfix.procera_qoe_in_ext", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.procera_qoe_out_int": { - "path_match": "ipfix.procera_qoe_out_int", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.procera_qoe_out_ext": { - "path_match": "ipfix.procera_qoe_out_ext", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.procera_local_ipv4_host": { - "path_match": "ipfix.procera_local_ipv4_host", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.procera_local_ipv6_host": { - "path_match": "ipfix.procera_local_ipv6_host", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.procera_remote_ipv4_host": { - "path_match": "ipfix.procera_remote_ipv4_host", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.procera_remote_ipv6_host": { - "path_match": "ipfix.procera_remote_ipv6_host", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.procera_http_req_ver": { - "path_match": "ipfix.procera_http_req_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_template": { - "path_match": "ipfix.procera_template", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_in_dscp": { - "path_match": "ipfix.procera_in_dscp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dscp": { - "path_match": "ipfix.procera_out_dscp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_dot1q_vlanid_level_1": { - "path_match": "ipfix.procera_in_dot1q_vlanid_level_1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_dot1q_vlanid_level_2": { - "path_match": "ipfix.procera_in_dot1q_vlanid_level_2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_dot1q_vlanid_level_3": { - "path_match": "ipfix.procera_in_dot1q_vlanid_level_3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_dot1q_vlanid_level_4": { - "path_match": "ipfix.procera_in_dot1q_vlanid_level_4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dot1q_vlanid_level_1": { - "path_match": "ipfix.procera_out_dot1q_vlanid_level_1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dot1q_vlanid_level_2": { - "path_match": "ipfix.procera_out_dot1q_vlanid_level_2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dot1q_vlanid_level_3": { - "path_match": "ipfix.procera_out_dot1q_vlanid_level_3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dot1q_vlanid_level_4": { - "path_match": "ipfix.procera_out_dot1q_vlanid_level_4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_dot1q_priority_level_1": { - "path_match": "ipfix.procera_in_dot1q_priority_level_1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_dot1q_priority_level_2": { - "path_match": "ipfix.procera_in_dot1q_priority_level_2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_dot1q_priority_level_3": { - "path_match": "ipfix.procera_in_dot1q_priority_level_3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_dot1q_priority_level_4": { - "path_match": "ipfix.procera_in_dot1q_priority_level_4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dot1q_priority_level_1": { - "path_match": "ipfix.procera_out_dot1q_priority_level_1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dot1q_priority_level_2": { - "path_match": "ipfix.procera_out_dot1q_priority_level_2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dot1q_priority_level_3": { - "path_match": "ipfix.procera_out_dot1q_priority_level_3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dot1q_priority_level_4": { - "path_match": "ipfix.procera_out_dot1q_priority_level_4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_internal_jitter": { - "path_match": "ipfix.procera_internal_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_service_object": { - "path_match": "ipfix.procera_service_object", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_remote_geoip": { - "path_match": "ipfix.procera_remote_geoip", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.pluribus_latency_usec": { + "path_match": "ipfix.pluribus_latency_usec", + "mapping": { + "type": "long" + } + } + }, + + + + { + "ipfix.procera_service": { + "path_match": "ipfix.procera_service", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_base_service": { + "path_match": "ipfix.procera_base_service", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_in_bytes": { + "path_match": "ipfix.procera_in_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_bytes": { + "path_match": "ipfix.procera_out_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_packets": { + "path_match": "ipfix.procera_in_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_packets": { + "path_match": "ipfix.procera_out_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_shaping_latency": { + "path_match": "ipfix.procera_in_shaping_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_shaping_latency": { + "path_match": "ipfix.procera_out_shaping_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_shaping_drops": { + "path_match": "ipfix.procera_in_shaping_drops", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_shaping_drops": { + "path_match": "ipfix.procera_out_shaping_drops", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_int_rtt": { + "path_match": "ipfix.procera_int_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_ext_rtt": { + "path_match": "ipfix.procera_ext_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_flow_behavior": { + "path_match": "ipfix.procera_flow_behavior", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_content_cat": { + "path_match": "ipfix.procera_content_cat", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_property": { + "path_match": "ipfix.procera_property", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_server_hostname": { + "path_match": "ipfix.procera_server_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_http_req_method": { + "path_match": "ipfix.procera_http_req_method", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_http_user_agent": { + "path_match": "ipfix.procera_http_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_http_content_type": { + "path_match": "ipfix.procera_http_content_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_http_url": { + "path_match": "ipfix.procera_http_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_http_referrer": { + "path_match": "ipfix.procera_http_referrer", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_http_resp_status": { + "path_match": "ipfix.procera_http_resp_status", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_http_file_len": { + "path_match": "ipfix.procera_http_file_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_http_location": { + "path_match": "ipfix.procera_http_location", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_http_lang": { + "path_match": "ipfix.procera_http_lang", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_subscriber": { + "path_match": "ipfix.procera_subscriber", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_msisdn": { + "path_match": "ipfix.procera_msisdn", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_imsi": { + "path_match": "ipfix.procera_imsi", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_rat": { + "path_match": "ipfix.procera_rat", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_device": { + "path_match": "ipfix.procera_device", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_sgsn": { + "path_match": "ipfix.procera_sgsn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_rnc": { + "path_match": "ipfix.procera_rnc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_apn": { + "path_match": "ipfix.procera_apn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_user_location_info": { + "path_match": "ipfix.procera_user_location_info", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_ggsn": { + "path_match": "ipfix.procera_ggsn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_qoe_in_int": { + "path_match": "ipfix.procera_qoe_in_int", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.procera_qoe_in_ext": { + "path_match": "ipfix.procera_qoe_in_ext", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.procera_qoe_out_int": { + "path_match": "ipfix.procera_qoe_out_int", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.procera_qoe_out_ext": { + "path_match": "ipfix.procera_qoe_out_ext", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.procera_local_ipv4_host": { + "path_match": "ipfix.procera_local_ipv4_host", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.procera_local_ipv6_host": { + "path_match": "ipfix.procera_local_ipv6_host", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.procera_remote_ipv4_host": { + "path_match": "ipfix.procera_remote_ipv4_host", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.procera_remote_ipv6_host": { + "path_match": "ipfix.procera_remote_ipv6_host", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.procera_http_req_ver": { + "path_match": "ipfix.procera_http_req_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_template": { + "path_match": "ipfix.procera_template", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_in_dscp": { + "path_match": "ipfix.procera_in_dscp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dscp": { + "path_match": "ipfix.procera_out_dscp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_dot1q_vlanid_level_1": { + "path_match": "ipfix.procera_in_dot1q_vlanid_level_1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_dot1q_vlanid_level_2": { + "path_match": "ipfix.procera_in_dot1q_vlanid_level_2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_dot1q_vlanid_level_3": { + "path_match": "ipfix.procera_in_dot1q_vlanid_level_3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_dot1q_vlanid_level_4": { + "path_match": "ipfix.procera_in_dot1q_vlanid_level_4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dot1q_vlanid_level_1": { + "path_match": "ipfix.procera_out_dot1q_vlanid_level_1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dot1q_vlanid_level_2": { + "path_match": "ipfix.procera_out_dot1q_vlanid_level_2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dot1q_vlanid_level_3": { + "path_match": "ipfix.procera_out_dot1q_vlanid_level_3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dot1q_vlanid_level_4": { + "path_match": "ipfix.procera_out_dot1q_vlanid_level_4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_dot1q_priority_level_1": { + "path_match": "ipfix.procera_in_dot1q_priority_level_1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_dot1q_priority_level_2": { + "path_match": "ipfix.procera_in_dot1q_priority_level_2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_dot1q_priority_level_3": { + "path_match": "ipfix.procera_in_dot1q_priority_level_3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_dot1q_priority_level_4": { + "path_match": "ipfix.procera_in_dot1q_priority_level_4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dot1q_priority_level_1": { + "path_match": "ipfix.procera_out_dot1q_priority_level_1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dot1q_priority_level_2": { + "path_match": "ipfix.procera_out_dot1q_priority_level_2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dot1q_priority_level_3": { + "path_match": "ipfix.procera_out_dot1q_priority_level_3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dot1q_priority_level_4": { + "path_match": "ipfix.procera_out_dot1q_priority_level_4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_internal_jitter": { + "path_match": "ipfix.procera_internal_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_service_object": { + "path_match": "ipfix.procera_service_object", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_remote_geoip": { + "path_match": "ipfix.procera_remote_geoip", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.redsocks_http_hostname": { - "path_match": "ipfix.redsocks_http_hostname", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.redsocks_http_hostname": { + "path_match": "ipfix.redsocks_http_hostname", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.sonic_timestamp": { - "path_match": "ipfix.sonic_timestamp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_id": { - "path_match": "ipfix.sonic_flow_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_initiator_gw_mac": { - "path_match": "ipfix.sonic_initiator_gw_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_responder_gw_mac": { - "path_match": "ipfix.sonic_responder_gw_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_initiator_ip": { - "path_match": "ipfix.sonic_initiator_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_responder_ip": { - "path_match": "ipfix.sonic_responder_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_initiator_gw_ip": { - "path_match": "ipfix.sonic_initiator_gw_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_responder_gw_ip": { - "path_match": "ipfix.sonic_responder_gw_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_initiator_iface": { - "path_match": "ipfix.sonic_initiator_iface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_responder_iface": { - "path_match": "ipfix.sonic_responder_iface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_initiator_port": { - "path_match": "ipfix.sonic_initiator_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_responder_port": { - "path_match": "ipfix.sonic_responder_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_init_to_resp_packets": { - "path_match": "ipfix.sonic_init_to_resp_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_init_to_resp_bytes": { - "path_match": "ipfix.sonic_init_to_resp_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_resp_to_init_packets": { - "path_match": "ipfix.sonic_resp_to_init_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_resp_to_init_bytes": { - "path_match": "ipfix.sonic_resp_to_init_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_start_time": { - "path_match": "ipfix.sonic_flow_start_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_end_time": { - "path_match": "ipfix.sonic_flow_end_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_internal_flags": { - "path_match": "ipfix.sonic_internal_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_protocol_type": { - "path_match": "ipfix.sonic_protocol_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_application_id": { - "path_match": "ipfix.sonic_application_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_ips_id": { - "path_match": "ipfix.sonic_ips_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_virus_id": { - "path_match": "ipfix.sonic_virus_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_spyware_id": { - "path_match": "ipfix.sonic_spyware_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_template_id": { - "path_match": "ipfix.sonic_template_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_table": { - "path_match": "ipfix.sonic_table", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_column_id": { - "path_match": "ipfix.sonic_column_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_column": { - "path_match": "ipfix.sonic_column", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_column_type": { - "path_match": "ipfix.sonic_column_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_column_standard_ipfix_id": { - "path_match": "ipfix.sonic_column_standard_ipfix_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_user_index": { - "path_match": "ipfix.sonic_user_index", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_user": { - "path_match": "ipfix.sonic_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_user_id": { - "path_match": "ipfix.sonic_user_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_user_domain": { - "path_match": "ipfix.sonic_user_domain", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_user_auth_type": { - "path_match": "ipfix.sonic_user_auth_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app_index": { - "path_match": "ipfix.sonic_app_index", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app_id": { - "path_match": "ipfix.sonic_app_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app": { - "path_match": "ipfix.sonic_app", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_app_cat_id": { - "path_match": "ipfix.sonic_app_cat_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app_cat": { - "path_match": "ipfix.sonic_app_cat", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_app_sig_id": { - "path_match": "ipfix.sonic_app_sig_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_gav_index": { - "path_match": "ipfix.sonic_gav_index", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_gav": { - "path_match": "ipfix.sonic_gav", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_gav_sig_id": { - "path_match": "ipfix.sonic_gav_sig_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_ips_index": { - "path_match": "ipfix.sonic_ips_index", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_ips": { - "path_match": "ipfix.sonic_ips", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_ips_cat_id": { - "path_match": "ipfix.sonic_ips_cat_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_ips_cat": { - "path_match": "ipfix.sonic_ips_cat", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_ips_sig_id": { - "path_match": "ipfix.sonic_ips_sig_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_aspy_index": { - "path_match": "ipfix.sonic_aspy_index", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_aspy": { - "path_match": "ipfix.sonic_aspy", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_aspy_prod_id": { - "path_match": "ipfix.sonic_aspy_prod_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_aspy_prod": { - "path_match": "ipfix.sonic_aspy_prod", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_aspy_sig_id": { - "path_match": "ipfix.sonic_aspy_sig_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_url": { - "path_match": "ipfix.sonic_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_url_ip": { - "path_match": "ipfix.sonic_url_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_rating_index": { - "path_match": "ipfix.sonic_rating_index", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_rating": { - "path_match": "ipfix.sonic_rating", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_region_id": { - "path_match": "ipfix.sonic_region_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_country_id": { - "path_match": "ipfix.sonic_country_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_country": { - "path_match": "ipfix.sonic_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_region": { - "path_match": "ipfix.sonic_region", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_location_ip": { - "path_match": "ipfix.sonic_location_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_location_region_id": { - "path_match": "ipfix.sonic_location_region_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_location_domain": { - "path_match": "ipfix.sonic_location_domain", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_if_stat_iface": { - "path_match": "ipfix.sonic_if_stat_iface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_in_packets_rate": { - "path_match": "ipfix.sonic_if_stat_in_packets_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_out_packets_rate": { - "path_match": "ipfix.sonic_if_stat_out_packets_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_in_bytes_rate": { - "path_match": "ipfix.sonic_if_stat_in_bytes_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_out_bytes_rate": { - "path_match": "ipfix.sonic_if_stat_out_bytes_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_in_packet_size": { - "path_match": "ipfix.sonic_if_stat_in_packet_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_out_packet_size": { - "path_match": "ipfix.sonic_if_stat_out_packet_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_conn_rate": { - "path_match": "ipfix.sonic_if_stat_conn_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_init_bytes_rate": { - "path_match": "ipfix.sonic_flow_init_bytes_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_resp_bytes_rate": { - "path_match": "ipfix.sonic_flow_resp_bytes_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_init_packet_rate": { - "path_match": "ipfix.sonic_flow_init_packet_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_resp_packet_rate": { - "path_match": "ipfix.sonic_flow_resp_packet_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_init_packet_size": { - "path_match": "ipfix.sonic_flow_init_packet_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_resp_packet_size": { - "path_match": "ipfix.sonic_flow_resp_packet_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_if_name": { - "path_match": "ipfix.sonic_if_stat_if_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_if_stat_if_type": { - "path_match": "ipfix.sonic_if_stat_if_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_if_speed": { - "path_match": "ipfix.sonic_if_stat_if_speed", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_if_state": { - "path_match": "ipfix.sonic_if_stat_if_state", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_if_mtu": { - "path_match": "ipfix.sonic_if_stat_if_mtu", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_if_mode": { - "path_match": "ipfix.sonic_if_stat_if_mode", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_url_flow_id": { - "path_match": "ipfix.sonic_url_flow_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_url_time_id": { - "path_match": "ipfix.sonic_url_time_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_core_stat_core_id": { - "path_match": "ipfix.sonic_core_stat_core_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_core_stat_core_util": { - "path_match": "ipfix.sonic_core_stat_core_util", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_flow_id": { - "path_match": "ipfix.sonic_voip_flow_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_time_id": { - "path_match": "ipfix.sonic_voip_time_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_init_call_id": { - "path_match": "ipfix.sonic_voip_init_call_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_voip_resp_call_id": { - "path_match": "ipfix.sonic_voip_resp_call_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_media_type": { - "path_match": "ipfix.sonic_media_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_media_protocol": { - "path_match": "ipfix.sonic_media_protocol", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_service": { - "path_match": "ipfix.sonic_service", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_service_ip_type": { - "path_match": "ipfix.sonic_service_ip_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_service_port_begin": { - "path_match": "ipfix.sonic_service_port_begin", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_service_port_end": { - "path_match": "ipfix.sonic_service_port_end", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_spam_sess_id": { - "path_match": "ipfix.sonic_spam_sess_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_spam_flow_id": { - "path_match": "ipfix.sonic_spam_flow_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_spam_time_id": { - "path_match": "ipfix.sonic_spam_time_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_spam_spammer": { - "path_match": "ipfix.sonic_spam_spammer", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_spam_type": { - "path_match": "ipfix.sonic_spam_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_spam_to_email": { - "path_match": "ipfix.sonic_spam_to_email", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_spam_from_email": { - "path_match": "ipfix.sonic_spam_from_email", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_mem_total_ram": { - "path_match": "ipfix.sonic_mem_total_ram", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_mem_avail_ram": { - "path_match": "ipfix.sonic_mem_avail_ram", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_mem_used_ram": { - "path_match": "ipfix.sonic_mem_used_ram", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_mem_db_ram": { - "path_match": "ipfix.sonic_mem_db_ram", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_mem_flows": { - "path_match": "ipfix.sonic_mem_flows", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_mem_per_flow": { - "path_match": "ipfix.sonic_mem_per_flow", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_dev_iface_id": { - "path_match": "ipfix.sonic_dev_iface_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_dev_ip": { - "path_match": "ipfix.sonic_dev_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_dev_mac": { - "path_match": "ipfix.sonic_dev_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_dev_name": { - "path_match": "ipfix.sonic_dev_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_vpn_in_spi_id": { - "path_match": "ipfix.sonic_vpn_in_spi_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_vpn_out_spi_id": { - "path_match": "ipfix.sonic_vpn_out_spi_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_vpn_tunnel": { - "path_match": "ipfix.sonic_vpn_tunnel", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_vpn_local_gw": { - "path_match": "ipfix.sonic_vpn_local_gw", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_vpn_remote_gw": { - "path_match": "ipfix.sonic_vpn_remote_gw", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_vpn_tunnel_iface_id": { - "path_match": "ipfix.sonic_vpn_tunnel_iface_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_vpn_policy_type": { - "path_match": "ipfix.sonic_vpn_policy_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_vpn_protocol_type": { - "path_match": "ipfix.sonic_vpn_protocol_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_vpn_encrypt_type": { - "path_match": "ipfix.sonic_vpn_encrypt_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_vpn_auth_type": { - "path_match": "ipfix.sonic_vpn_auth_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_vpn_start_time": { - "path_match": "ipfix.sonic_vpn_start_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_vpn_end_time": { - "path_match": "ipfix.sonic_vpn_end_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_init_vpn_spi_out": { - "path_match": "ipfix.sonic_init_vpn_spi_out", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_resp_vpn_spi_out": { - "path_match": "ipfix.sonic_resp_vpn_spi_out", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_init_to_resp_delta_packets": { - "path_match": "ipfix.sonic_init_to_resp_delta_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_init_to_resp_delta_bytes": { - "path_match": "ipfix.sonic_init_to_resp_delta_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_resp_to_init_delta_packets": { - "path_match": "ipfix.sonic_resp_to_init_delta_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_resp_to_init_delta_bytes": { - "path_match": "ipfix.sonic_resp_to_init_delta_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_block_reason": { - "path_match": "ipfix.sonic_flow_block_reason", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_mac": { - "path_match": "ipfix.sonic_if_stat_mac", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_ip": { - "path_match": "ipfix.sonic_if_stat_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_if_stat_security_type": { - "path_match": "ipfix.sonic_if_stat_security_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_zone": { - "path_match": "ipfix.sonic_if_stat_zone", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_user_ip": { - "path_match": "ipfix.sonic_user_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_url_rating_val1": { - "path_match": "ipfix.sonic_url_rating_val1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_url_rating_val2": { - "path_match": "ipfix.sonic_url_rating_val2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_url_rating_val3": { - "path_match": "ipfix.sonic_url_rating_val3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_url_rating_val4": { - "path_match": "ipfix.sonic_url_rating_val4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app_bwm_attr": { - "path_match": "ipfix.sonic_app_bwm_attr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_init_to_resp_lost_packets": { - "path_match": "ipfix.sonic_voip_init_to_resp_lost_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_resp_to_init_lost_packets": { - "path_match": "ipfix.sonic_voip_resp_to_init_lost_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_init_to_resp_avg_latency": { - "path_match": "ipfix.sonic_voip_init_to_resp_avg_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_init_to_resp_max_latency": { - "path_match": "ipfix.sonic_voip_init_to_resp_max_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_resp_to_init_avg_latency": { - "path_match": "ipfix.sonic_voip_resp_to_init_avg_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_resp_to_init_max_latency": { - "path_match": "ipfix.sonic_voip_resp_to_init_max_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app_content_type": { - "path_match": "ipfix.sonic_app_content_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_snwl_option": { - "path_match": "ipfix.sonic_snwl_option", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app_risk_attr": { - "path_match": "ipfix.sonic_app_risk_attr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app_tech_attr": { - "path_match": "ipfix.sonic_app_tech_attr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app_attr_bit_mask": { - "path_match": "ipfix.sonic_app_attr_bit_mask", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_top_apps_sigid": { - "path_match": "ipfix.sonic_top_apps_sigid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_top_apps_appname": { - "path_match": "ipfix.sonic_top_apps_appname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_top_apps_rate": { - "path_match": "ipfix.sonic_top_apps_rate", - "mapping": { - "type": "long" - } - } - }, + { + "ipfix.sonic_timestamp": { + "path_match": "ipfix.sonic_timestamp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_id": { + "path_match": "ipfix.sonic_flow_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_initiator_gw_mac": { + "path_match": "ipfix.sonic_initiator_gw_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_responder_gw_mac": { + "path_match": "ipfix.sonic_responder_gw_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_initiator_ip": { + "path_match": "ipfix.sonic_initiator_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_responder_ip": { + "path_match": "ipfix.sonic_responder_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_initiator_gw_ip": { + "path_match": "ipfix.sonic_initiator_gw_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_responder_gw_ip": { + "path_match": "ipfix.sonic_responder_gw_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_initiator_iface": { + "path_match": "ipfix.sonic_initiator_iface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_responder_iface": { + "path_match": "ipfix.sonic_responder_iface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_initiator_port": { + "path_match": "ipfix.sonic_initiator_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_responder_port": { + "path_match": "ipfix.sonic_responder_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_init_to_resp_packets": { + "path_match": "ipfix.sonic_init_to_resp_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_init_to_resp_bytes": { + "path_match": "ipfix.sonic_init_to_resp_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_resp_to_init_packets": { + "path_match": "ipfix.sonic_resp_to_init_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_resp_to_init_bytes": { + "path_match": "ipfix.sonic_resp_to_init_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_start_time": { + "path_match": "ipfix.sonic_flow_start_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_end_time": { + "path_match": "ipfix.sonic_flow_end_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_internal_flags": { + "path_match": "ipfix.sonic_internal_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_protocol_type": { + "path_match": "ipfix.sonic_protocol_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_application_id": { + "path_match": "ipfix.sonic_application_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_ips_id": { + "path_match": "ipfix.sonic_ips_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_virus_id": { + "path_match": "ipfix.sonic_virus_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_spyware_id": { + "path_match": "ipfix.sonic_spyware_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_template_id": { + "path_match": "ipfix.sonic_template_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_table": { + "path_match": "ipfix.sonic_table", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_column_id": { + "path_match": "ipfix.sonic_column_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_column": { + "path_match": "ipfix.sonic_column", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_column_type": { + "path_match": "ipfix.sonic_column_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_column_standard_ipfix_id": { + "path_match": "ipfix.sonic_column_standard_ipfix_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_user_index": { + "path_match": "ipfix.sonic_user_index", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_user": { + "path_match": "ipfix.sonic_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_user_id": { + "path_match": "ipfix.sonic_user_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_user_domain": { + "path_match": "ipfix.sonic_user_domain", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_user_auth_type": { + "path_match": "ipfix.sonic_user_auth_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app_index": { + "path_match": "ipfix.sonic_app_index", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app_id": { + "path_match": "ipfix.sonic_app_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app": { + "path_match": "ipfix.sonic_app", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_app_cat_id": { + "path_match": "ipfix.sonic_app_cat_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app_cat": { + "path_match": "ipfix.sonic_app_cat", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_app_sig_id": { + "path_match": "ipfix.sonic_app_sig_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_gav_index": { + "path_match": "ipfix.sonic_gav_index", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_gav": { + "path_match": "ipfix.sonic_gav", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_gav_sig_id": { + "path_match": "ipfix.sonic_gav_sig_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_ips_index": { + "path_match": "ipfix.sonic_ips_index", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_ips": { + "path_match": "ipfix.sonic_ips", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_ips_cat_id": { + "path_match": "ipfix.sonic_ips_cat_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_ips_cat": { + "path_match": "ipfix.sonic_ips_cat", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_ips_sig_id": { + "path_match": "ipfix.sonic_ips_sig_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_aspy_index": { + "path_match": "ipfix.sonic_aspy_index", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_aspy": { + "path_match": "ipfix.sonic_aspy", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_aspy_prod_id": { + "path_match": "ipfix.sonic_aspy_prod_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_aspy_prod": { + "path_match": "ipfix.sonic_aspy_prod", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_aspy_sig_id": { + "path_match": "ipfix.sonic_aspy_sig_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_url": { + "path_match": "ipfix.sonic_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_url_ip": { + "path_match": "ipfix.sonic_url_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_rating_index": { + "path_match": "ipfix.sonic_rating_index", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_rating": { + "path_match": "ipfix.sonic_rating", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_region_id": { + "path_match": "ipfix.sonic_region_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_country_id": { + "path_match": "ipfix.sonic_country_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_country": { + "path_match": "ipfix.sonic_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_region": { + "path_match": "ipfix.sonic_region", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_location_ip": { + "path_match": "ipfix.sonic_location_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_location_region_id": { + "path_match": "ipfix.sonic_location_region_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_location_domain": { + "path_match": "ipfix.sonic_location_domain", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_if_stat_iface": { + "path_match": "ipfix.sonic_if_stat_iface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_in_packets_rate": { + "path_match": "ipfix.sonic_if_stat_in_packets_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_out_packets_rate": { + "path_match": "ipfix.sonic_if_stat_out_packets_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_in_bytes_rate": { + "path_match": "ipfix.sonic_if_stat_in_bytes_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_out_bytes_rate": { + "path_match": "ipfix.sonic_if_stat_out_bytes_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_in_packet_size": { + "path_match": "ipfix.sonic_if_stat_in_packet_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_out_packet_size": { + "path_match": "ipfix.sonic_if_stat_out_packet_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_conn_rate": { + "path_match": "ipfix.sonic_if_stat_conn_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_init_bytes_rate": { + "path_match": "ipfix.sonic_flow_init_bytes_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_resp_bytes_rate": { + "path_match": "ipfix.sonic_flow_resp_bytes_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_init_packet_rate": { + "path_match": "ipfix.sonic_flow_init_packet_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_resp_packet_rate": { + "path_match": "ipfix.sonic_flow_resp_packet_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_init_packet_size": { + "path_match": "ipfix.sonic_flow_init_packet_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_resp_packet_size": { + "path_match": "ipfix.sonic_flow_resp_packet_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_if_name": { + "path_match": "ipfix.sonic_if_stat_if_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_if_stat_if_type": { + "path_match": "ipfix.sonic_if_stat_if_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_if_speed": { + "path_match": "ipfix.sonic_if_stat_if_speed", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_if_state": { + "path_match": "ipfix.sonic_if_stat_if_state", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_if_mtu": { + "path_match": "ipfix.sonic_if_stat_if_mtu", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_if_mode": { + "path_match": "ipfix.sonic_if_stat_if_mode", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_url_flow_id": { + "path_match": "ipfix.sonic_url_flow_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_url_time_id": { + "path_match": "ipfix.sonic_url_time_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_core_stat_core_id": { + "path_match": "ipfix.sonic_core_stat_core_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_core_stat_core_util": { + "path_match": "ipfix.sonic_core_stat_core_util", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_flow_id": { + "path_match": "ipfix.sonic_voip_flow_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_time_id": { + "path_match": "ipfix.sonic_voip_time_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_init_call_id": { + "path_match": "ipfix.sonic_voip_init_call_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_voip_resp_call_id": { + "path_match": "ipfix.sonic_voip_resp_call_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_media_type": { + "path_match": "ipfix.sonic_media_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_media_protocol": { + "path_match": "ipfix.sonic_media_protocol", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_service": { + "path_match": "ipfix.sonic_service", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_service_ip_type": { + "path_match": "ipfix.sonic_service_ip_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_service_port_begin": { + "path_match": "ipfix.sonic_service_port_begin", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_service_port_end": { + "path_match": "ipfix.sonic_service_port_end", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_spam_sess_id": { + "path_match": "ipfix.sonic_spam_sess_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_spam_flow_id": { + "path_match": "ipfix.sonic_spam_flow_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_spam_time_id": { + "path_match": "ipfix.sonic_spam_time_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_spam_spammer": { + "path_match": "ipfix.sonic_spam_spammer", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_spam_type": { + "path_match": "ipfix.sonic_spam_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_spam_to_email": { + "path_match": "ipfix.sonic_spam_to_email", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_spam_from_email": { + "path_match": "ipfix.sonic_spam_from_email", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_mem_total_ram": { + "path_match": "ipfix.sonic_mem_total_ram", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_mem_avail_ram": { + "path_match": "ipfix.sonic_mem_avail_ram", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_mem_used_ram": { + "path_match": "ipfix.sonic_mem_used_ram", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_mem_db_ram": { + "path_match": "ipfix.sonic_mem_db_ram", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_mem_flows": { + "path_match": "ipfix.sonic_mem_flows", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_mem_per_flow": { + "path_match": "ipfix.sonic_mem_per_flow", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_dev_iface_id": { + "path_match": "ipfix.sonic_dev_iface_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_dev_ip": { + "path_match": "ipfix.sonic_dev_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_dev_mac": { + "path_match": "ipfix.sonic_dev_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_dev_name": { + "path_match": "ipfix.sonic_dev_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_vpn_in_spi_id": { + "path_match": "ipfix.sonic_vpn_in_spi_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_vpn_out_spi_id": { + "path_match": "ipfix.sonic_vpn_out_spi_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_vpn_tunnel": { + "path_match": "ipfix.sonic_vpn_tunnel", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_vpn_local_gw": { + "path_match": "ipfix.sonic_vpn_local_gw", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_vpn_remote_gw": { + "path_match": "ipfix.sonic_vpn_remote_gw", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_vpn_tunnel_iface_id": { + "path_match": "ipfix.sonic_vpn_tunnel_iface_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_vpn_policy_type": { + "path_match": "ipfix.sonic_vpn_policy_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_vpn_protocol_type": { + "path_match": "ipfix.sonic_vpn_protocol_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_vpn_encrypt_type": { + "path_match": "ipfix.sonic_vpn_encrypt_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_vpn_auth_type": { + "path_match": "ipfix.sonic_vpn_auth_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_vpn_start_time": { + "path_match": "ipfix.sonic_vpn_start_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_vpn_end_time": { + "path_match": "ipfix.sonic_vpn_end_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_init_vpn_spi_out": { + "path_match": "ipfix.sonic_init_vpn_spi_out", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_resp_vpn_spi_out": { + "path_match": "ipfix.sonic_resp_vpn_spi_out", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_init_to_resp_delta_packets": { + "path_match": "ipfix.sonic_init_to_resp_delta_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_init_to_resp_delta_bytes": { + "path_match": "ipfix.sonic_init_to_resp_delta_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_resp_to_init_delta_packets": { + "path_match": "ipfix.sonic_resp_to_init_delta_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_resp_to_init_delta_bytes": { + "path_match": "ipfix.sonic_resp_to_init_delta_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_block_reason": { + "path_match": "ipfix.sonic_flow_block_reason", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_mac": { + "path_match": "ipfix.sonic_if_stat_mac", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_ip": { + "path_match": "ipfix.sonic_if_stat_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_if_stat_security_type": { + "path_match": "ipfix.sonic_if_stat_security_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_zone": { + "path_match": "ipfix.sonic_if_stat_zone", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_user_ip": { + "path_match": "ipfix.sonic_user_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_url_rating_val1": { + "path_match": "ipfix.sonic_url_rating_val1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_url_rating_val2": { + "path_match": "ipfix.sonic_url_rating_val2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_url_rating_val3": { + "path_match": "ipfix.sonic_url_rating_val3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_url_rating_val4": { + "path_match": "ipfix.sonic_url_rating_val4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app_bwm_attr": { + "path_match": "ipfix.sonic_app_bwm_attr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_init_to_resp_lost_packets": { + "path_match": "ipfix.sonic_voip_init_to_resp_lost_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_resp_to_init_lost_packets": { + "path_match": "ipfix.sonic_voip_resp_to_init_lost_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_init_to_resp_avg_latency": { + "path_match": "ipfix.sonic_voip_init_to_resp_avg_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_init_to_resp_max_latency": { + "path_match": "ipfix.sonic_voip_init_to_resp_max_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_resp_to_init_avg_latency": { + "path_match": "ipfix.sonic_voip_resp_to_init_avg_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_resp_to_init_max_latency": { + "path_match": "ipfix.sonic_voip_resp_to_init_max_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app_content_type": { + "path_match": "ipfix.sonic_app_content_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_snwl_option": { + "path_match": "ipfix.sonic_snwl_option", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app_risk_attr": { + "path_match": "ipfix.sonic_app_risk_attr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app_tech_attr": { + "path_match": "ipfix.sonic_app_tech_attr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app_attr_bit_mask": { + "path_match": "ipfix.sonic_app_attr_bit_mask", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_top_apps_sigid": { + "path_match": "ipfix.sonic_top_apps_sigid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_top_apps_appname": { + "path_match": "ipfix.sonic_top_apps_appname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_top_apps_rate": { + "path_match": "ipfix.sonic_top_apps_rate", + "mapping": { + "type": "long" + } + } + }, - { - "ipfix.sophos_afc_proto": { - "path_match": "ipfix.sophos_afc_proto", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sophos_afc_proto_name": { - "path_match": "ipfix.sophos_afc_proto_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sophos_flow_direction": { - "path_match": "ipfix.sophos_flow_direction", - "mapping": { - "type": "long" - } - } - }, + { + "ipfix.sophos_afc_proto": { + "path_match": "ipfix.sophos_afc_proto", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sophos_afc_proto_name": { + "path_match": "ipfix.sophos_afc_proto_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sophos_flow_direction": { + "path_match": "ipfix.sophos_flow_direction", + "mapping": { + "type": "long" + } + } + }, - { - "ipfix.viptela_vpn_id": { - "path_match": "ipfix.viptela_vpn_id", - "mapping": { - "type": "long" - } - } - }, - - - - { - "ipfix.vmware_tenant_proto": { - "path_match": "ipfix.vmware_tenant_proto", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_tenant_src_ipv4": { - "path_match": "ipfix.vmware_tenant_src_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.vmware_tenant_dst_ipv4": { - "path_match": "ipfix.vmware_tenant_dst_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.vmware_tenant_src_ipv6": { - "path_match": "ipfix.vmware_tenant_src_ipv6", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.vmware_tenant_dst_ipv6": { - "path_match": "ipfix.vmware_tenant_dst_ipv6", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.vmware_tenant_src_port": { - "path_match": "ipfix.vmware_tenant_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_tenant_dst_port": { - "path_match": "ipfix.vmware_tenant_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_egress_iface_attr": { - "path_match": "ipfix.vmware_egress_iface_attr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_vxlan_export_role": { - "path_match": "ipfix.vmware_vxlan_export_role", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_ingress_iface_attr": { - "path_match": "ipfix.vmware_ingress_iface_attr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_tunnel_type": { - "path_match": "ipfix.vmware_tunnel_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_tunnel_key": { - "path_match": "ipfix.vmware_tunnel_key", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.vmware_tunnel_src_ipv4_addr": { - "path_match": "ipfix.vmware_tunnel_src_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.vmware_tunnel_dst_ipv4_addr": { - "path_match": "ipfix.vmware_tunnel_dst_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.vmware_tunnel_protocol_id": { - "path_match": "ipfix.vmware_tunnel_protocol_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_tunnel_src_transport_port": { - "path_match": "ipfix.vmware_tunnel_src_transport_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_tunnel_dst_transport_port": { - "path_match": "ipfix.vmware_tunnel_dst_transport_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_virt_observation_id": { - "path_match": "ipfix.vmware_virt_observation_id", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.viptela_vpn_id": { + "path_match": "ipfix.viptela_vpn_id", + "mapping": { + "type": "long" + } + } + }, + + + + { + "ipfix.vmware_tenant_proto": { + "path_match": "ipfix.vmware_tenant_proto", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_tenant_src_ipv4": { + "path_match": "ipfix.vmware_tenant_src_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.vmware_tenant_dst_ipv4": { + "path_match": "ipfix.vmware_tenant_dst_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.vmware_tenant_src_ipv6": { + "path_match": "ipfix.vmware_tenant_src_ipv6", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.vmware_tenant_dst_ipv6": { + "path_match": "ipfix.vmware_tenant_dst_ipv6", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.vmware_tenant_src_port": { + "path_match": "ipfix.vmware_tenant_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_tenant_dst_port": { + "path_match": "ipfix.vmware_tenant_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_egress_iface_attr": { + "path_match": "ipfix.vmware_egress_iface_attr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_vxlan_export_role": { + "path_match": "ipfix.vmware_vxlan_export_role", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_ingress_iface_attr": { + "path_match": "ipfix.vmware_ingress_iface_attr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_tunnel_type": { + "path_match": "ipfix.vmware_tunnel_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_tunnel_key": { + "path_match": "ipfix.vmware_tunnel_key", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.vmware_tunnel_src_ipv4_addr": { + "path_match": "ipfix.vmware_tunnel_src_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.vmware_tunnel_dst_ipv4_addr": { + "path_match": "ipfix.vmware_tunnel_dst_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.vmware_tunnel_protocol_id": { + "path_match": "ipfix.vmware_tunnel_protocol_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_tunnel_src_transport_port": { + "path_match": "ipfix.vmware_tunnel_src_transport_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_tunnel_dst_transport_port": { + "path_match": "ipfix.vmware_tunnel_dst_transport_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_virt_observation_id": { + "path_match": "ipfix.vmware_virt_observation_id", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.ziften_inbound": { - "path_match": "ipfix.ziften_inbound", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ziften_pid": { - "path_match": "ipfix.ziften_pid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ziften_parent_pid": { - "path_match": "ipfix.ziften_parent_pid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ziften_image_path": { - "path_match": "ipfix.ziften_image_path", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_filename": { - "path_match": "ipfix.ziften_filename", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_platform": { - "path_match": "ipfix.ziften_platform", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_agent_guid": { - "path_match": "ipfix.ziften_agent_guid", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_hostname": { - "path_match": "ipfix.ziften_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_unk_269": { - "path_match": "ipfix.ziften_unk_269", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_file_sig": { - "path_match": "ipfix.ziften_file_sig", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_file_sig_algo": { - "path_match": "ipfix.ziften_file_sig_algo", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_file_sig_algo_char": { - "path_match": "ipfix.ziften_file_sig_algo_char", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_user_sid": { - "path_match": "ipfix.ziften_user_sid", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_parent_image_path": { - "path_match": "ipfix.ziften_parent_image_path", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_parent_file_sig": { - "path_match": "ipfix.ziften_parent_file_sig", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_acct_id": { - "path_match": "ipfix.ziften_acct_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ziften_mod_time_secs": { - "path_match": "ipfix.ziften_mod_time_secs", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ziften_command": { - "path_match": "ipfix.ziften_command", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.ziften_inbound": { + "path_match": "ipfix.ziften_inbound", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ziften_pid": { + "path_match": "ipfix.ziften_pid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ziften_parent_pid": { + "path_match": "ipfix.ziften_parent_pid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ziften_image_path": { + "path_match": "ipfix.ziften_image_path", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_filename": { + "path_match": "ipfix.ziften_filename", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_platform": { + "path_match": "ipfix.ziften_platform", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_agent_guid": { + "path_match": "ipfix.ziften_agent_guid", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_hostname": { + "path_match": "ipfix.ziften_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_unk_269": { + "path_match": "ipfix.ziften_unk_269", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_file_sig": { + "path_match": "ipfix.ziften_file_sig", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_file_sig_algo": { + "path_match": "ipfix.ziften_file_sig_algo", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_file_sig_algo_char": { + "path_match": "ipfix.ziften_file_sig_algo_char", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_user_sid": { + "path_match": "ipfix.ziften_user_sid", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_parent_image_path": { + "path_match": "ipfix.ziften_parent_image_path", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_parent_file_sig": { + "path_match": "ipfix.ziften_parent_file_sig", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_acct_id": { + "path_match": "ipfix.ziften_acct_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ziften_mod_time_secs": { + "path_match": "ipfix.ziften_mod_time_secs", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ziften_command": { + "path_match": "ipfix.ziften_command", + "mapping": { + "type": "keyword" + } + } + }, - { - "netflow.absoluteError": { - "path_match": "netflow.absoluteError", - "mapping": { - "type": "double" - } - } - }, - { - "netflow.anonymizationFlags": { - "path_match": "netflow.anonymizationFlags", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.anonymizationTechnique": { - "path_match": "netflow.anonymizationTechnique", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.app_id": { - "path_match": "netflow.app_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.application_description": { - "path_match": "netflow.application_description", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.application_id": { - "path_match": "netflow.application_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.application_name": { - "path_match": "netflow.application_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.applicationCategoryName": { - "path_match": "netflow.applicationCategoryName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.applicationGroupName": { - "path_match": "netflow.applicationGroupName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.applicationSubCategoryName": { - "path_match": "netflow.applicationSubCategoryName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.bgp_ipv4_next_hop": { - "path_match": "netflow.bgp_ipv4_next_hop", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.bgp_ipv6_next_hop": { - "path_match": "netflow.bgp_ipv6_next_hop", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.bgpNextAdjacentAsNumber": { - "path_match": "netflow.bgpNextAdjacentAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.bgpPrevAdjacentAsNumber": { - "path_match": "netflow.bgpPrevAdjacentAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.bgpValidityState": { - "path_match": "netflow.bgpValidityState", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.biflowDirection": { - "path_match": "netflow.biflowDirection", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.collectorCertificate": { - "path_match": "netflow.collectorCertificate", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.collectorIPv4Address": { - "path_match": "netflow.collectorIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.collectorIPv6Address": { - "path_match": "netflow.collectorIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.collectionTimeMilliseconds": { - "path_match": "netflow.collectionTimeMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.collectorTransportPort": { - "path_match": "netflow.collectorTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.commonPropertiesId": { - "path_match": "netflow.commonPropertiesId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.confidenceLevel": { - "path_match": "netflow.confidenceLevel", - "mapping": { - "type": "double" - } - } - }, - { - "netflow.conn_id": { - "path_match": "netflow.conn_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.connectionSumDurationSeconds": { - "path_match": "netflow.connectionSumDurationSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.connectionTransactionId": { - "path_match": "netflow.connectionTransactionId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dataLinkFrameSection": { - "path_match": "netflow.dataLinkFrameSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.dataLinkFrameSize": { - "path_match": "netflow.dataLinkFrameSize", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dataLinkFrameType": { - "path_match": "netflow.dataLinkFrameType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dataRecordsReliability": { - "path_match": "netflow.dataRecordsReliability", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.destinationIPv6Prefix": { - "path_match": "netflow.destinationIPv6Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.digestHashValue": { - "path_match": "netflow.digestHashValue", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.direction": { - "path_match": "netflow.direction", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.distinctCountOfDestinationIPAddress": { - "path_match": "netflow.distinctCountOfDestinationIPAddress", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.distinctCountOfDestinationIPv4Address": { - "path_match": "netflow.distinctCountOfDestinationIPv4Address", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.distinctCountOfDestinationIPv6Address": { - "path_match": "netflow.distinctCountOfDestinationIPv6Address", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.distinctCountOfSourceIPAddress": { - "path_match": "netflow.distinctCountOfSourceIPAddress", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.distinctCountOfSourceIPv4Address": { - "path_match": "netflow.distinctCountOfSourceIPv4Address", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.distinctCountOfSourceIPv6Address": { - "path_match": "netflow.distinctCountOfSourceIPv6Address", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dot1qCustomerDEI": { - "path_match": "netflow.dot1qCustomerDEI", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dot1qCustomerDestinationMacAddress": { - "path_match": "netflow.dot1qCustomerDestinationMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.dot1qCustomerPriority": { - "path_match": "netflow.dot1qCustomerPriority", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dot1qCustomerSourceMacAddress": { - "path_match": "netflow.dot1qCustomerSourceMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.dot1qCustomerVlanId": { - "path_match": "netflow.dot1qCustomerVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dot1qDEI": { - "path_match": "netflow.dot1qDEI", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dot1qPriority": { - "path_match": "netflow.dot1qPriority", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dot1qServiceInstanceId": { - "path_match": "netflow.dot1qServiceInstanceId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dot1qServiceInstancePriority": { - "path_match": "netflow.dot1qServiceInstancePriority", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dot1qServiceInstanceTag": { - "path_match": "netflow.dot1qServiceInstanceTag", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.dot1qVlanId": { - "path_match": "netflow.dot1qVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.droppedLayer2OctetDeltaCount": { - "path_match": "netflow.droppedLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.droppedLayer2OctetTotalCount": { - "path_match": "netflow.droppedLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.droppedOctetDeltaCount": { - "path_match": "netflow.droppedOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.droppedOctetTotalCount": { - "path_match": "netflow.droppedOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.droppedPacketDeltaCount": { - "path_match": "netflow.droppedPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.droppedPacketTotalCount": { - "path_match": "netflow.droppedPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dst_as": { - "path_match": "netflow.dst_as", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dst_mask": { - "path_match": "netflow.dst_mask", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dst_tos": { - "path_match": "netflow.dst_tos", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dst_vlan": { - "path_match": "netflow.dst_vlan", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.egressBroadcastPacketTotalCount": { - "path_match": "netflow.egressBroadcastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.egressInterfaceType": { - "path_match": "netflow.egressInterfaceType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.egressPhysicalInterface": { - "path_match": "netflow.egressPhysicalInterface", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.egressUnicastPacketTotalCount": { - "path_match": "netflow.egressUnicastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.egressVRFID": { - "path_match": "netflow.egressVRFID", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.encryptedTechnology": { - "path_match": "netflow.encryptedTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.engine_id": { - "path_match": "netflow.engine_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.engine_type": { - "path_match": "netflow.engine_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ethernetHeaderLength": { - "path_match": "netflow.ethernetHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ethernetPayloadLength": { - "path_match": "netflow.ethernetPayloadLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ethernetTotalLength": { - "path_match": "netflow.ethernetTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ethernetType": { - "path_match": "netflow.ethernetType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.event_time_msec": { - "path_match": "netflow.event_time_msec", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.exporterCertificate": { - "path_match": "netflow.exporterCertificate", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.exporterIPv4Address": { - "path_match": "netflow.exporterIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.exporterIPv6Address": { - "path_match": "netflow.exporterIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.exporterTransportPort": { - "path_match": "netflow.exporterTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.exportingProcessId": { - "path_match": "netflow.exportingProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.exportInterface": { - "path_match": "netflow.exportInterface", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.exportProtocolVersion": { - "path_match": "netflow.exportProtocolVersion", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.exportSctpStreamId": { - "path_match": "netflow.exportSctpStreamId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.exportTransportProtocol": { - "path_match": "netflow.exportTransportProtocol", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.first_switched": { - "path_match": "netflow.first_switched", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.flow_active_timeout": { - "path_match": "netflow.flow_active_timeout", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_end_msec": { - "path_match": "netflow.flow_end_msec", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_end_reason": { - "path_match": "netflow.flow_end_reason", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_inactive_timeout": { - "path_match": "netflow.flow_inactive_timeout", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_records": { - "path_match": "netflow.flow_records", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_sampler_id": { - "path_match": "netflow.flow_sampler_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_sampler_mode": { - "path_match": "netflow.flow_sampler_mode", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_sampler_random_interval": { - "path_match": "netflow.flow_sampler_random_interval", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_seq_num": { - "path_match": "netflow.flow_seq_num", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_start_msec": { - "path_match": "netflow.flow_start_msec", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowDurationMicroseconds": { - "path_match": "netflow.flowDurationMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowDurationMilliseconds": { - "path_match": "netflow.flowDurationMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowEndDeltaMicroseconds": { - "path_match": "netflow.flowEndDeltaMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowEndMicroseconds": { - "path_match": "netflow.flowEndMicroseconds", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.flowEndNanoseconds": { - "path_match": "netflow.flowEndNanoseconds", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.flowEndSeconds": { - "path_match": "netflow.flowEndSeconds", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.flowKeyIndicator": { - "path_match": "netflow.flowKeyIndicator", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flows": { - "path_match": "netflow.flows", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowSamplingTimeInterval": { - "path_match": "netflow.flowSamplingTimeInterval", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowSamplingTimeSpacing": { - "path_match": "netflow.flowSamplingTimeSpacing", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowSelectedFlowDeltaCount": { - "path_match": "netflow.flowSelectedFlowDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowSelectedOctetDeltaCount": { - "path_match": "netflow.flowSelectedOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowSelectedPacketDeltaCount": { - "path_match": "netflow.flowSelectedPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowSelectorAlgorithm": { - "path_match": "netflow.flowSelectorAlgorithm", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowset_id": { - "path_match": "netflow.flowset_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowStartDeltaMicroseconds": { - "path_match": "netflow.flowStartDeltaMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowStartMicroseconds": { - "path_match": "netflow.flowStartMicroseconds", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.flowStartNanoseconds": { - "path_match": "netflow.flowStartNanoseconds", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.flowStartSeconds": { - "path_match": "netflow.flowStartSeconds", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.forwarding_status.reason": { - "path_match": "netflow.forwarding_status.reason", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.forwarding_status.status": { - "path_match": "netflow.forwarding_status.status", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.fragmentFlags": { - "path_match": "netflow.fragmentFlags", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.fw_event": { - "path_match": "netflow.fw_event", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.fw_ext_event": { - "path_match": "netflow.fw_ext_event", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.fwd_flow_delta_bytes": { - "path_match": "netflow.fwd_flow_delta_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.greKey": { - "path_match": "netflow.greKey", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashDigestOutput": { - "path_match": "netflow.hashDigestOutput", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashFlowDomain": { - "path_match": "netflow.hashFlowDomain", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashInitialiserValue": { - "path_match": "netflow.hashInitialiserValue", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashIPPayloadOffset": { - "path_match": "netflow.hashIPPayloadOffset", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashIPPayloadSize": { - "path_match": "netflow.hashIPPayloadSize", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashOutputRangeMax": { - "path_match": "netflow.hashOutputRangeMax", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashOutputRangeMin": { - "path_match": "netflow.hashOutputRangeMin", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashSelectedRangeMax": { - "path_match": "netflow.hashSelectedRangeMax", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashSelectedRangeMin": { - "path_match": "netflow.hashSelectedRangeMin", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.icmp_code_ipv4": { - "path_match": "netflow.icmp_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.icmp_code_ipv6": { - "path_match": "netflow.icmp_code_ipv6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.icmp_type": { - "path_match": "netflow.icmp_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.icmp_type_ipv4": { - "path_match": "netflow.icmp_type_ipv4", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.icmp_type_ipv6": { - "path_match": "netflow.icmp_type_ipv6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.icmpTypeCodeIPv6": { - "path_match": "netflow.icmpTypeCodeIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.if_desc": { - "path_match": "netflow.if_desc", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.if_name": { - "path_match": "netflow.if_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ignoredDataRecordTotalCount": { - "path_match": "netflow.ignoredDataRecordTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ignoredLayer2FrameTotalCount": { - "path_match": "netflow.ignoredLayer2FrameTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ignoredLayer2OctetTotalCount": { - "path_match": "netflow.ignoredLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ignoredOctetTotalCount": { - "path_match": "netflow.ignoredOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ignoredPacketTotalCount": { - "path_match": "netflow.ignoredPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.in_bytes": { - "path_match": "netflow.in_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.in_dst_mac": { - "path_match": "netflow.in_dst_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.in_permanent_bytes": { - "path_match": "netflow.in_permanent_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.in_permanent_pkts": { - "path_match": "netflow.in_permanent_pkts", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.in_pkts": { - "path_match": "netflow.in_pkts", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.in_src_mac": { - "path_match": "netflow.in_src_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.informationElementDataType": { - "path_match": "netflow.informationElementDataType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.informationElementDescription": { - "path_match": "netflow.informationElementDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.informationElementId": { - "path_match": "netflow.informationElementId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.informationElementIndex": { - "path_match": "netflow.informationElementIndex", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.informationElementName": { - "path_match": "netflow.informationElementName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.informationElementRangeBegin": { - "path_match": "netflow.informationElementRangeBegin", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.informationElementRangeEnd": { - "path_match": "netflow.informationElementRangeEnd", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.informationElementSemantics": { - "path_match": "netflow.informationElementSemantics", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.informationElementUnits": { - "path_match": "netflow.informationElementUnits", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ingressBroadcastPacketTotalCount": { - "path_match": "netflow.ingressBroadcastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ingressInterfaceType": { - "path_match": "netflow.ingressInterfaceType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ingressMulticastPacketTotalCount": { - "path_match": "netflow.ingressMulticastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ingressPhysicalInterface": { - "path_match": "netflow.ingressPhysicalInterface", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ingressUnicastPacketTotalCount": { - "path_match": "netflow.ingressUnicastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ingressVRFID": { - "path_match": "netflow.ingressVRFID", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.initiatorPackets": { - "path_match": "netflow.initiatorPackets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.input_snmp": { - "path_match": "netflow.input_snmp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.intermediateProcessId": { - "path_match": "netflow.intermediateProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ip_dscp": { - "path_match": "netflow.ip_dscp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ip_protocol_version": { - "path_match": "netflow.ip_protocol_version", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ip_tos": { - "path_match": "netflow.ip_tos", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipHeaderLength": { - "path_match": "netflow.ipHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipHeaderPacketSection": { - "path_match": "netflow.ipHeaderPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ipPayloadLength": { - "path_match": "netflow.ipPayloadLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipPayloadPacketSection": { - "path_match": "netflow.ipPayloadPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ipPrecedence": { - "path_match": "netflow.ipPrecedence", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.IPSecSPI": { - "path_match": "netflow.IPSecSPI", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipTotalLength": { - "path_match": "netflow.ipTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipTTL": { - "path_match": "netflow.ipTTL", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipv4_dst_addr": { - "path_match": "netflow.ipv4_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ipv4_dst_prefix": { - "path_match": "netflow.ipv4_dst_prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ipv4_ident": { - "path_match": "netflow.ipv4_ident", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipv4_next_hop": { - "path_match": "netflow.ipv4_next_hop", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ipv4_src_addr": { - "path_match": "netflow.ipv4_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ipv4_src_prefix": { - "path_match": "netflow.ipv4_src_prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ipv4IHL": { - "path_match": "netflow.ipv4IHL", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipv4Options": { - "path_match": "netflow.ipv4Options", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipv6_dst_addr": { - "path_match": "netflow.ipv6_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ipv6_dst_mask": { - "path_match": "netflow.ipv6_dst_mask", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipv6_flow_label": { - "path_match": "netflow.ipv6_flow_label", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipv6_next_hop": { - "path_match": "netflow.ipv6_next_hop", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ipv6_option_headers": { - "path_match": "netflow.ipv6_option_headers", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipv6_src_addr": { - "path_match": "netflow.ipv6_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ipv6_src_mask": { - "path_match": "netflow.ipv6_src_mask", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.isMulticast": { - "path_match": "netflow.isMulticast", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.l4_dst_port": { - "path_match": "netflow.l4_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.l4_src_port": { - "path_match": "netflow.l4_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.last_switched": { - "path_match": "netflow.last_switched", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.layer2FrameDeltaCount": { - "path_match": "netflow.layer2FrameDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.layer2FrameTotalCount": { - "path_match": "netflow.layer2FrameTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.layer2OctetDeltaCount": { - "path_match": "netflow.layer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.layer2OctetDeltaSumOfSquares": { - "path_match": "netflow.layer2OctetDeltaSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.layer2OctetTotalCount": { - "path_match": "netflow.layer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.layer2OctetTotalSumOfSquares": { - "path_match": "netflow.layer2OctetTotalSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.layer2SegmentId": { - "path_match": "netflow.layer2SegmentId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.lineCardId": { - "path_match": "netflow.lineCardId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.lowerCILimit": { - "path_match": "netflow.lowerCILimit", - "mapping": { - "type": "double" - } - } - }, - { - "netflow.max_pkt_length": { - "path_match": "netflow.max_pkt_length", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.max_ttl": { - "path_match": "netflow.max_ttl", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.maxExportSeconds": { - "path_match": "netflow.maxExportSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.maxFlowEndMicroseconds": { - "path_match": "netflow.maxFlowEndMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.maxFlowEndMilliseconds": { - "path_match": "netflow.maxFlowEndMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.maxFlowEndNanoseconds": { - "path_match": "netflow.maxFlowEndNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.maxFlowEndSeconds": { - "path_match": "netflow.maxFlowEndSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.maximumLayer2TotalLength": { - "path_match": "netflow.maximumLayer2TotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.messageMD5Checksum": { - "path_match": "netflow.messageMD5Checksum", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.messageScope": { - "path_match": "netflow.messageScope", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.meteringProcessId": { - "path_match": "netflow.meteringProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.metroEvcId": { - "path_match": "netflow.metroEvcId", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.metroEvcType": { - "path_match": "netflow.metroEvcType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.min_pkt_length": { - "path_match": "netflow.min_pkt_length", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.min_ttl": { - "path_match": "netflow.min_ttl", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.minExportSeconds": { - "path_match": "netflow.minExportSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.minFlowStartMicroseconds": { - "path_match": "netflow.minFlowStartMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.minFlowStartMilliseconds": { - "path_match": "netflow.minFlowStartMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.minFlowStartNanoseconds": { - "path_match": "netflow.minFlowStartNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.minFlowStartSeconds": { - "path_match": "netflow.minFlowStartSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.minimumLayer2TotalLength": { - "path_match": "netflow.minimumLayer2TotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.monitoringIntervalEndMilliSeconds": { - "path_match": "netflow.monitoringIntervalEndMilliSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.monitoringIntervalStartMilliSeconds": { - "path_match": "netflow.monitoringIntervalStartMilliSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mpls_label_stack_octets.bottom_of_stack": { - "path_match": "netflow.mpls_label_stack_octets.bottom_of_stack", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mpls_label_stack_octets.experimental": { - "path_match": "netflow.mpls_label_stack_octets.experimental", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mpls_label_stack_octets.label": { - "path_match": "netflow.mpls_label_stack_octets.label", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mpls_label_stack_octets.ttl": { - "path_match": "netflow.mpls_label_stack_octets.ttl", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mpls_top_label_ip": { - "path_match": "netflow.mpls_top_label_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.mpls_top_label_type": { - "path_match": "netflow.mpls_top_label_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mplsLabelStackDepth": { - "path_match": "netflow.mplsLabelStackDepth", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mplsLabelStackSection": { - "path_match": "netflow.mplsLabelStackSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.mplsPayloadPacketSection": { - "path_match": "netflow.mplsPayloadPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.mplsTopLabelExp": { - "path_match": "netflow.mplsTopLabelExp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mplsTopLabelIPv6Address": { - "path_match": "netflow.mplsTopLabelIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.mplsTopLabelTTL": { - "path_match": "netflow.mplsTopLabelTTL", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mul_dst_bytes": { - "path_match": "netflow.mul_dst_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mul_dst_pkts": { - "path_match": "netflow.mul_dst_pkts", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mul_igmp_type": { - "path_match": "netflow.mul_igmp_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.natEvent": { - "path_match": "netflow.natEvent", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.natOriginatingAddressRealm": { - "path_match": "netflow.natOriginatingAddressRealm", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.natPoolId": { - "path_match": "netflow.natPoolId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.natPoolName": { - "path_match": "netflow.natPoolName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.natType": { - "path_match": "netflow.natType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.newConnectionDeltaCount": { - "path_match": "netflow.newConnectionDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.nextHeaderIPv6": { - "path_match": "netflow.nextHeaderIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.notSentFlowTotalCount": { - "path_match": "netflow.notSentFlowTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.notSentLayer2OctetTotalCount": { - "path_match": "netflow.notSentLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.notSentOctetTotalCount": { - "path_match": "netflow.notSentOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.notSentPacketTotalCount": { - "path_match": "netflow.notSentPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.nprobe_proto": { - "path_match": "netflow.nprobe_proto", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.nprobe_proto_name": { - "path_match": "netflow.nprobe_proto_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.observationDomainId": { - "path_match": "netflow.observationDomainId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.observationDomainName": { - "path_match": "netflow.observationDomainName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.observationPointId": { - "path_match": "netflow.observationPointId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.observationPointType": { - "path_match": "netflow.observationPointType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.observationTimeMicroseconds": { - "path_match": "netflow.observationTimeMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.observationTimeNanoseconds": { - "path_match": "netflow.observationTimeNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.observationTimeSeconds": { - "path_match": "netflow.observationTimeSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.observedFlowTotalCount": { - "path_match": "netflow.observedFlowTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.octetDeltaSumOfSquares": { - "path_match": "netflow.octetDeltaSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.octetTotalSumOfSquares": { - "path_match": "netflow.octetTotalSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.opaqueOctets": { - "path_match": "netflow.opaqueOctets", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.originalExporterIPv4Address": { - "path_match": "netflow.originalExporterIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.originalExporterIPv6Address": { - "path_match": "netflow.originalExporterIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.originalFlowsCompleted": { - "path_match": "netflow.originalFlowsCompleted", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.originalFlowsInitiated": { - "path_match": "netflow.originalFlowsInitiated", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.originalFlowsPresent": { - "path_match": "netflow.originalFlowsPresent", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.originalObservationDomainId": { - "path_match": "netflow.originalObservationDomainId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.out_bytes": { - "path_match": "netflow.out_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.out_dst_mac": { - "path_match": "netflow.out_dst_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.out_pkts": { - "path_match": "netflow.out_pkts", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.out_src_mac": { - "path_match": "netflow.out_src_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.output_snmp": { - "path_match": "netflow.output_snmp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.p2pTechnology": { - "path_match": "netflow.p2pTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.payloadLengthIPv6": { - "path_match": "netflow.payloadLengthIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.portId": { - "path_match": "netflow.portId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.portRangeNumPorts": { - "path_match": "netflow.portRangeNumPorts", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.portRangeStepSize": { - "path_match": "netflow.portRangeStepSize", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postDot1qCustomerVlanId": { - "path_match": "netflow.postDot1qCustomerVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postDot1qVlanId": { - "path_match": "netflow.postDot1qVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postIpDiffServCodePoint": { - "path_match": "netflow.postIpDiffServCodePoint", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postIpPrecedence": { - "path_match": "netflow.postIpPrecedence", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postLayer2OctetDeltaCount": { - "path_match": "netflow.postLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postLayer2OctetTotalCount": { - "path_match": "netflow.postLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postMCastLayer2OctetDeltaCount": { - "path_match": "netflow.postMCastLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postMCastLayer2OctetTotalCount": { - "path_match": "netflow.postMCastLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postMCastPacketTotalCount": { - "path_match": "netflow.postMCastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postMCastOctetTotalCount": { - "path_match": "netflow.postMCastOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postMplsTopLabelExp": { - "path_match": "netflow.postMplsTopLabelExp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postNATPortBlockEnd": { - "path_match": "netflow.postNATPortBlockEnd", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postNATPortBlockStart": { - "path_match": "netflow.postNATPortBlockStart", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postOctetTotalCount": { - "path_match": "netflow.postOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postPacketTotalCount": { - "path_match": "netflow.postPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.privateEnterpriseNumber": { - "path_match": "netflow.privateEnterpriseNumber", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.protocol": { - "path_match": "netflow.protocol", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.pseudoWireControlWord": { - "path_match": "netflow.pseudoWireControlWord", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.pseudoWireDestinationIPv4Address": { - "path_match": "netflow.pseudoWireDestinationIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.pseudoWireId": { - "path_match": "netflow.pseudoWireId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.pseudoWireType": { - "path_match": "netflow.pseudoWireType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.relativeError": { - "path_match": "netflow.relativeError", - "mapping": { - "type": "double" - } - } - }, - { - "netflow.responderPackets": { - "path_match": "netflow.responderPackets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.rev_flow_delta_bytes": { - "path_match": "netflow.rev_flow_delta_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.rfc3550JitterMicroseconds": { - "path_match": "netflow.rfc3550JitterMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.rfc3550JitterMilliseconds": { - "path_match": "netflow.rfc3550JitterMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.rfc3550JitterNanoseconds": { - "path_match": "netflow.rfc3550JitterNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.rtpSequenceNumber": { - "path_match": "netflow.rtpSequenceNumber", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.sampler_name": { - "path_match": "netflow.sampler_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.sampling_algorithm": { - "path_match": "netflow.sampling_algorithm", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.sampling_interval": { - "path_match": "netflow.sampling_interval", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.samplingFlowInterval": { - "path_match": "netflow.samplingFlowInterval", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.samplingFlowSpacing": { - "path_match": "netflow.samplingFlowSpacing", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.samplingPacketInterval": { - "path_match": "netflow.samplingPacketInterval", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.samplingPacketSpace": { - "path_match": "netflow.samplingPacketSpace", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.samplingPopulation": { - "path_match": "netflow.samplingPopulation", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.samplingProbability": { - "path_match": "netflow.samplingProbability", - "mapping": { - "type": "double" - } - } - }, - { - "netflow.samplingSize": { - "path_match": "netflow.samplingSize", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.samplingTimeInterval": { - "path_match": "netflow.samplingTimeInterval", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.samplingTimeSpace": { - "path_match": "netflow.samplingTimeSpace", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.scope_system": { - "path_match": "netflow.scope_system", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.sectionExportedOctets": { - "path_match": "netflow.sectionExportedOctets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.sectionOffset": { - "path_match": "netflow.sectionOffset", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.selectionSequenceId": { - "path_match": "netflow.selectionSequenceId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.selectorAlgorithm": { - "path_match": "netflow.selectorAlgorithm", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.selectorId": { - "path_match": "netflow.selectorId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.selectorIDTotalFlowsObserved": { - "path_match": "netflow.selectorIDTotalFlowsObserved", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.selectorIDTotalFlowsSelected": { - "path_match": "netflow.selectorIDTotalFlowsSelected", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.selectorIdTotalPktsObserved": { - "path_match": "netflow.selectorIdTotalPktsObserved", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.selectorIdTotalPktsSelected": { - "path_match": "netflow.selectorIdTotalPktsSelected", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.selectorName": { - "path_match": "netflow.selectorName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.sessionScope": { - "path_match": "netflow.sessionScope", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.sourceIPv6Prefix": { - "path_match": "netflow.sourceIPv6Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.src_as": { - "path_match": "netflow.src_as", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.src_mask": { - "path_match": "netflow.src_mask", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.src_tos": { - "path_match": "netflow.src_tos", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.src_vlan": { - "path_match": "netflow.src_vlan", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.staIPv4Address": { - "path_match": "netflow.staIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.staMacAddress": { - "path_match": "netflow.staMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.systemInitTimeMilliseconds": { - "path_match": "netflow.systemInitTimeMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcp_dst_port": { - "path_match": "netflow.tcp_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcp_flags": { - "path_match": "netflow.tcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcp_src_port": { - "path_match": "netflow.tcp_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpAcknowledgementNumber": { - "path_match": "netflow.tcpAcknowledgementNumber", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpAckTotalCount": { - "path_match": "netflow.tcpAckTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpDestinationPort": { - "path_match": "netflow.tcpDestinationPort", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpFinTotalCount": { - "path_match": "netflow.tcpFinTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpHeaderLength": { - "path_match": "netflow.tcpHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpOptions": { - "path_match": "netflow.tcpOptions", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpPshTotalCount": { - "path_match": "netflow.tcpPshTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpRstTotalCount": { - "path_match": "netflow.tcpRstTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpSequenceNumber": { - "path_match": "netflow.tcpSequenceNumber", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpSynTotalCount": { - "path_match": "netflow.tcpSynTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpUrgentPointer": { - "path_match": "netflow.tcpUrgentPointer", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpUrgTotalCount": { - "path_match": "netflow.tcpUrgTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpWindowScale": { - "path_match": "netflow.tcpWindowScale", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpWindowSize": { - "path_match": "netflow.tcpWindowSize", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.templateId": { - "path_match": "netflow.templateId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.total_bytes_exp": { - "path_match": "netflow.total_bytes_exp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.total_flows_exp": { - "path_match": "netflow.total_flows_exp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.total_pkts_exp": { - "path_match": "netflow.total_pkts_exp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.totalLengthIPv4": { - "path_match": "netflow.totalLengthIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.transportOctetDeltaCount": { - "path_match": "netflow.transportOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.transportPacketDeltaCount": { - "path_match": "netflow.transportPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tunnelTechnology": { - "path_match": "netflow.tunnelTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.udp_dst_port": { - "path_match": "netflow.udp_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.udp_src_port": { - "path_match": "netflow.udp_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.udpMessageLength": { - "path_match": "netflow.udpMessageLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.upperCILimit": { - "path_match": "netflow.upperCILimit", - "mapping": { - "type": "double" - } - } - }, - { - "netflow.user_id": { - "path_match": "netflow.user_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.username": { - "path_match": "netflow.username", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.userName": { - "path_match": "netflow.userName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.valueDistributionMethod": { - "path_match": "netflow.valueDistributionMethod", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.virtualStationInterfaceId": { - "path_match": "netflow.virtualStationInterfaceId", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.virtualStationInterfaceName": { - "path_match": "netflow.virtualStationInterfaceName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.virtualStationName": { - "path_match": "netflow.virtualStationName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.virtualStationUUID": { - "path_match": "netflow.virtualStationUUID", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.VRFname": { - "path_match": "netflow.VRFname", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.wlan_id": { - "path_match": "netflow.wlan_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.wlanChannelId": { - "path_match": "netflow.wlanChannelId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.wlanSSID": { - "path_match": "netflow.wlanSSID", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.wtpMacAddress": { - "path_match": "netflow.wtpMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.xlate_dst_addr_ipv4": { - "path_match": "netflow.xlate_dst_addr_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.xlate_dst_addr_ipv6": { - "path_match": "netflow.xlate_dst_addr_ipv6", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.xlate_dst_port": { - "path_match": "netflow.xlate_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.xlate_src_addr_ipv4": { - "path_match": "netflow.xlate_src_addr_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.xlate_src_addr_ipv6": { - "path_match": "netflow.xlate_src_addr_ipv6", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.xlate_src_port": { - "path_match": "netflow.xlate_src_port", - "mapping": { - "type": "long" - } - } - }, + { + "netflow.absoluteError": { + "path_match": "netflow.absoluteError", + "mapping": { + "type": "double" + } + } + }, + { + "netflow.anonymizationFlags": { + "path_match": "netflow.anonymizationFlags", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.anonymizationTechnique": { + "path_match": "netflow.anonymizationTechnique", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.app_id": { + "path_match": "netflow.app_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.application_description": { + "path_match": "netflow.application_description", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.application_id": { + "path_match": "netflow.application_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.application_name": { + "path_match": "netflow.application_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.applicationCategoryName": { + "path_match": "netflow.applicationCategoryName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.applicationGroupName": { + "path_match": "netflow.applicationGroupName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.applicationSubCategoryName": { + "path_match": "netflow.applicationSubCategoryName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.bgp_ipv4_next_hop": { + "path_match": "netflow.bgp_ipv4_next_hop", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.bgp_ipv6_next_hop": { + "path_match": "netflow.bgp_ipv6_next_hop", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.bgpNextAdjacentAsNumber": { + "path_match": "netflow.bgpNextAdjacentAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.bgpPrevAdjacentAsNumber": { + "path_match": "netflow.bgpPrevAdjacentAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.bgpValidityState": { + "path_match": "netflow.bgpValidityState", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.biflowDirection": { + "path_match": "netflow.biflowDirection", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.collectorCertificate": { + "path_match": "netflow.collectorCertificate", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.collectorIPv4Address": { + "path_match": "netflow.collectorIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.collectorIPv6Address": { + "path_match": "netflow.collectorIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.collectionTimeMilliseconds": { + "path_match": "netflow.collectionTimeMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.collectorTransportPort": { + "path_match": "netflow.collectorTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.commonPropertiesId": { + "path_match": "netflow.commonPropertiesId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.confidenceLevel": { + "path_match": "netflow.confidenceLevel", + "mapping": { + "type": "double" + } + } + }, + { + "netflow.conn_id": { + "path_match": "netflow.conn_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.connectionSumDurationSeconds": { + "path_match": "netflow.connectionSumDurationSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.connectionTransactionId": { + "path_match": "netflow.connectionTransactionId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dataLinkFrameSection": { + "path_match": "netflow.dataLinkFrameSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.dataLinkFrameSize": { + "path_match": "netflow.dataLinkFrameSize", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dataLinkFrameType": { + "path_match": "netflow.dataLinkFrameType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dataRecordsReliability": { + "path_match": "netflow.dataRecordsReliability", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.destinationIPv6Prefix": { + "path_match": "netflow.destinationIPv6Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.digestHashValue": { + "path_match": "netflow.digestHashValue", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.direction": { + "path_match": "netflow.direction", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.distinctCountOfDestinationIPAddress": { + "path_match": "netflow.distinctCountOfDestinationIPAddress", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.distinctCountOfDestinationIPv4Address": { + "path_match": "netflow.distinctCountOfDestinationIPv4Address", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.distinctCountOfDestinationIPv6Address": { + "path_match": "netflow.distinctCountOfDestinationIPv6Address", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.distinctCountOfSourceIPAddress": { + "path_match": "netflow.distinctCountOfSourceIPAddress", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.distinctCountOfSourceIPv4Address": { + "path_match": "netflow.distinctCountOfSourceIPv4Address", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.distinctCountOfSourceIPv6Address": { + "path_match": "netflow.distinctCountOfSourceIPv6Address", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dot1qCustomerDEI": { + "path_match": "netflow.dot1qCustomerDEI", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dot1qCustomerDestinationMacAddress": { + "path_match": "netflow.dot1qCustomerDestinationMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.dot1qCustomerPriority": { + "path_match": "netflow.dot1qCustomerPriority", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dot1qCustomerSourceMacAddress": { + "path_match": "netflow.dot1qCustomerSourceMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.dot1qCustomerVlanId": { + "path_match": "netflow.dot1qCustomerVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dot1qDEI": { + "path_match": "netflow.dot1qDEI", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dot1qPriority": { + "path_match": "netflow.dot1qPriority", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dot1qServiceInstanceId": { + "path_match": "netflow.dot1qServiceInstanceId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dot1qServiceInstancePriority": { + "path_match": "netflow.dot1qServiceInstancePriority", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dot1qServiceInstanceTag": { + "path_match": "netflow.dot1qServiceInstanceTag", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.dot1qVlanId": { + "path_match": "netflow.dot1qVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.droppedLayer2OctetDeltaCount": { + "path_match": "netflow.droppedLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.droppedLayer2OctetTotalCount": { + "path_match": "netflow.droppedLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.droppedOctetDeltaCount": { + "path_match": "netflow.droppedOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.droppedOctetTotalCount": { + "path_match": "netflow.droppedOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.droppedPacketDeltaCount": { + "path_match": "netflow.droppedPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.droppedPacketTotalCount": { + "path_match": "netflow.droppedPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dst_as": { + "path_match": "netflow.dst_as", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dst_mask": { + "path_match": "netflow.dst_mask", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dst_tos": { + "path_match": "netflow.dst_tos", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dst_vlan": { + "path_match": "netflow.dst_vlan", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.egressBroadcastPacketTotalCount": { + "path_match": "netflow.egressBroadcastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.egressInterfaceType": { + "path_match": "netflow.egressInterfaceType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.egressPhysicalInterface": { + "path_match": "netflow.egressPhysicalInterface", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.egressUnicastPacketTotalCount": { + "path_match": "netflow.egressUnicastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.egressVRFID": { + "path_match": "netflow.egressVRFID", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.encryptedTechnology": { + "path_match": "netflow.encryptedTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.engine_id": { + "path_match": "netflow.engine_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.engine_type": { + "path_match": "netflow.engine_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ethernetHeaderLength": { + "path_match": "netflow.ethernetHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ethernetPayloadLength": { + "path_match": "netflow.ethernetPayloadLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ethernetTotalLength": { + "path_match": "netflow.ethernetTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ethernetType": { + "path_match": "netflow.ethernetType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.event_time_msec": { + "path_match": "netflow.event_time_msec", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.exporterCertificate": { + "path_match": "netflow.exporterCertificate", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.exporterIPv4Address": { + "path_match": "netflow.exporterIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.exporterIPv6Address": { + "path_match": "netflow.exporterIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.exporterTransportPort": { + "path_match": "netflow.exporterTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.exportingProcessId": { + "path_match": "netflow.exportingProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.exportInterface": { + "path_match": "netflow.exportInterface", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.exportProtocolVersion": { + "path_match": "netflow.exportProtocolVersion", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.exportSctpStreamId": { + "path_match": "netflow.exportSctpStreamId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.exportTransportProtocol": { + "path_match": "netflow.exportTransportProtocol", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.first_switched": { + "path_match": "netflow.first_switched", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.flow_active_timeout": { + "path_match": "netflow.flow_active_timeout", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_end_msec": { + "path_match": "netflow.flow_end_msec", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_end_reason": { + "path_match": "netflow.flow_end_reason", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_inactive_timeout": { + "path_match": "netflow.flow_inactive_timeout", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_records": { + "path_match": "netflow.flow_records", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_sampler_id": { + "path_match": "netflow.flow_sampler_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_sampler_mode": { + "path_match": "netflow.flow_sampler_mode", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_sampler_random_interval": { + "path_match": "netflow.flow_sampler_random_interval", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_seq_num": { + "path_match": "netflow.flow_seq_num", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_start_msec": { + "path_match": "netflow.flow_start_msec", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowDurationMicroseconds": { + "path_match": "netflow.flowDurationMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowDurationMilliseconds": { + "path_match": "netflow.flowDurationMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowEndDeltaMicroseconds": { + "path_match": "netflow.flowEndDeltaMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowEndMicroseconds": { + "path_match": "netflow.flowEndMicroseconds", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.flowEndNanoseconds": { + "path_match": "netflow.flowEndNanoseconds", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.flowEndSeconds": { + "path_match": "netflow.flowEndSeconds", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.flowKeyIndicator": { + "path_match": "netflow.flowKeyIndicator", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flows": { + "path_match": "netflow.flows", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowSamplingTimeInterval": { + "path_match": "netflow.flowSamplingTimeInterval", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowSamplingTimeSpacing": { + "path_match": "netflow.flowSamplingTimeSpacing", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowSelectedFlowDeltaCount": { + "path_match": "netflow.flowSelectedFlowDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowSelectedOctetDeltaCount": { + "path_match": "netflow.flowSelectedOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowSelectedPacketDeltaCount": { + "path_match": "netflow.flowSelectedPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowSelectorAlgorithm": { + "path_match": "netflow.flowSelectorAlgorithm", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowset_id": { + "path_match": "netflow.flowset_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowStartDeltaMicroseconds": { + "path_match": "netflow.flowStartDeltaMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowStartMicroseconds": { + "path_match": "netflow.flowStartMicroseconds", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.flowStartNanoseconds": { + "path_match": "netflow.flowStartNanoseconds", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.flowStartSeconds": { + "path_match": "netflow.flowStartSeconds", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.forwarding_status.reason": { + "path_match": "netflow.forwarding_status.reason", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.forwarding_status.status": { + "path_match": "netflow.forwarding_status.status", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.fragmentFlags": { + "path_match": "netflow.fragmentFlags", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.fw_event": { + "path_match": "netflow.fw_event", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.fw_ext_event": { + "path_match": "netflow.fw_ext_event", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.fwd_flow_delta_bytes": { + "path_match": "netflow.fwd_flow_delta_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.greKey": { + "path_match": "netflow.greKey", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashDigestOutput": { + "path_match": "netflow.hashDigestOutput", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashFlowDomain": { + "path_match": "netflow.hashFlowDomain", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashInitialiserValue": { + "path_match": "netflow.hashInitialiserValue", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashIPPayloadOffset": { + "path_match": "netflow.hashIPPayloadOffset", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashIPPayloadSize": { + "path_match": "netflow.hashIPPayloadSize", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashOutputRangeMax": { + "path_match": "netflow.hashOutputRangeMax", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashOutputRangeMin": { + "path_match": "netflow.hashOutputRangeMin", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashSelectedRangeMax": { + "path_match": "netflow.hashSelectedRangeMax", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashSelectedRangeMin": { + "path_match": "netflow.hashSelectedRangeMin", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.icmp_code_ipv4": { + "path_match": "netflow.icmp_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.icmp_code_ipv6": { + "path_match": "netflow.icmp_code_ipv6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.icmp_type": { + "path_match": "netflow.icmp_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.icmp_type_ipv4": { + "path_match": "netflow.icmp_type_ipv4", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.icmp_type_ipv6": { + "path_match": "netflow.icmp_type_ipv6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.icmpTypeCodeIPv6": { + "path_match": "netflow.icmpTypeCodeIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.if_desc": { + "path_match": "netflow.if_desc", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.if_name": { + "path_match": "netflow.if_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ignoredDataRecordTotalCount": { + "path_match": "netflow.ignoredDataRecordTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ignoredLayer2FrameTotalCount": { + "path_match": "netflow.ignoredLayer2FrameTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ignoredLayer2OctetTotalCount": { + "path_match": "netflow.ignoredLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ignoredOctetTotalCount": { + "path_match": "netflow.ignoredOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ignoredPacketTotalCount": { + "path_match": "netflow.ignoredPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.in_bytes": { + "path_match": "netflow.in_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.in_dst_mac": { + "path_match": "netflow.in_dst_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.in_permanent_bytes": { + "path_match": "netflow.in_permanent_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.in_permanent_pkts": { + "path_match": "netflow.in_permanent_pkts", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.in_pkts": { + "path_match": "netflow.in_pkts", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.in_src_mac": { + "path_match": "netflow.in_src_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.informationElementDataType": { + "path_match": "netflow.informationElementDataType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.informationElementDescription": { + "path_match": "netflow.informationElementDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.informationElementId": { + "path_match": "netflow.informationElementId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.informationElementIndex": { + "path_match": "netflow.informationElementIndex", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.informationElementName": { + "path_match": "netflow.informationElementName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.informationElementRangeBegin": { + "path_match": "netflow.informationElementRangeBegin", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.informationElementRangeEnd": { + "path_match": "netflow.informationElementRangeEnd", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.informationElementSemantics": { + "path_match": "netflow.informationElementSemantics", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.informationElementUnits": { + "path_match": "netflow.informationElementUnits", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ingressBroadcastPacketTotalCount": { + "path_match": "netflow.ingressBroadcastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ingressInterfaceType": { + "path_match": "netflow.ingressInterfaceType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ingressMulticastPacketTotalCount": { + "path_match": "netflow.ingressMulticastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ingressPhysicalInterface": { + "path_match": "netflow.ingressPhysicalInterface", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ingressUnicastPacketTotalCount": { + "path_match": "netflow.ingressUnicastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ingressVRFID": { + "path_match": "netflow.ingressVRFID", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.initiatorPackets": { + "path_match": "netflow.initiatorPackets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.input_snmp": { + "path_match": "netflow.input_snmp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.intermediateProcessId": { + "path_match": "netflow.intermediateProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ip_dscp": { + "path_match": "netflow.ip_dscp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ip_protocol_version": { + "path_match": "netflow.ip_protocol_version", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ip_tos": { + "path_match": "netflow.ip_tos", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipHeaderLength": { + "path_match": "netflow.ipHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipHeaderPacketSection": { + "path_match": "netflow.ipHeaderPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ipPayloadLength": { + "path_match": "netflow.ipPayloadLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipPayloadPacketSection": { + "path_match": "netflow.ipPayloadPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ipPrecedence": { + "path_match": "netflow.ipPrecedence", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.IPSecSPI": { + "path_match": "netflow.IPSecSPI", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipTotalLength": { + "path_match": "netflow.ipTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipTTL": { + "path_match": "netflow.ipTTL", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipv4_dst_addr": { + "path_match": "netflow.ipv4_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ipv4_dst_prefix": { + "path_match": "netflow.ipv4_dst_prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ipv4_ident": { + "path_match": "netflow.ipv4_ident", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipv4_next_hop": { + "path_match": "netflow.ipv4_next_hop", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ipv4_src_addr": { + "path_match": "netflow.ipv4_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ipv4_src_prefix": { + "path_match": "netflow.ipv4_src_prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ipv4IHL": { + "path_match": "netflow.ipv4IHL", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipv4Options": { + "path_match": "netflow.ipv4Options", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipv6_dst_addr": { + "path_match": "netflow.ipv6_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ipv6_dst_mask": { + "path_match": "netflow.ipv6_dst_mask", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipv6_flow_label": { + "path_match": "netflow.ipv6_flow_label", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipv6_next_hop": { + "path_match": "netflow.ipv6_next_hop", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ipv6_option_headers": { + "path_match": "netflow.ipv6_option_headers", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipv6_src_addr": { + "path_match": "netflow.ipv6_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ipv6_src_mask": { + "path_match": "netflow.ipv6_src_mask", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.isMulticast": { + "path_match": "netflow.isMulticast", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.l4_dst_port": { + "path_match": "netflow.l4_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.l4_src_port": { + "path_match": "netflow.l4_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.last_switched": { + "path_match": "netflow.last_switched", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.layer2FrameDeltaCount": { + "path_match": "netflow.layer2FrameDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.layer2FrameTotalCount": { + "path_match": "netflow.layer2FrameTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.layer2OctetDeltaCount": { + "path_match": "netflow.layer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.layer2OctetDeltaSumOfSquares": { + "path_match": "netflow.layer2OctetDeltaSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.layer2OctetTotalCount": { + "path_match": "netflow.layer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.layer2OctetTotalSumOfSquares": { + "path_match": "netflow.layer2OctetTotalSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.layer2SegmentId": { + "path_match": "netflow.layer2SegmentId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.lineCardId": { + "path_match": "netflow.lineCardId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.lowerCILimit": { + "path_match": "netflow.lowerCILimit", + "mapping": { + "type": "double" + } + } + }, + { + "netflow.max_pkt_length": { + "path_match": "netflow.max_pkt_length", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.max_ttl": { + "path_match": "netflow.max_ttl", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.maxExportSeconds": { + "path_match": "netflow.maxExportSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.maxFlowEndMicroseconds": { + "path_match": "netflow.maxFlowEndMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.maxFlowEndMilliseconds": { + "path_match": "netflow.maxFlowEndMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.maxFlowEndNanoseconds": { + "path_match": "netflow.maxFlowEndNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.maxFlowEndSeconds": { + "path_match": "netflow.maxFlowEndSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.maximumLayer2TotalLength": { + "path_match": "netflow.maximumLayer2TotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.messageMD5Checksum": { + "path_match": "netflow.messageMD5Checksum", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.messageScope": { + "path_match": "netflow.messageScope", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.meteringProcessId": { + "path_match": "netflow.meteringProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.metroEvcId": { + "path_match": "netflow.metroEvcId", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.metroEvcType": { + "path_match": "netflow.metroEvcType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.min_pkt_length": { + "path_match": "netflow.min_pkt_length", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.min_ttl": { + "path_match": "netflow.min_ttl", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.minExportSeconds": { + "path_match": "netflow.minExportSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.minFlowStartMicroseconds": { + "path_match": "netflow.minFlowStartMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.minFlowStartMilliseconds": { + "path_match": "netflow.minFlowStartMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.minFlowStartNanoseconds": { + "path_match": "netflow.minFlowStartNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.minFlowStartSeconds": { + "path_match": "netflow.minFlowStartSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.minimumLayer2TotalLength": { + "path_match": "netflow.minimumLayer2TotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.monitoringIntervalEndMilliSeconds": { + "path_match": "netflow.monitoringIntervalEndMilliSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.monitoringIntervalStartMilliSeconds": { + "path_match": "netflow.monitoringIntervalStartMilliSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mpls_label_stack_octets.bottom_of_stack": { + "path_match": "netflow.mpls_label_stack_octets.bottom_of_stack", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mpls_label_stack_octets.experimental": { + "path_match": "netflow.mpls_label_stack_octets.experimental", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mpls_label_stack_octets.label": { + "path_match": "netflow.mpls_label_stack_octets.label", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mpls_label_stack_octets.ttl": { + "path_match": "netflow.mpls_label_stack_octets.ttl", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mpls_top_label_ip": { + "path_match": "netflow.mpls_top_label_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.mpls_top_label_type": { + "path_match": "netflow.mpls_top_label_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mplsLabelStackDepth": { + "path_match": "netflow.mplsLabelStackDepth", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mplsLabelStackSection": { + "path_match": "netflow.mplsLabelStackSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.mplsPayloadPacketSection": { + "path_match": "netflow.mplsPayloadPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.mplsTopLabelExp": { + "path_match": "netflow.mplsTopLabelExp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mplsTopLabelIPv6Address": { + "path_match": "netflow.mplsTopLabelIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.mplsTopLabelTTL": { + "path_match": "netflow.mplsTopLabelTTL", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mul_dst_bytes": { + "path_match": "netflow.mul_dst_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mul_dst_pkts": { + "path_match": "netflow.mul_dst_pkts", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mul_igmp_type": { + "path_match": "netflow.mul_igmp_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.natEvent": { + "path_match": "netflow.natEvent", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.natOriginatingAddressRealm": { + "path_match": "netflow.natOriginatingAddressRealm", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.natPoolId": { + "path_match": "netflow.natPoolId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.natPoolName": { + "path_match": "netflow.natPoolName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.natType": { + "path_match": "netflow.natType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.newConnectionDeltaCount": { + "path_match": "netflow.newConnectionDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.nextHeaderIPv6": { + "path_match": "netflow.nextHeaderIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.notSentFlowTotalCount": { + "path_match": "netflow.notSentFlowTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.notSentLayer2OctetTotalCount": { + "path_match": "netflow.notSentLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.notSentOctetTotalCount": { + "path_match": "netflow.notSentOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.notSentPacketTotalCount": { + "path_match": "netflow.notSentPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.nprobe_proto": { + "path_match": "netflow.nprobe_proto", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.nprobe_proto_name": { + "path_match": "netflow.nprobe_proto_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.observationDomainId": { + "path_match": "netflow.observationDomainId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.observationDomainName": { + "path_match": "netflow.observationDomainName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.observationPointId": { + "path_match": "netflow.observationPointId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.observationPointType": { + "path_match": "netflow.observationPointType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.observationTimeMicroseconds": { + "path_match": "netflow.observationTimeMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.observationTimeNanoseconds": { + "path_match": "netflow.observationTimeNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.observationTimeSeconds": { + "path_match": "netflow.observationTimeSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.observedFlowTotalCount": { + "path_match": "netflow.observedFlowTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.octetDeltaSumOfSquares": { + "path_match": "netflow.octetDeltaSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.octetTotalSumOfSquares": { + "path_match": "netflow.octetTotalSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.opaqueOctets": { + "path_match": "netflow.opaqueOctets", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.originalExporterIPv4Address": { + "path_match": "netflow.originalExporterIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.originalExporterIPv6Address": { + "path_match": "netflow.originalExporterIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.originalFlowsCompleted": { + "path_match": "netflow.originalFlowsCompleted", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.originalFlowsInitiated": { + "path_match": "netflow.originalFlowsInitiated", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.originalFlowsPresent": { + "path_match": "netflow.originalFlowsPresent", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.originalObservationDomainId": { + "path_match": "netflow.originalObservationDomainId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.out_bytes": { + "path_match": "netflow.out_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.out_dst_mac": { + "path_match": "netflow.out_dst_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.out_pkts": { + "path_match": "netflow.out_pkts", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.out_src_mac": { + "path_match": "netflow.out_src_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.output_snmp": { + "path_match": "netflow.output_snmp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.p2pTechnology": { + "path_match": "netflow.p2pTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.payloadLengthIPv6": { + "path_match": "netflow.payloadLengthIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.portId": { + "path_match": "netflow.portId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.portRangeNumPorts": { + "path_match": "netflow.portRangeNumPorts", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.portRangeStepSize": { + "path_match": "netflow.portRangeStepSize", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postDot1qCustomerVlanId": { + "path_match": "netflow.postDot1qCustomerVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postDot1qVlanId": { + "path_match": "netflow.postDot1qVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postIpDiffServCodePoint": { + "path_match": "netflow.postIpDiffServCodePoint", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postIpPrecedence": { + "path_match": "netflow.postIpPrecedence", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postLayer2OctetDeltaCount": { + "path_match": "netflow.postLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postLayer2OctetTotalCount": { + "path_match": "netflow.postLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postMCastLayer2OctetDeltaCount": { + "path_match": "netflow.postMCastLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postMCastLayer2OctetTotalCount": { + "path_match": "netflow.postMCastLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postMCastPacketTotalCount": { + "path_match": "netflow.postMCastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postMCastOctetTotalCount": { + "path_match": "netflow.postMCastOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postMplsTopLabelExp": { + "path_match": "netflow.postMplsTopLabelExp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postNATPortBlockEnd": { + "path_match": "netflow.postNATPortBlockEnd", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postNATPortBlockStart": { + "path_match": "netflow.postNATPortBlockStart", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postOctetTotalCount": { + "path_match": "netflow.postOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postPacketTotalCount": { + "path_match": "netflow.postPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.privateEnterpriseNumber": { + "path_match": "netflow.privateEnterpriseNumber", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.protocol": { + "path_match": "netflow.protocol", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.pseudoWireControlWord": { + "path_match": "netflow.pseudoWireControlWord", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.pseudoWireDestinationIPv4Address": { + "path_match": "netflow.pseudoWireDestinationIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.pseudoWireId": { + "path_match": "netflow.pseudoWireId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.pseudoWireType": { + "path_match": "netflow.pseudoWireType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.relativeError": { + "path_match": "netflow.relativeError", + "mapping": { + "type": "double" + } + } + }, + { + "netflow.responderPackets": { + "path_match": "netflow.responderPackets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.rev_flow_delta_bytes": { + "path_match": "netflow.rev_flow_delta_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.rfc3550JitterMicroseconds": { + "path_match": "netflow.rfc3550JitterMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.rfc3550JitterMilliseconds": { + "path_match": "netflow.rfc3550JitterMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.rfc3550JitterNanoseconds": { + "path_match": "netflow.rfc3550JitterNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.rtpSequenceNumber": { + "path_match": "netflow.rtpSequenceNumber", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.sampler_name": { + "path_match": "netflow.sampler_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.sampling_algorithm": { + "path_match": "netflow.sampling_algorithm", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.sampling_interval": { + "path_match": "netflow.sampling_interval", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.samplingFlowInterval": { + "path_match": "netflow.samplingFlowInterval", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.samplingFlowSpacing": { + "path_match": "netflow.samplingFlowSpacing", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.samplingPacketInterval": { + "path_match": "netflow.samplingPacketInterval", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.samplingPacketSpace": { + "path_match": "netflow.samplingPacketSpace", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.samplingPopulation": { + "path_match": "netflow.samplingPopulation", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.samplingProbability": { + "path_match": "netflow.samplingProbability", + "mapping": { + "type": "double" + } + } + }, + { + "netflow.samplingSize": { + "path_match": "netflow.samplingSize", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.samplingTimeInterval": { + "path_match": "netflow.samplingTimeInterval", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.samplingTimeSpace": { + "path_match": "netflow.samplingTimeSpace", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.scope_system": { + "path_match": "netflow.scope_system", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.sectionExportedOctets": { + "path_match": "netflow.sectionExportedOctets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.sectionOffset": { + "path_match": "netflow.sectionOffset", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.selectionSequenceId": { + "path_match": "netflow.selectionSequenceId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.selectorAlgorithm": { + "path_match": "netflow.selectorAlgorithm", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.selectorId": { + "path_match": "netflow.selectorId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.selectorIDTotalFlowsObserved": { + "path_match": "netflow.selectorIDTotalFlowsObserved", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.selectorIDTotalFlowsSelected": { + "path_match": "netflow.selectorIDTotalFlowsSelected", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.selectorIdTotalPktsObserved": { + "path_match": "netflow.selectorIdTotalPktsObserved", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.selectorIdTotalPktsSelected": { + "path_match": "netflow.selectorIdTotalPktsSelected", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.selectorName": { + "path_match": "netflow.selectorName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.sessionScope": { + "path_match": "netflow.sessionScope", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.sourceIPv6Prefix": { + "path_match": "netflow.sourceIPv6Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.src_as": { + "path_match": "netflow.src_as", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.src_mask": { + "path_match": "netflow.src_mask", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.src_tos": { + "path_match": "netflow.src_tos", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.src_vlan": { + "path_match": "netflow.src_vlan", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.staIPv4Address": { + "path_match": "netflow.staIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.staMacAddress": { + "path_match": "netflow.staMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.systemInitTimeMilliseconds": { + "path_match": "netflow.systemInitTimeMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcp_dst_port": { + "path_match": "netflow.tcp_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcp_flags": { + "path_match": "netflow.tcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcp_src_port": { + "path_match": "netflow.tcp_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpAcknowledgementNumber": { + "path_match": "netflow.tcpAcknowledgementNumber", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpAckTotalCount": { + "path_match": "netflow.tcpAckTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpDestinationPort": { + "path_match": "netflow.tcpDestinationPort", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpFinTotalCount": { + "path_match": "netflow.tcpFinTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpHeaderLength": { + "path_match": "netflow.tcpHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpOptions": { + "path_match": "netflow.tcpOptions", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpPshTotalCount": { + "path_match": "netflow.tcpPshTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpRstTotalCount": { + "path_match": "netflow.tcpRstTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpSequenceNumber": { + "path_match": "netflow.tcpSequenceNumber", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpSynTotalCount": { + "path_match": "netflow.tcpSynTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpUrgentPointer": { + "path_match": "netflow.tcpUrgentPointer", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpUrgTotalCount": { + "path_match": "netflow.tcpUrgTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpWindowScale": { + "path_match": "netflow.tcpWindowScale", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpWindowSize": { + "path_match": "netflow.tcpWindowSize", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.templateId": { + "path_match": "netflow.templateId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.total_bytes_exp": { + "path_match": "netflow.total_bytes_exp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.total_flows_exp": { + "path_match": "netflow.total_flows_exp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.total_pkts_exp": { + "path_match": "netflow.total_pkts_exp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.totalLengthIPv4": { + "path_match": "netflow.totalLengthIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.transportOctetDeltaCount": { + "path_match": "netflow.transportOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.transportPacketDeltaCount": { + "path_match": "netflow.transportPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tunnelTechnology": { + "path_match": "netflow.tunnelTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.udp_dst_port": { + "path_match": "netflow.udp_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.udp_src_port": { + "path_match": "netflow.udp_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.udpMessageLength": { + "path_match": "netflow.udpMessageLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.upperCILimit": { + "path_match": "netflow.upperCILimit", + "mapping": { + "type": "double" + } + } + }, + { + "netflow.user_id": { + "path_match": "netflow.user_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.username": { + "path_match": "netflow.username", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.userName": { + "path_match": "netflow.userName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.valueDistributionMethod": { + "path_match": "netflow.valueDistributionMethod", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.virtualStationInterfaceId": { + "path_match": "netflow.virtualStationInterfaceId", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.virtualStationInterfaceName": { + "path_match": "netflow.virtualStationInterfaceName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.virtualStationName": { + "path_match": "netflow.virtualStationName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.virtualStationUUID": { + "path_match": "netflow.virtualStationUUID", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.VRFname": { + "path_match": "netflow.VRFname", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.wlan_id": { + "path_match": "netflow.wlan_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.wlanChannelId": { + "path_match": "netflow.wlanChannelId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.wlanSSID": { + "path_match": "netflow.wlanSSID", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.wtpMacAddress": { + "path_match": "netflow.wtpMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.xlate_dst_addr_ipv4": { + "path_match": "netflow.xlate_dst_addr_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.xlate_dst_addr_ipv6": { + "path_match": "netflow.xlate_dst_addr_ipv6", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.xlate_dst_port": { + "path_match": "netflow.xlate_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.xlate_src_addr_ipv4": { + "path_match": "netflow.xlate_src_addr_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.xlate_src_addr_ipv6": { + "path_match": "netflow.xlate_src_addr_ipv6", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.xlate_src_port": { + "path_match": "netflow.xlate_src_port", + "mapping": { + "type": "long" + } + } + }, - { - "netflow.cisco_avc_p2p_tech": { - "path_match": "netflow.cisco_avc_p2p_tech", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_tunnel_tech": { - "path_match": "netflow.cisco_avc_tunnel_tech", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_encrypt_tech": { - "path_match": "netflow.cisco_avc_encrypt_tech", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_ipt_dialing_phone": { - "path_match": "netflow.cisco_ipt_dialing_phone", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_ipt_dialing_user": { - "path_match": "netflow.cisco_ipt_dialing_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_ipt_dialed_phone": { - "path_match": "netflow.cisco_ipt_dialed_phone", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_ipt_dialed_user": { - "path_match": "netflow.cisco_ipt_dialed_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_ipt_call_duration": { - "path_match": "netflow.cisco_ipt_call_duration", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_ipt_call_end_reason": { - "path_match": "netflow.cisco_ipt_call_end_reason", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_ipt_calls_dialed": { - "path_match": "netflow.cisco_ipt_calls_dialed", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_ipt_calls_connected": { - "path_match": "netflow.cisco_ipt_calls_connected", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_ipt_calls_failed": { - "path_match": "netflow.cisco_ipt_calls_failed", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_nexus_fastpath_src_addr": { - "path_match": "netflow.cisco_nexus_fastpath_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_nexus_fastpath_src_port": { - "path_match": "netflow.cisco_nexus_fastpath_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_nexus_fastpath_dst_addr": { - "path_match": "netflow.cisco_nexus_fastpath_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_nexus_fastpath_dst_port": { - "path_match": "netflow.cisco_nexus_fastpath_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_endpoint_process_user": { - "path_match": "netflow.cisco_endpoint_process_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_endpoint_process_name": { - "path_match": "netflow.cisco_endpoint_process_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_endpoint_process_hash": { - "path_match": "netflow.cisco_endpoint_process_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_endpoint_process_parent_user": { - "path_match": "netflow.cisco_endpoint_process_parent_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_endpoint_process_parent_name": { - "path_match": "netflow.cisco_endpoint_process_parent_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_endpoint_process_parent_hash": { - "path_match": "netflow.cisco_endpoint_process_parent_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_pfr_policy_id": { - "path_match": "netflow.cisco_pfr_policy_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_map_name": { - "path_match": "netflow.cisco_pfr_map_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_pfr_reason": { - "path_match": "netflow.cisco_pfr_reason", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_fw_ingress_acl_id": { - "path_match": "netflow.cisco_fw_ingress_acl_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_fw_egress_acl_id": { - "path_match": "netflow.cisco_fw_egress_acl_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_fw_ext_event": { - "path_match": "netflow.cisco_fw_ext_event", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_fw_event_level": { - "path_match": "netflow.cisco_fw_event_level", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_event_level_id": { - "path_match": "netflow.cisco_fw_event_level_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_config_value": { - "path_match": "netflow.cisco_fw_config_value", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_erm_code": { - "path_match": "netflow.cisco_fw_erm_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_erm_descr": { - "path_match": "netflow.cisco_fw_erm_descr", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_trustsec_src_id": { - "path_match": "netflow.cisco_trustsec_src_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_trustsec_dst_id": { - "path_match": "netflow.cisco_trustsec_dst_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_trustsec_src_name": { - "path_match": "netflow.cisco_trustsec_src_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_trustsec_dst_name": { - "path_match": "netflow.cisco_trustsec_dst_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_trustsec_switch_derived_sgt": { - "path_match": "netflow.cisco_trustsec_switch_derived_sgt", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_fw_blackout_secs": { - "path_match": "netflow.cisco_fw_blackout_secs", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_half_open_sessions_rate_1min_max": { - "path_match": "netflow.cisco_fw_half_open_sessions_rate_1min_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_half_open_sessions_rate_1min": { - "path_match": "netflow.cisco_fw_half_open_sessions_rate_1min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_zonepair_id": { - "path_match": "netflow.cisco_fw_zonepair_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_sessions_max": { - "path_match": "netflow.cisco_fw_sessions_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_zonepair": { - "path_match": "netflow.cisco_fw_zonepair", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_fw_ext_event_descr": { - "path_match": "netflow.cisco_fw_ext_event_descr", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_fw_drop_pass_summary_packets": { - "path_match": "netflow.cisco_fw_drop_pass_summary_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_half_open_sessions": { - "path_match": "netflow.cisco_fw_half_open_sessions", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_dre_input": { - "path_match": "netflow.cisco_waas_dre_input", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_dre_output": { - "path_match": "netflow.cisco_waas_dre_output", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_lz_input": { - "path_match": "netflow.cisco_waas_lz_input", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_lz_output": { - "path_match": "netflow.cisco_waas_lz_output", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_conn_mode": { - "path_match": "netflow.cisco_waas_conn_mode", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_input_bytes": { - "path_match": "netflow.cisco_waas_input_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_output_bytes": { - "path_match": "netflow.cisco_waas_output_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_short_term_packets_drop": { - "path_match": "netflow.cisco_avc_transport_short_term_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_long_term_packets_drop": { - "path_match": "netflow.cisco_avc_transport_long_term_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_media_bytes": { - "path_match": "netflow.cisco_avc_app_media_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_media_byte_rate": { - "path_match": "netflow.cisco_avc_app_media_byte_rate", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_media_packets": { - "path_match": "netflow.cisco_avc_app_media_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_media_packet_rate": { - "path_match": "netflow.cisco_avc_app_media_packet_rate", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_media_packet_rate_variation": { - "path_match": "netflow.cisco_avc_app_media_packet_rate_variation", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_media_event": { - "path_match": "netflow.cisco_avc_app_media_event", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_monitor_event": { - "path_match": "netflow.cisco_avc_app_monitor_event", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_packets_expected": { - "path_match": "netflow.cisco_avc_transport_packets_expected", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtt": { - "path_match": "netflow.cisco_avc_transport_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_packet_sets_lost": { - "path_match": "netflow.cisco_avc_transport_packet_sets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_short_term_packets_lost": { - "path_match": "netflow.cisco_avc_transport_short_term_packets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_long_term_packets_lost": { - "path_match": "netflow.cisco_avc_transport_long_term_packets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_packet_loss_rate": { - "path_match": "netflow.cisco_avc_transport_packet_loss_rate", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtp_ssrc": { - "path_match": "netflow.cisco_avc_transport_rtp_ssrc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtp_jitter_mean": { - "path_match": "netflow.cisco_avc_transport_rtp_jitter_mean", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtp_jitter_min": { - "path_match": "netflow.cisco_avc_transport_rtp_jitter_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtp_jitter_max": { - "path_match": "netflow.cisco_avc_transport_rtp_jitter_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_controlled_tc": { - "path_match": "netflow.cisco_avc_controlled_tc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_in_policy_tc": { - "path_match": "netflow.cisco_avc_in_policy_tc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_media_packet_rate_variation_min": { - "path_match": "netflow.cisco_avc_app_media_packet_rate_variation_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_media_packet_rate_variation_max": { - "path_match": "netflow.cisco_avc_app_media_packet_rate_variation_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtp_flows": { - "path_match": "netflow.cisco_avc_transport_rtp_flows", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtp_payload_type": { - "path_match": "netflow.cisco_avc_transport_rtp_payload_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_packet_loss_rate_min": { - "path_match": "netflow.cisco_avc_transport_packet_loss_rate_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_packet_loss_rate_max": { - "path_match": "netflow.cisco_avc_transport_packet_loss_rate_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtt_sum": { - "path_match": "netflow.cisco_avc_transport_rtt_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtt_min": { - "path_match": "netflow.cisco_avc_transport_rtt_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtt_max": { - "path_match": "netflow.cisco_avc_transport_rtt_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_metadata_global_session_id": { - "path_match": "netflow.cisco_avc_metadata_global_session_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_metadata_multi_party_session_id": { - "path_match": "netflow.cisco_avc_metadata_multi_party_session_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_metadata_clock_rate": { - "path_match": "netflow.cisco_avc_metadata_clock_rate", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_network_delay_avg": { - "path_match": "netflow.cisco_avc_network_delay_avg", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_one_way_delay": { - "path_match": "netflow.cisco_avc_one_way_delay", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_tcp_window_size_min": { - "path_match": "netflow.cisco_avc_tcp_window_size_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_tcp_window_size_max": { - "path_match": "netflow.cisco_avc_tcp_window_size_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_tcp_max_segment_size": { - "path_match": "netflow.cisco_avc_tcp_max_segment_size", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_tcp_window_size_sum": { - "path_match": "netflow.cisco_avc_tcp_window_size_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_rtp_jitter_interarrival_avg": { - "path_match": "netflow.cisco_avc_rtp_jitter_interarrival_avg", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_src_site_id": { - "path_match": "netflow.cisco_pfr_src_site_id", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_pfr_dst_site_id": { - "path_match": "netflow.cisco_pfr_dst_site_id", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_avc_transport_byte_loss_rate": { - "path_match": "netflow.cisco_avc_transport_byte_loss_rate", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_event_tc_nomitigation_err_bw_count": { - "path_match": "netflow.cisco_pfr_event_tc_nomitigation_err_bw_count", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_event_tc_nomitigation_err_perf_count": { - "path_match": "netflow.cisco_pfr_event_tc_nomitigation_err_perf_count", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_dst_site_prefix": { - "path_match": "netflow.cisco_pfr_dst_site_prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_pfr_dst_site_prefix_mask": { - "path_match": "netflow.cisco_pfr_dst_site_prefix_mask", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_label_id": { - "path_match": "netflow.cisco_pfr_label_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_br_addr": { - "path_match": "netflow.cisco_pfr_br_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_pfr_state": { - "path_match": "netflow.cisco_pfr_state", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_reason_id": { - "path_match": "netflow.cisco_pfr_reason_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_threshold": { - "path_match": "netflow.cisco_pfr_threshold", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_priority": { - "path_match": "netflow.cisco_pfr_priority", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_long_term_rtt": { - "path_match": "netflow.cisco_avc_long_term_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_mos_below_counts": { - "path_match": "netflow.cisco_avc_mos_below_counts", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_rsvp_bandwidth_pool": { - "path_match": "netflow.cisco_avc_rsvp_bandwidth_pool", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_rollup_counter": { - "path_match": "netflow.cisco_avc_rollup_counter", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_kth_tier_percent": { - "path_match": "netflow.cisco_avc_kth_tier_percent", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_kth_bw_fee": { - "path_match": "netflow.cisco_avc_kth_bw_fee", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_src_port_min": { - "path_match": "netflow.cisco_avc_src_port_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_src_port_max": { - "path_match": "netflow.cisco_avc_src_port_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_dst_port_min": { - "path_match": "netflow.cisco_avc_dst_port_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_dst_port_max": { - "path_match": "netflow.cisco_avc_dst_port_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_link_capacity": { - "path_match": "netflow.cisco_avc_link_capacity", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_ingress_bw": { - "path_match": "netflow.cisco_avc_ingress_bw", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_ingress_bw_max": { - "path_match": "netflow.cisco_avc_ingress_bw_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_egress_bw": { - "path_match": "netflow.cisco_avc_egress_bw", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_egress_bw_max": { - "path_match": "netflow.cisco_avc_egress_bw_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_ingress_rollup_bw": { - "path_match": "netflow.cisco_avc_ingress_rollup_bw", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_egress_rollup_bw": { - "path_match": "netflow.cisco_avc_egress_rollup_bw", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_cost_target_bw": { - "path_match": "netflow.cisco_avc_cost_target_bw", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_kth_rollup_bw": { - "path_match": "netflow.cisco_avc_kth_rollup_bw", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_link_group_name": { - "path_match": "netflow.cisco_avc_link_group_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_bgp_community": { - "path_match": "netflow.cisco_avc_bgp_community", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_avc_bgp_prepend": { - "path_match": "netflow.cisco_avc_bgp_prepend", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_cost_discard_rollup_count": { - "path_match": "netflow.cisco_avc_cost_discard_rollup_count", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_user": { - "path_match": "netflow.cisco_fw_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_fw_xlate_src_addr_ipv4": { - "path_match": "netflow.cisco_fw_xlate_src_addr_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_fw_xlate_dst_addr_ipv4": { - "path_match": "netflow.cisco_fw_xlate_dst_addr_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_fw_xlate_src_port": { - "path_match": "netflow.cisco_fw_xlate_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_xlate_dst_port": { - "path_match": "netflow.cisco_fw_xlate_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_event": { - "path_match": "netflow.cisco_fw_event", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_client_long_lived_network_delay_max": { - "path_match": "netflow.cisco_avc_client_long_lived_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_long_lived_network_delay_min": { - "path_match": "netflow.cisco_avc_client_long_lived_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_long_lived_network_delay_max": { - "path_match": "netflow.cisco_avc_server_long_lived_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_long_lived_network_delay_min": { - "path_match": "netflow.cisco_avc_server_long_lived_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_policy_qos_class_hierarchy": { - "path_match": "netflow.cisco_policy_qos_class_hierarchy", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_server_bytes": { - "path_match": "netflow.cisco_avc_server_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_bytes": { - "path_match": "netflow.cisco_avc_client_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_concurrent_sessions": { - "path_match": "netflow.cisco_avc_concurrent_sessions", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_segment": { - "path_match": "netflow.cisco_waas_segment", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_passthru_reason": { - "path_match": "netflow.cisco_waas_passthru_reason", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_long_lived_network_delay_sum": { - "path_match": "netflow.cisco_avc_server_long_lived_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_long_lived_network_delay_sum": { - "path_match": "netflow.cisco_avc_client_long_lived_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_total_long_lived_network_delay_sum": { - "path_match": "netflow.cisco_avc_total_long_lived_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_total_long_lived_network_delay_samples": { - "path_match": "netflow.cisco_avc_total_long_lived_network_delay_samples", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_long_lived_network_delay_samples": { - "path_match": "netflow.cisco_avc_server_long_lived_network_delay_samples", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_long_lived_network_delay_samples": { - "path_match": "netflow.cisco_avc_client_long_lived_network_delay_samples", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_packets": { - "path_match": "netflow.cisco_avc_client_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_packets": { - "path_match": "netflow.cisco_avc_server_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_retrans_bytes": { - "path_match": "netflow.cisco_avc_client_retrans_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_retrans_packets": { - "path_match": "netflow.cisco_avc_client_retrans_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_retrans_bytes": { - "path_match": "netflow.cisco_avc_server_retrans_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_retrans_packets": { - "path_match": "netflow.cisco_avc_server_retrans_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transact_time_delta": { - "path_match": "netflow.cisco_avc_transact_time_delta", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transact_time_total": { - "path_match": "netflow.cisco_avc_transact_time_total", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transact_time_max": { - "path_match": "netflow.cisco_avc_transact_time_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transact_time_min": { - "path_match": "netflow.cisco_avc_transact_time_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_resps": { - "path_match": "netflow.cisco_avc_server_resps", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_resp_histogram1": { - "path_match": "netflow.cisco_avc_resp_histogram1", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_resp_histogram2": { - "path_match": "netflow.cisco_avc_resp_histogram2", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_resp_histogram3": { - "path_match": "netflow.cisco_avc_resp_histogram3", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_resp_histogram4": { - "path_match": "netflow.cisco_avc_resp_histogram4", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_resp_histogram5": { - "path_match": "netflow.cisco_avc_resp_histogram5", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_resp_histogram6": { - "path_match": "netflow.cisco_avc_resp_histogram6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_resp_histogram7": { - "path_match": "netflow.cisco_avc_resp_histogram7", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_late_resps": { - "path_match": "netflow.cisco_avc_server_late_resps", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_resp_time_sum": { - "path_match": "netflow.cisco_avc_server_resp_time_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_resp_time_max": { - "path_match": "netflow.cisco_avc_server_resp_time_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_resp_time_min": { - "path_match": "netflow.cisco_avc_server_resp_time_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_delay_sum": { - "path_match": "netflow.cisco_avc_app_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_delay_max": { - "path_match": "netflow.cisco_avc_app_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_delay_min": { - "path_match": "netflow.cisco_avc_app_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_total_delay_sum": { - "path_match": "netflow.cisco_avc_total_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_total_delay_max": { - "path_match": "netflow.cisco_avc_total_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_total_delay_min": { - "path_match": "netflow.cisco_avc_total_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_total_network_delay_sum": { - "path_match": "netflow.cisco_avc_total_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_total_network_delay_max": { - "path_match": "netflow.cisco_avc_total_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_total_network_delay_min": { - "path_match": "netflow.cisco_avc_total_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_network_delay_sum": { - "path_match": "netflow.cisco_avc_client_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_network_delay_max": { - "path_match": "netflow.cisco_avc_client_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_network_delay_min": { - "path_match": "netflow.cisco_avc_client_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_network_delay_sum": { - "path_match": "netflow.cisco_avc_server_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_network_delay_max": { - "path_match": "netflow.cisco_avc_server_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_network_delay_min": { - "path_match": "netflow.cisco_avc_server_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_rtp_short_term_mos": { - "path_match": "netflow.cisco_avc_rtp_short_term_mos", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_rtp_mos": { - "path_match": "netflow.cisco_avc_rtp_mos", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_rtp_mos_total": { - "path_match": "netflow.cisco_avc_rtp_mos_total", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_http_uri_stats": { - "path_match": "netflow.cisco_avc_app_http_uri_stats", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_policy_qos_queue_id": { - "path_match": "netflow.cisco_avc_policy_qos_queue_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_policy_qos_queue_drops": { - "path_match": "netflow.cisco_avc_policy_qos_queue_drops", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_eta_idp_old": { - "path_match": "netflow.cisco_eta_idp_old", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_eta_slpt_old": { - "path_match": "netflow.cisco_eta_slpt_old", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_wlan_id": { - "path_match": "netflow.cisco_wlan_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_category": { - "path_match": "netflow.cisco_avc_app_category", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_app_sub_category": { - "path_match": "netflow.cisco_avc_app_sub_category", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_app_group": { - "path_match": "netflow.cisco_avc_app_group", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_app_http_host": { - "path_match": "netflow.cisco_avc_app_http_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_client_ipv4_addr": { - "path_match": "netflow.cisco_avc_client_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_avc_server_ipv4_addr": { - "path_match": "netflow.cisco_avc_server_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_avc_client_ipv6_addr": { - "path_match": "netflow.cisco_avc_client_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_avc_server_ipv6_addr": { - "path_match": "netflow.cisco_avc_server_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_avc_client_l4_port": { - "path_match": "netflow.cisco_avc_client_l4_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_l4_port": { - "path_match": "netflow.cisco_avc_server_l4_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_conn_id": { - "path_match": "netflow.cisco_avc_conn_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_traffic_class": { - "path_match": "netflow.cisco_avc_app_traffic_class", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_app_business_relevance": { - "path_match": "netflow.cisco_avc_app_business_relevance", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_udid": { - "path_match": "netflow.cisco_nvzflow_udid", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_user": { - "path_match": "netflow.cisco_nvzflow_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_os_name": { - "path_match": "netflow.cisco_nvzflow_os_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_os_ver": { - "path_match": "netflow.cisco_nvzflow_os_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_sys_vendor": { - "path_match": "netflow.cisco_nvzflow_sys_vendor", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_sys_type": { - "path_match": "netflow.cisco_nvzflow_sys_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_proc_acct": { - "path_match": "netflow.cisco_nvzflow_proc_acct", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_parent_proc_acct": { - "path_match": "netflow.cisco_nvzflow_parent_proc_acct", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_proc": { - "path_match": "netflow.cisco_nvzflow_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_proc_hash": { - "path_match": "netflow.cisco_nvzflow_proc_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_parent_proc": { - "path_match": "netflow.cisco_nvzflow_parent_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_parent_proc_hash": { - "path_match": "netflow.cisco_nvzflow_parent_proc_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_dns_suffix": { - "path_match": "netflow.cisco_nvzflow_dns_suffix", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_dst_hostname": { - "path_match": "netflow.cisco_nvzflow_dst_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_l4_bytes_in": { - "path_match": "netflow.cisco_nvzflow_l4_bytes_in", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_nvzflow_l4_bytes_out": { - "path_match": "netflow.cisco_nvzflow_l4_bytes_out", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_nvzflow_os_edition": { - "path_match": "netflow.cisco_nvzflow_os_edition", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_module_list": { - "path_match": "netflow.cisco_nvzflow_module_list", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_hash_list": { - "path_match": "netflow.cisco_nvzflow_hash_list", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_coord_list": { - "path_match": "netflow.cisco_nvzflow_coord_list", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_iface_info_uid": { - "path_match": "netflow.cisco_nvzflow_iface_info_uid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_nvzflow_iface_index": { - "path_match": "netflow.cisco_nvzflow_iface_index", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_nvzflow_iface_type": { - "path_match": "netflow.cisco_nvzflow_iface_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_nvzflow_iface_name": { - "path_match": "netflow.cisco_nvzflow_iface_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_iface_details_list": { - "path_match": "netflow.cisco_nvzflow_iface_details_list", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_timestamp_abs_monitor_interval_start": { - "path_match": "netflow.cisco_timestamp_abs_monitor_interval_start", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_timestamp_abs_monitor_interval_end": { - "path_match": "netflow.cisco_timestamp_abs_monitor_interval_end", - "mapping": { - "type": "long" - } - } - }, + { + "netflow.cisco_avc_p2p_tech": { + "path_match": "netflow.cisco_avc_p2p_tech", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_tunnel_tech": { + "path_match": "netflow.cisco_avc_tunnel_tech", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_encrypt_tech": { + "path_match": "netflow.cisco_avc_encrypt_tech", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_ipt_dialing_phone": { + "path_match": "netflow.cisco_ipt_dialing_phone", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_ipt_dialing_user": { + "path_match": "netflow.cisco_ipt_dialing_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_ipt_dialed_phone": { + "path_match": "netflow.cisco_ipt_dialed_phone", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_ipt_dialed_user": { + "path_match": "netflow.cisco_ipt_dialed_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_ipt_call_duration": { + "path_match": "netflow.cisco_ipt_call_duration", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_ipt_call_end_reason": { + "path_match": "netflow.cisco_ipt_call_end_reason", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_ipt_calls_dialed": { + "path_match": "netflow.cisco_ipt_calls_dialed", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_ipt_calls_connected": { + "path_match": "netflow.cisco_ipt_calls_connected", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_ipt_calls_failed": { + "path_match": "netflow.cisco_ipt_calls_failed", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_nexus_fastpath_src_addr": { + "path_match": "netflow.cisco_nexus_fastpath_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_nexus_fastpath_src_port": { + "path_match": "netflow.cisco_nexus_fastpath_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_nexus_fastpath_dst_addr": { + "path_match": "netflow.cisco_nexus_fastpath_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_nexus_fastpath_dst_port": { + "path_match": "netflow.cisco_nexus_fastpath_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_endpoint_process_user": { + "path_match": "netflow.cisco_endpoint_process_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_endpoint_process_name": { + "path_match": "netflow.cisco_endpoint_process_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_endpoint_process_hash": { + "path_match": "netflow.cisco_endpoint_process_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_endpoint_process_parent_user": { + "path_match": "netflow.cisco_endpoint_process_parent_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_endpoint_process_parent_name": { + "path_match": "netflow.cisco_endpoint_process_parent_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_endpoint_process_parent_hash": { + "path_match": "netflow.cisco_endpoint_process_parent_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_pfr_policy_id": { + "path_match": "netflow.cisco_pfr_policy_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_map_name": { + "path_match": "netflow.cisco_pfr_map_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_pfr_reason": { + "path_match": "netflow.cisco_pfr_reason", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_fw_ingress_acl_id": { + "path_match": "netflow.cisco_fw_ingress_acl_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_fw_egress_acl_id": { + "path_match": "netflow.cisco_fw_egress_acl_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_fw_ext_event": { + "path_match": "netflow.cisco_fw_ext_event", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_fw_event_level": { + "path_match": "netflow.cisco_fw_event_level", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_event_level_id": { + "path_match": "netflow.cisco_fw_event_level_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_config_value": { + "path_match": "netflow.cisco_fw_config_value", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_erm_code": { + "path_match": "netflow.cisco_fw_erm_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_erm_descr": { + "path_match": "netflow.cisco_fw_erm_descr", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_trustsec_src_id": { + "path_match": "netflow.cisco_trustsec_src_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_trustsec_dst_id": { + "path_match": "netflow.cisco_trustsec_dst_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_trustsec_src_name": { + "path_match": "netflow.cisco_trustsec_src_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_trustsec_dst_name": { + "path_match": "netflow.cisco_trustsec_dst_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_trustsec_switch_derived_sgt": { + "path_match": "netflow.cisco_trustsec_switch_derived_sgt", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_fw_blackout_secs": { + "path_match": "netflow.cisco_fw_blackout_secs", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_half_open_sessions_rate_1min_max": { + "path_match": "netflow.cisco_fw_half_open_sessions_rate_1min_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_half_open_sessions_rate_1min": { + "path_match": "netflow.cisco_fw_half_open_sessions_rate_1min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_zonepair_id": { + "path_match": "netflow.cisco_fw_zonepair_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_sessions_max": { + "path_match": "netflow.cisco_fw_sessions_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_zonepair": { + "path_match": "netflow.cisco_fw_zonepair", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_fw_ext_event_descr": { + "path_match": "netflow.cisco_fw_ext_event_descr", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_fw_drop_pass_summary_packets": { + "path_match": "netflow.cisco_fw_drop_pass_summary_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_half_open_sessions": { + "path_match": "netflow.cisco_fw_half_open_sessions", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_dre_input": { + "path_match": "netflow.cisco_waas_dre_input", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_dre_output": { + "path_match": "netflow.cisco_waas_dre_output", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_lz_input": { + "path_match": "netflow.cisco_waas_lz_input", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_lz_output": { + "path_match": "netflow.cisco_waas_lz_output", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_conn_mode": { + "path_match": "netflow.cisco_waas_conn_mode", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_input_bytes": { + "path_match": "netflow.cisco_waas_input_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_output_bytes": { + "path_match": "netflow.cisco_waas_output_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_short_term_packets_drop": { + "path_match": "netflow.cisco_avc_transport_short_term_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_long_term_packets_drop": { + "path_match": "netflow.cisco_avc_transport_long_term_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_media_bytes": { + "path_match": "netflow.cisco_avc_app_media_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_media_byte_rate": { + "path_match": "netflow.cisco_avc_app_media_byte_rate", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_media_packets": { + "path_match": "netflow.cisco_avc_app_media_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_media_packet_rate": { + "path_match": "netflow.cisco_avc_app_media_packet_rate", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_media_packet_rate_variation": { + "path_match": "netflow.cisco_avc_app_media_packet_rate_variation", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_media_event": { + "path_match": "netflow.cisco_avc_app_media_event", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_monitor_event": { + "path_match": "netflow.cisco_avc_app_monitor_event", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_packets_expected": { + "path_match": "netflow.cisco_avc_transport_packets_expected", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtt": { + "path_match": "netflow.cisco_avc_transport_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_packet_sets_lost": { + "path_match": "netflow.cisco_avc_transport_packet_sets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_short_term_packets_lost": { + "path_match": "netflow.cisco_avc_transport_short_term_packets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_long_term_packets_lost": { + "path_match": "netflow.cisco_avc_transport_long_term_packets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_packet_loss_rate": { + "path_match": "netflow.cisco_avc_transport_packet_loss_rate", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtp_ssrc": { + "path_match": "netflow.cisco_avc_transport_rtp_ssrc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtp_jitter_mean": { + "path_match": "netflow.cisco_avc_transport_rtp_jitter_mean", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtp_jitter_min": { + "path_match": "netflow.cisco_avc_transport_rtp_jitter_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtp_jitter_max": { + "path_match": "netflow.cisco_avc_transport_rtp_jitter_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_controlled_tc": { + "path_match": "netflow.cisco_avc_controlled_tc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_in_policy_tc": { + "path_match": "netflow.cisco_avc_in_policy_tc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_media_packet_rate_variation_min": { + "path_match": "netflow.cisco_avc_app_media_packet_rate_variation_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_media_packet_rate_variation_max": { + "path_match": "netflow.cisco_avc_app_media_packet_rate_variation_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtp_flows": { + "path_match": "netflow.cisco_avc_transport_rtp_flows", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtp_payload_type": { + "path_match": "netflow.cisco_avc_transport_rtp_payload_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_packet_loss_rate_min": { + "path_match": "netflow.cisco_avc_transport_packet_loss_rate_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_packet_loss_rate_max": { + "path_match": "netflow.cisco_avc_transport_packet_loss_rate_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtt_sum": { + "path_match": "netflow.cisco_avc_transport_rtt_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtt_min": { + "path_match": "netflow.cisco_avc_transport_rtt_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtt_max": { + "path_match": "netflow.cisco_avc_transport_rtt_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_metadata_global_session_id": { + "path_match": "netflow.cisco_avc_metadata_global_session_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_metadata_multi_party_session_id": { + "path_match": "netflow.cisco_avc_metadata_multi_party_session_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_metadata_clock_rate": { + "path_match": "netflow.cisco_avc_metadata_clock_rate", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_network_delay_avg": { + "path_match": "netflow.cisco_avc_network_delay_avg", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_one_way_delay": { + "path_match": "netflow.cisco_avc_one_way_delay", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_tcp_window_size_min": { + "path_match": "netflow.cisco_avc_tcp_window_size_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_tcp_window_size_max": { + "path_match": "netflow.cisco_avc_tcp_window_size_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_tcp_max_segment_size": { + "path_match": "netflow.cisco_avc_tcp_max_segment_size", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_tcp_window_size_sum": { + "path_match": "netflow.cisco_avc_tcp_window_size_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_rtp_jitter_interarrival_avg": { + "path_match": "netflow.cisco_avc_rtp_jitter_interarrival_avg", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_src_site_id": { + "path_match": "netflow.cisco_pfr_src_site_id", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_pfr_dst_site_id": { + "path_match": "netflow.cisco_pfr_dst_site_id", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_avc_transport_byte_loss_rate": { + "path_match": "netflow.cisco_avc_transport_byte_loss_rate", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_event_tc_nomitigation_err_bw_count": { + "path_match": "netflow.cisco_pfr_event_tc_nomitigation_err_bw_count", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_event_tc_nomitigation_err_perf_count": { + "path_match": "netflow.cisco_pfr_event_tc_nomitigation_err_perf_count", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_dst_site_prefix": { + "path_match": "netflow.cisco_pfr_dst_site_prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_pfr_dst_site_prefix_mask": { + "path_match": "netflow.cisco_pfr_dst_site_prefix_mask", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_label_id": { + "path_match": "netflow.cisco_pfr_label_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_br_addr": { + "path_match": "netflow.cisco_pfr_br_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_pfr_state": { + "path_match": "netflow.cisco_pfr_state", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_reason_id": { + "path_match": "netflow.cisco_pfr_reason_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_threshold": { + "path_match": "netflow.cisco_pfr_threshold", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_priority": { + "path_match": "netflow.cisco_pfr_priority", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_long_term_rtt": { + "path_match": "netflow.cisco_avc_long_term_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_mos_below_counts": { + "path_match": "netflow.cisco_avc_mos_below_counts", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_rsvp_bandwidth_pool": { + "path_match": "netflow.cisco_avc_rsvp_bandwidth_pool", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_rollup_counter": { + "path_match": "netflow.cisco_avc_rollup_counter", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_kth_tier_percent": { + "path_match": "netflow.cisco_avc_kth_tier_percent", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_kth_bw_fee": { + "path_match": "netflow.cisco_avc_kth_bw_fee", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_src_port_min": { + "path_match": "netflow.cisco_avc_src_port_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_src_port_max": { + "path_match": "netflow.cisco_avc_src_port_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_dst_port_min": { + "path_match": "netflow.cisco_avc_dst_port_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_dst_port_max": { + "path_match": "netflow.cisco_avc_dst_port_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_link_capacity": { + "path_match": "netflow.cisco_avc_link_capacity", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_ingress_bw": { + "path_match": "netflow.cisco_avc_ingress_bw", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_ingress_bw_max": { + "path_match": "netflow.cisco_avc_ingress_bw_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_egress_bw": { + "path_match": "netflow.cisco_avc_egress_bw", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_egress_bw_max": { + "path_match": "netflow.cisco_avc_egress_bw_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_ingress_rollup_bw": { + "path_match": "netflow.cisco_avc_ingress_rollup_bw", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_egress_rollup_bw": { + "path_match": "netflow.cisco_avc_egress_rollup_bw", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_cost_target_bw": { + "path_match": "netflow.cisco_avc_cost_target_bw", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_kth_rollup_bw": { + "path_match": "netflow.cisco_avc_kth_rollup_bw", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_link_group_name": { + "path_match": "netflow.cisco_avc_link_group_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_bgp_community": { + "path_match": "netflow.cisco_avc_bgp_community", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_avc_bgp_prepend": { + "path_match": "netflow.cisco_avc_bgp_prepend", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_cost_discard_rollup_count": { + "path_match": "netflow.cisco_avc_cost_discard_rollup_count", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_user": { + "path_match": "netflow.cisco_fw_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_fw_xlate_src_addr_ipv4": { + "path_match": "netflow.cisco_fw_xlate_src_addr_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_fw_xlate_dst_addr_ipv4": { + "path_match": "netflow.cisco_fw_xlate_dst_addr_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_fw_xlate_src_port": { + "path_match": "netflow.cisco_fw_xlate_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_xlate_dst_port": { + "path_match": "netflow.cisco_fw_xlate_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_event": { + "path_match": "netflow.cisco_fw_event", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_client_long_lived_network_delay_max": { + "path_match": "netflow.cisco_avc_client_long_lived_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_long_lived_network_delay_min": { + "path_match": "netflow.cisco_avc_client_long_lived_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_long_lived_network_delay_max": { + "path_match": "netflow.cisco_avc_server_long_lived_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_long_lived_network_delay_min": { + "path_match": "netflow.cisco_avc_server_long_lived_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_policy_qos_class_hierarchy": { + "path_match": "netflow.cisco_policy_qos_class_hierarchy", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_server_bytes": { + "path_match": "netflow.cisco_avc_server_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_bytes": { + "path_match": "netflow.cisco_avc_client_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_concurrent_sessions": { + "path_match": "netflow.cisco_avc_concurrent_sessions", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_segment": { + "path_match": "netflow.cisco_waas_segment", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_passthru_reason": { + "path_match": "netflow.cisco_waas_passthru_reason", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_long_lived_network_delay_sum": { + "path_match": "netflow.cisco_avc_server_long_lived_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_long_lived_network_delay_sum": { + "path_match": "netflow.cisco_avc_client_long_lived_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_total_long_lived_network_delay_sum": { + "path_match": "netflow.cisco_avc_total_long_lived_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_total_long_lived_network_delay_samples": { + "path_match": "netflow.cisco_avc_total_long_lived_network_delay_samples", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_long_lived_network_delay_samples": { + "path_match": "netflow.cisco_avc_server_long_lived_network_delay_samples", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_long_lived_network_delay_samples": { + "path_match": "netflow.cisco_avc_client_long_lived_network_delay_samples", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_packets": { + "path_match": "netflow.cisco_avc_client_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_packets": { + "path_match": "netflow.cisco_avc_server_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_retrans_bytes": { + "path_match": "netflow.cisco_avc_client_retrans_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_retrans_packets": { + "path_match": "netflow.cisco_avc_client_retrans_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_retrans_bytes": { + "path_match": "netflow.cisco_avc_server_retrans_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_retrans_packets": { + "path_match": "netflow.cisco_avc_server_retrans_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transact_time_delta": { + "path_match": "netflow.cisco_avc_transact_time_delta", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transact_time_total": { + "path_match": "netflow.cisco_avc_transact_time_total", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transact_time_max": { + "path_match": "netflow.cisco_avc_transact_time_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transact_time_min": { + "path_match": "netflow.cisco_avc_transact_time_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_resps": { + "path_match": "netflow.cisco_avc_server_resps", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_resp_histogram1": { + "path_match": "netflow.cisco_avc_resp_histogram1", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_resp_histogram2": { + "path_match": "netflow.cisco_avc_resp_histogram2", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_resp_histogram3": { + "path_match": "netflow.cisco_avc_resp_histogram3", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_resp_histogram4": { + "path_match": "netflow.cisco_avc_resp_histogram4", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_resp_histogram5": { + "path_match": "netflow.cisco_avc_resp_histogram5", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_resp_histogram6": { + "path_match": "netflow.cisco_avc_resp_histogram6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_resp_histogram7": { + "path_match": "netflow.cisco_avc_resp_histogram7", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_late_resps": { + "path_match": "netflow.cisco_avc_server_late_resps", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_resp_time_sum": { + "path_match": "netflow.cisco_avc_server_resp_time_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_resp_time_max": { + "path_match": "netflow.cisco_avc_server_resp_time_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_resp_time_min": { + "path_match": "netflow.cisco_avc_server_resp_time_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_delay_sum": { + "path_match": "netflow.cisco_avc_app_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_delay_max": { + "path_match": "netflow.cisco_avc_app_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_delay_min": { + "path_match": "netflow.cisco_avc_app_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_total_delay_sum": { + "path_match": "netflow.cisco_avc_total_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_total_delay_max": { + "path_match": "netflow.cisco_avc_total_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_total_delay_min": { + "path_match": "netflow.cisco_avc_total_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_total_network_delay_sum": { + "path_match": "netflow.cisco_avc_total_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_total_network_delay_max": { + "path_match": "netflow.cisco_avc_total_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_total_network_delay_min": { + "path_match": "netflow.cisco_avc_total_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_network_delay_sum": { + "path_match": "netflow.cisco_avc_client_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_network_delay_max": { + "path_match": "netflow.cisco_avc_client_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_network_delay_min": { + "path_match": "netflow.cisco_avc_client_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_network_delay_sum": { + "path_match": "netflow.cisco_avc_server_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_network_delay_max": { + "path_match": "netflow.cisco_avc_server_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_network_delay_min": { + "path_match": "netflow.cisco_avc_server_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_rtp_short_term_mos": { + "path_match": "netflow.cisco_avc_rtp_short_term_mos", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_rtp_mos": { + "path_match": "netflow.cisco_avc_rtp_mos", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_rtp_mos_total": { + "path_match": "netflow.cisco_avc_rtp_mos_total", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_http_uri_stats": { + "path_match": "netflow.cisco_avc_app_http_uri_stats", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_policy_qos_queue_id": { + "path_match": "netflow.cisco_avc_policy_qos_queue_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_policy_qos_queue_drops": { + "path_match": "netflow.cisco_avc_policy_qos_queue_drops", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_eta_idp_old": { + "path_match": "netflow.cisco_eta_idp_old", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_eta_slpt_old": { + "path_match": "netflow.cisco_eta_slpt_old", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_wlan_id": { + "path_match": "netflow.cisco_wlan_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_category": { + "path_match": "netflow.cisco_avc_app_category", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_app_sub_category": { + "path_match": "netflow.cisco_avc_app_sub_category", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_app_group": { + "path_match": "netflow.cisco_avc_app_group", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_app_http_host": { + "path_match": "netflow.cisco_avc_app_http_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_client_ipv4_addr": { + "path_match": "netflow.cisco_avc_client_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_avc_server_ipv4_addr": { + "path_match": "netflow.cisco_avc_server_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_avc_client_ipv6_addr": { + "path_match": "netflow.cisco_avc_client_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_avc_server_ipv6_addr": { + "path_match": "netflow.cisco_avc_server_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_avc_client_l4_port": { + "path_match": "netflow.cisco_avc_client_l4_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_l4_port": { + "path_match": "netflow.cisco_avc_server_l4_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_conn_id": { + "path_match": "netflow.cisco_avc_conn_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_traffic_class": { + "path_match": "netflow.cisco_avc_app_traffic_class", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_app_business_relevance": { + "path_match": "netflow.cisco_avc_app_business_relevance", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_udid": { + "path_match": "netflow.cisco_nvzflow_udid", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_user": { + "path_match": "netflow.cisco_nvzflow_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_os_name": { + "path_match": "netflow.cisco_nvzflow_os_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_os_ver": { + "path_match": "netflow.cisco_nvzflow_os_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_sys_vendor": { + "path_match": "netflow.cisco_nvzflow_sys_vendor", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_sys_type": { + "path_match": "netflow.cisco_nvzflow_sys_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_proc_acct": { + "path_match": "netflow.cisco_nvzflow_proc_acct", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_parent_proc_acct": { + "path_match": "netflow.cisco_nvzflow_parent_proc_acct", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_proc": { + "path_match": "netflow.cisco_nvzflow_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_proc_hash": { + "path_match": "netflow.cisco_nvzflow_proc_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_parent_proc": { + "path_match": "netflow.cisco_nvzflow_parent_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_parent_proc_hash": { + "path_match": "netflow.cisco_nvzflow_parent_proc_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_dns_suffix": { + "path_match": "netflow.cisco_nvzflow_dns_suffix", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_dst_hostname": { + "path_match": "netflow.cisco_nvzflow_dst_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_l4_bytes_in": { + "path_match": "netflow.cisco_nvzflow_l4_bytes_in", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_nvzflow_l4_bytes_out": { + "path_match": "netflow.cisco_nvzflow_l4_bytes_out", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_nvzflow_os_edition": { + "path_match": "netflow.cisco_nvzflow_os_edition", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_module_list": { + "path_match": "netflow.cisco_nvzflow_module_list", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_hash_list": { + "path_match": "netflow.cisco_nvzflow_hash_list", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_coord_list": { + "path_match": "netflow.cisco_nvzflow_coord_list", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_iface_info_uid": { + "path_match": "netflow.cisco_nvzflow_iface_info_uid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_nvzflow_iface_index": { + "path_match": "netflow.cisco_nvzflow_iface_index", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_nvzflow_iface_type": { + "path_match": "netflow.cisco_nvzflow_iface_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_nvzflow_iface_name": { + "path_match": "netflow.cisco_nvzflow_iface_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_iface_details_list": { + "path_match": "netflow.cisco_nvzflow_iface_details_list", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_timestamp_abs_monitor_interval_start": { + "path_match": "netflow.cisco_timestamp_abs_monitor_interval_start", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_timestamp_abs_monitor_interval_end": { + "path_match": "netflow.cisco_timestamp_abs_monitor_interval_end", + "mapping": { + "type": "long" + } + } + }, - { - "netflow.ericsson_nat_context_id": { - "path_match": "netflow.ericsson_nat_context_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ericsson_nat_context_name": { - "path_match": "netflow.ericsson_nat_context_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ericsson_nat_assign_ts_secs": { - "path_match": "netflow.ericsson_nat_assign_ts_secs", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ericsson_nat_unassign_ts_secs": { - "path_match": "netflow.ericsson_nat_unassign_ts_secs", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ericsson_nat_int_ipv4": { - "path_match": "netflow.ericsson_nat_internal_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ericsson_nat_ext_ipv4": { - "path_match": "netflow.ericsson_nat_external_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ericsson_nat_ext_port_start": { - "path_match": "netflow.ericsson_nat_external_port_start", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ericsson_nat_ext_port_end": { - "path_match": "netflow.ericsson_nat_external_port_end", - "mapping": { - "type": "long" - } - } - }, + { + "netflow.ericsson_nat_context_id": { + "path_match": "netflow.ericsson_nat_context_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ericsson_nat_context_name": { + "path_match": "netflow.ericsson_nat_context_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ericsson_nat_assign_ts_secs": { + "path_match": "netflow.ericsson_nat_assign_ts_secs", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ericsson_nat_unassign_ts_secs": { + "path_match": "netflow.ericsson_nat_unassign_ts_secs", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ericsson_nat_int_ipv4": { + "path_match": "netflow.ericsson_nat_internal_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ericsson_nat_ext_ipv4": { + "path_match": "netflow.ericsson_nat_external_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ericsson_nat_ext_port_start": { + "path_match": "netflow.ericsson_nat_external_port_start", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ericsson_nat_ext_port_end": { + "path_match": "netflow.ericsson_nat_external_port_end", + "mapping": { + "type": "long" + } + } + }, - - { - "netflow.ntop_src_frags": { - "path_match": "netflow.ntop_src_frags", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_frags": { - "path_match": "netflow.ntop_dst_frags", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_to_dst_max_throughput": { - "path_match": "netflow.ntop_src_to_dst_max_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_to_dst_min_throughput": { - "path_match": "netflow.ntop_src_to_dst_min_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_to_dst_avg_throughput": { - "path_match": "netflow.ntop_src_to_dst_avg_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_to_src_max_throughput": { - "path_match": "netflow.ntop_dst_to_src_max_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_to_src_min_throughput": { - "path_match": "netflow.ntop_dst_to_src_min_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_to_src_avg_throughput": { - "path_match": "netflow.ntop_dst_to_src_avg_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_upto_128_bytes": { - "path_match": "netflow.ntop_packets_upto_128_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_128_to_256_bytes": { - "path_match": "netflow.ntop_packets_128_to_256_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_256_to_512_bytes": { - "path_match": "netflow.ntop_packets_256_to_512_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_512_to_1024_bytes": { - "path_match": "netflow.ntop_packets_512_to_1024_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_1024_to_1514_bytes": { - "path_match": "netflow.ntop_packets_1024_to_1514_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_over_1514_bytes": { - "path_match": "netflow.ntop_packets_over_1514_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_cumulative_icmp_type": { - "path_match": "netflow.ntop_cumulative_icmp_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_country": { - "path_match": "netflow.ntop_src_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_src_city": { - "path_match": "netflow.ntop_src_city", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dst_country": { - "path_match": "netflow.ntop_dst_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dst_city": { - "path_match": "netflow.ntop_dst_city", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_flow_proto_port": { - "path_match": "netflow.ntop_flow_proto_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tunnel_id": { - "path_match": "netflow.ntop_tunnel_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_longest_flow_packet": { - "path_match": "netflow.ntop_longest_flow_packet", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_shortest_flow_packet": { - "path_match": "netflow.ntop_shortest_flow_packet", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_retrans_in_packets": { - "path_match": "netflow.ntop_retrans_in_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_retrans_out_packets": { - "path_match": "netflow.ntop_retrans_out_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_ooorder_in_packets": { - "path_match": "netflow.ntop_ooorder_in_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_ooorder_out_packets": { - "path_match": "netflow.ntop_ooorder_out_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_untunneled_protocol": { - "path_match": "netflow.ntop_untunneled_protocol", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_untunneled_ipv4_src_addr": { - "path_match": "netflow.ntop_untunneled_ipv4_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_untunneled_l4_src_port": { - "path_match": "netflow.ntop_untunneled_l4_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_untunneled_ipv4_dst_addr": { - "path_match": "netflow.ntop_untunneled_ipv4_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_untunneled_l4_dst_port": { - "path_match": "netflow.ntop_untunneled_l4_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_l7_proto": { - "path_match": "netflow.ntop_l7_proto", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_l7_proto_name": { - "path_match": "netflow.ntop_l7_proto_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_downstram_tunnel_id": { - "path_match": "netflow.ntop_downstram_tunnel_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_flow_user": { - "path_match": "netflow.ntop_flow_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_flow_server": { - "path_match": "netflow.ntop_flow_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_client_nw_latency_ms": { - "path_match": "netflow.ntop_client_nw_latency_ms", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_server_nw_latency_ms": { - "path_match": "netflow.ntop_server_nw_latency_ms", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_appl_latency_ms": { - "path_match": "netflow.ntop_appl_latency_ms", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_plugin": { - "path_match": "netflow.ntop_plugin", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_retrans_in_bytes": { - "path_match": "netflow.ntop_retrans_in_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_retrans_out_bytes": { - "path_match": "netflow.ntop_retrans_out_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_call_id": { - "path_match": "netflow.ntop_sip_call_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_sip_calling_party": { - "path_match": "netflow.ntop_sip_calling_party", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_sip_called_party": { - "path_match": "netflow.ntop_sip_called_party", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_sip_rtp_codecs": { - "path_match": "netflow.ntop_sip_rtp_codecs", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_sip_invite_time": { - "path_match": "netflow.ntop_sip_invite_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_trying_time": { - "path_match": "netflow.ntop_sip_trying_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_ringing_time": { - "path_match": "netflow.ntop_sip_ringing_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_ok_time": { - "path_match": "netflow.ntop_sip_ok_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_invite_failure_time": { - "path_match": "netflow.ntop_sip_invite_failure_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_bye_time": { - "path_match": "netflow.ntop_sip_bye_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_bye_ok_time": { - "path_match": "netflow.ntop_sip_bye_ok_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_cancel_time": { - "path_match": "netflow.ntop_sip_cancel_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_cancel_ok_time": { - "path_match": "netflow.ntop_sip_cancel_ok_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_rtp_ipv4_src_addr": { - "path_match": "netflow.ntop_sip_rtp_ipv4_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_sip_rtp_l4_src_port": { - "path_match": "netflow.ntop_sip_rtp_l4_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_rtp_ipv4_dst_addr": { - "path_match": "netflow.ntop_sip_rtp_ipv4_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_sip_rtp_l4_dst_port": { - "path_match": "netflow.ntop_sip_rtp_l4_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_resp_code": { - "path_match": "netflow.ntop_sip_resp_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_reason_cause": { - "path_match": "netflow.ntop_sip_reason_cause", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_first_seq": { - "path_match": "netflow.ntop_rtp_first_seq", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_first_ts": { - "path_match": "netflow.ntop_rtp_first_ts", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_last_seq": { - "path_match": "netflow.ntop_rtp_last_seq", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_last_ts": { - "path_match": "netflow.ntop_rtp_last_ts", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_in_jitter": { - "path_match": "netflow.ntop_rtp_in_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_out_jitter": { - "path_match": "netflow.ntop_rtp_out_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_in_packets_lost": { - "path_match": "netflow.ntop_rtp_in_packets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_out_packets_lost": { - "path_match": "netflow.ntop_rtp_out_packets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_out_payload_type": { - "path_match": "netflow.ntop_rtp_out_payload_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_in_max_delta": { - "path_match": "netflow.ntop_rtp_in_max_delta", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_out_max_delta": { - "path_match": "netflow.ntop_rtp_out_max_delta", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_in_payload_type": { - "path_match": "netflow.ntop_rtp_in_payload_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_proc_id": { - "path_match": "netflow.ntop_src_proc_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_proc": { - "path_match": "netflow.ntop_src_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_http_url": { - "path_match": "netflow.ntop_http_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_http_ret_code": { - "path_match": "netflow.ntop_http_ret_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_http_referrer": { - "path_match": "netflow.ntop_http_referrer", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_http_user_agent": { - "path_match": "netflow.ntop_http_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_http_mime": { - "path_match": "netflow.ntop_http_mime", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_smtp_mail_from": { - "path_match": "netflow.ntop_smtp_mail_from", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_smtp_rcpt_to": { - "path_match": "netflow.ntop_smtp_rcpt_to", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_http_host": { - "path_match": "netflow.ntop_http_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ssl_server": { - "path_match": "netflow.ntop_ssl_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_bittorrent_hash": { - "path_match": "netflow.ntop_bittorrent_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_mysql_server_ver": { - "path_match": "netflow.ntop_mysql_server_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_mysql_user": { - "path_match": "netflow.ntop_mysql_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_mysql_db": { - "path_match": "netflow.ntop_mysql_db", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_mysql_query": { - "path_match": "netflow.ntop_mysql_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_mysql_resp": { - "path_match": "netflow.ntop_mysql_resp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_oracle_user": { - "path_match": "netflow.ntop_oracle_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_oracle_query": { - "path_match": "netflow.ntop_oracle_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_oracle_resp_code": { - "path_match": "netflow.ntop_oracle_resp_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_oracle_resp_string": { - "path_match": "netflow.ntop_oracle_resp_string", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_oracle_query_duration": { - "path_match": "netflow.ntop_oracle_query_duration", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dns_query": { - "path_match": "netflow.ntop_dns_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dns_query_id": { - "path_match": "netflow.ntop_dns_query_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dns_query_type": { - "path_match": "netflow.ntop_dns_query_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dns_ret_code": { - "path_match": "netflow.ntop_dns_ret_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dns_answers": { - "path_match": "netflow.ntop_dns_answers", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_pop_user": { - "path_match": "netflow.ntop_pop_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv1_req_msg_type": { - "path_match": "netflow.ntop_gtpv1_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_resp_msg_type": { - "path_match": "netflow.ntop_gtpv1_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_c2s_teid_data": { - "path_match": "netflow.ntop_gtpv1_c2s_teid_data", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_c2s_teid_ctrl": { - "path_match": "netflow.ntop_gtpv1_c2s_teid_ctrl", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_s2c_teid_data": { - "path_match": "netflow.ntop_gtpv1_s2c_teid_data", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_s2c_teid_ctrl": { - "path_match": "netflow.ntop_gtpv1_s2c_teid_ctrl", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_end_user_ip": { - "path_match": "netflow.ntop_gtpv1_end_user_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv1_end_user_imsi": { - "path_match": "netflow.ntop_gtpv1_end_user_imsi", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv1_end_user_msisdn": { - "path_match": "netflow.ntop_gtpv1_end_user_msisdn", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv1_end_user_imei": { - "path_match": "netflow.ntop_gtpv1_end_user_imei", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv1_apn": { - "path_match": "netflow.ntop_gtpv1_apn", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv1_rai_mcc": { - "path_match": "netflow.ntop_gtpv1_rai_mcc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_rai_mnc": { - "path_match": "netflow.ntop_gtpv1_rai_mnc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_uli_cell_lac": { - "path_match": "netflow.ntop_gtpv1_uli_cell_lac", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_uli_cell_ci": { - "path_match": "netflow.ntop_gtpv1_uli_cell_ci", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_uli_sac": { - "path_match": "netflow.ntop_gtpv1_uli_sac", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_rai_type": { - "path_match": "netflow.ntop_gtpv1_rai_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_radius_req_msg_type": { - "path_match": "netflow.ntop_radius_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_radius_resp_msg_type": { - "path_match": "netflow.ntop_radius_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_radius_user": { - "path_match": "netflow.ntop_radius_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_radius_calling_station_id": { - "path_match": "netflow.ntop_radius_calling_station_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_radius_called_station_id": { - "path_match": "netflow.ntop_radius_called_station_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_radius_nas_ip": { - "path_match": "netflow.ntop_radius_nas_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_radius_nas_id": { - "path_match": "netflow.ntop_radius_nas_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_radius_user_imsi": { - "path_match": "netflow.ntop_radius_user_imsi", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_radius_user_imei": { - "path_match": "netflow.ntop_radius_user_imei", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_radius_framed_ip": { - "path_match": "netflow.ntop_radius_framed_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_radius_acct_sess_id": { - "path_match": "netflow.ntop_radius_acct_sess_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_radius_acct_status_type": { - "path_match": "netflow.ntop_radius_acct_status_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_radius_acct_in_octets": { - "path_match": "netflow.ntop_radius_acct_in_octets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_radius_acct_out_octets": { - "path_match": "netflow.ntop_radius_acct_out_octets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_radius_acct_in_packets": { - "path_match": "netflow.ntop_radius_acct_in_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_radius_acct_out_packets": { - "path_match": "netflow.ntop_radius_acct_out_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_imap_login": { - "path_match": "netflow.ntop_imap_login", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv2_req_msg_type": { - "path_match": "netflow.ntop_gtpv2_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_resp_msg_type": { - "path_match": "netflow.ntop_gtpv2_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_c2s_s1u_gtpu_teid": { - "path_match": "netflow.ntop_gtpv2_c2s_s1u_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_c2s_s1u_gtpu_ip": { - "path_match": "netflow.ntop_gtpv2_c2s_s1u_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv2_s2c_s1u_gtpu_teid": { - "path_match": "netflow.ntop_gtpv2_s2c_s1u_gtpu_teid", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv2_s2c_s1u_gtpu_ip": { - "path_match": "netflow.ntop_gtpv2_s2c_s1u_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv2_end_user_imsi": { - "path_match": "netflow.ntop_gtpv2_end_user_imsi", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv2_and_user_msisdn": { - "path_match": "netflow.ntop_gtpv2_and_user_msisdn", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv2_apn": { - "path_match": "netflow.ntop_gtpv2_apn", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv2_uli_mcc": { - "path_match": "netflow.ntop_gtpv2_uli_mcc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_uli_mnc": { - "path_match": "netflow.ntop_gtpv2_uli_mnc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_uli_cell_tac": { - "path_match": "netflow.ntop_gtpv2_uli_cell_tac", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_uli_cell_id": { - "path_match": "netflow.ntop_gtpv2_uli_cell_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_rat_type": { - "path_match": "netflow.ntop_gtpv2_rat_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_pdn_ip": { - "path_match": "netflow.ntop_gtpv2_pdn_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv2_end_user_imei": { - "path_match": "netflow.ntop_gtpv2_end_user_imei", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_src_as_path_1": { - "path_match": "netflow.ntop_src_as_path_1", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_2": { - "path_match": "netflow.ntop_src_as_path_2", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_3": { - "path_match": "netflow.ntop_src_as_path_3", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_4": { - "path_match": "netflow.ntop_src_as_path_4", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_5": { - "path_match": "netflow.ntop_src_as_path_5", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_6": { - "path_match": "netflow.ntop_src_as_path_6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_7": { - "path_match": "netflow.ntop_src_as_path_7", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_8": { - "path_match": "netflow.ntop_src_as_path_8", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_9": { - "path_match": "netflow.ntop_src_as_path_9", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_10": { - "path_match": "netflow.ntop_src_as_path_10", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_1": { - "path_match": "netflow.ntop_dst_as_path_1", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_2": { - "path_match": "netflow.ntop_dst_as_path_2", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_3": { - "path_match": "netflow.ntop_dst_as_path_3", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_4": { - "path_match": "netflow.ntop_dst_as_path_4", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_5": { - "path_match": "netflow.ntop_dst_as_path_5", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_6": { - "path_match": "netflow.ntop_dst_as_path_6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_7": { - "path_match": "netflow.ntop_dst_as_path_7", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_8": { - "path_match": "netflow.ntop_dst_as_path_8", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_9": { - "path_match": "netflow.ntop_dst_as_path_9", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_10": { - "path_match": "netflow.ntop_dst_as_path_10", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_mysql_appl_latency_usec": { - "path_match": "netflow.ntop_mysql_appl_latency_usec", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv0_req_msg_type": { - "path_match": "netflow.ntop_gtpv0_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv0_resp_msg_type": { - "path_match": "netflow.ntop_gtpv0_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv0_tid": { - "path_match": "netflow.ntop_gtpv0_tid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv0_end_user_ip": { - "path_match": "netflow.ntop_gtpv0_end_user_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv0_end_user_msisdn": { - "path_match": "netflow.ntop_gtpv0_end_user_msisdn", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv0_apn": { - "path_match": "netflow.ntop_gtpv0_apn", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv0_rai_mcc": { - "path_match": "netflow.ntop_gtpv0_rai_mcc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv0_rai_mnc": { - "path_match": "netflow.ntop_gtpv0_rai_mnc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv0_rai_cell_lac": { - "path_match": "netflow.ntop_gtpv0_rai_cell_lac", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv0_rai_cell_rac": { - "path_match": "netflow.ntop_gtpv0_rai_cell_rac", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv0_resp_cause": { - "path_match": "netflow.ntop_gtpv0_resp_cause", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_resp_cause": { - "path_match": "netflow.ntop_gtpv1_resp_cause", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_resp_cause": { - "path_match": "netflow.ntop_gtpv2_resp_cause", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_5_32": { - "path_match": "netflow.ntop_packets_ttl_5_32", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_32_64": { - "path_match": "netflow.ntop_packets_ttl_32_64", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_64_96": { - "path_match": "netflow.ntop_packets_ttl_64_96", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_96_128": { - "path_match": "netflow.ntop_packets_ttl_96_128", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_128_160": { - "path_match": "netflow.ntop_packets_ttl_128_160", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_160_192": { - "path_match": "netflow.ntop_packets_ttl_160_192", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_192_224": { - "path_match": "netflow.ntop_packets_ttl_192_224", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_224_225": { - "path_match": "netflow.ntop_packets_ttl_224_225", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_rai_lac": { - "path_match": "netflow.ntop_gtpv1_rai_lac", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_rai_rac": { - "path_match": "netflow.ntop_gtpv1_rai_rac", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_uli_mcc": { - "path_match": "netflow.ntop_gtpv1_uli_mcc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_uli_mnc": { - "path_match": "netflow.ntop_gtpv1_uli_mnc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_2_5": { - "path_match": "netflow.ntop_packets_ttl_2_5", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_eq_1": { - "path_match": "netflow.ntop_packets_ttl_eq_1", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_sip_call_id": { - "path_match": "netflow.ntop_rtp_sip_call_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_in_src_osi_sap": { - "path_match": "netflow.ntop_in_src_osi_sap", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_out_dst_osi_sap": { - "path_match": "netflow.ntop_out_dst_osi_sap", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_whois_das_domain": { - "path_match": "netflow.ntop_whois_das_domain", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dns_ttl_answer": { - "path_match": "netflow.ntop_dns_ttl_answer", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dhcp_client_mac": { - "path_match": "netflow.ntop_dhcp_client_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dhcp_client_ip": { - "path_match": "netflow.ntop_dhcp_client_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_dhcp_client": { - "path_match": "netflow.ntop_dhcp_client", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ftp_login": { - "path_match": "netflow.ntop_ftp_login", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ftp_password": { - "path_match": "netflow.ntop_ftp_password", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ftp_command": { - "path_match": "netflow.ntop_ftp_command", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ftp_command_ret_code": { - "path_match": "netflow.ntop_ftp_command_ret_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_http_method": { - "path_match": "netflow.ntop_http_method", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_http_site": { - "path_match": "netflow.ntop_http_site", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_sip_c_ip": { - "path_match": "netflow.ntop_sip_c_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_sip_call_state": { - "path_match": "netflow.ntop_sip_call_state", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_rtp_in_mos": { - "path_match": "netflow.ntop_rtp_in_mos", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_in_r_factor": { - "path_match": "netflow.ntop_rtp_in_r_factor", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_proc_user": { - "path_match": "netflow.ntop_src_proc_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_src_father_proc_pid": { - "path_match": "netflow.ntop_src_father_proc_pid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_father_proc": { - "path_match": "netflow.ntop_src_father_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dst_proc_pid": { - "path_match": "netflow.ntop_dst_proc_pid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_proc": { - "path_match": "netflow.ntop_dst_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dst_proc_user": { - "path_match": "netflow.ntop_dst_proc_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dst_father_proc_pid": { - "path_match": "netflow.ntop_dst_father_proc_pid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_father_proc": { - "path_match": "netflow.ntop_dst_father_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_rtp_rtt": { - "path_match": "netflow.ntop_rtp_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_in_transit": { - "path_match": "netflow.ntop_rtp_in_transit", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_out_transit": { - "path_match": "netflow.ntop_rtp_out_transit", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_proc_actual_memory": { - "path_match": "netflow.ntop_src_proc_actual_memory", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_proc_peak_memory": { - "path_match": "netflow.ntop_src_proc_peak_memory", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_proc_avg_cpu_load": { - "path_match": "netflow.ntop_src_proc_avg_cpu_load", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_proc_page_faults": { - "path_match": "netflow.ntop_src_proc_page_faults", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_proc_actual_memory": { - "path_match": "netflow.ntop_dst_proc_actual_memory", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_proc_peak_memory": { - "path_match": "netflow.ntop_dst_proc_peak_memory", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_proc_avg_cpu_load": { - "path_match": "netflow.ntop_dst_proc_avg_cpu_load", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_proc_page_faults": { - "path_match": "netflow.ntop_dst_proc_page_faults", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_duration_in": { - "path_match": "netflow.ntop_duration_in", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_duration_out": { - "path_match": "netflow.ntop_duration_out", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_proc_pctg_iowait": { - "path_match": "netflow.ntop_src_proc_pctg_iowait", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_proc_pctg_iowait": { - "path_match": "netflow.ntop_dst_proc_pctg_iowait", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_dtmf_tones": { - "path_match": "netflow.ntop_rtp_dtmf_tones", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_untunneled_ipv6_src_addr": { - "path_match": "netflow.ntop_untunneled_ipv6_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_untunneled_ipv6_dst_addr": { - "path_match": "netflow.ntop_untunneled_ipv6_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_dns_resp": { - "path_match": "netflow.ntop_dns_resp", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_diameter_req_msg_type": { - "path_match": "netflow.ntop_diameter_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_diameter_resp_msg_type": { - "path_match": "netflow.ntop_diameter_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_diameter_req_origin_host": { - "path_match": "netflow.ntop_diameter_req_origin_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_diameter_resp_origin_host": { - "path_match": "netflow.ntop_diameter_resp_origin_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_diameter_req_user": { - "path_match": "netflow.ntop_diameter_req_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_diameter_resp_result_code": { - "path_match": "netflow.ntop_diameter_resp_result_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_diameter_exp_res_vendor_id": { - "path_match": "netflow.ntop_diameter_exp_res_vendor_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_diameter_exp_res_result_code": { - "path_match": "netflow.ntop_diameter_exp_res_result_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_s1ap_enb_ue_s1ap_id": { - "path_match": "netflow.ntop_s1ap_enb_ue_s1ap_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_s1ap_mme_ue_s1ap_id": { - "path_match": "netflow.ntop_s1ap_mme_ue_s1ap_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_s1ap_msg_emm_type_mme_to_enb": { - "path_match": "netflow.ntop_s1ap_msg_emm_type_mme_to_enb", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_s1ap_msg_esm_type_mme_to_enb": { - "path_match": "netflow.ntop_s1ap_msg_esm_type_mme_to_enb", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_s1ap_msg_emm_type_enb_to_mme": { - "path_match": "netflow.ntop_s1ap_msg_emm_type_enb_to_mme", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_s1ap_msg_esm_type_enb_to_mme": { - "path_match": "netflow.ntop_s1ap_msg_esm_type_enb_to_mme", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_s1ap_cause_enb_to_mme": { - "path_match": "netflow.ntop_s1ap_cause_enb_to_mme", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_s1ap_detailed_cause_enb_to_mme": { - "path_match": "netflow.ntop_s1ap_detailed_cause_enb_to_mme", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tcp_win_min_in": { - "path_match": "netflow.ntop_tcp_win_min_in", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tcp_win_max_in": { - "path_match": "netflow.ntop_tcp_win_max_in", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tcp_win_mss_in": { - "path_match": "netflow.ntop_tcp_win_mss_in", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tcp_win_scale_in": { - "path_match": "netflow.ntop_tcp_win_scale_in", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tcp_win_min_out": { - "path_match": "netflow.ntop_tcp_win_min_out", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tcp_win_max_out": { - "path_match": "netflow.ntop_tcp_win_max_out", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tcp_win_mss_out": { - "path_match": "netflow.ntop_tcp_win_mss_out", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tcp_win_scale_out": { - "path_match": "netflow.ntop_tcp_win_scale_out", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dhcp_remote_id": { - "path_match": "netflow.ntop_dhcp_remote_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dhcp_subscriber_id": { - "path_match": "netflow.ntop_dhcp_subscriber_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_src_proc_uid": { - "path_match": "netflow.ntop_src_proc_uid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_proc_uid": { - "path_match": "netflow.ntop_dst_proc_uid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_application": { - "path_match": "netflow.ntop_application", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_user": { - "path_match": "netflow.ntop_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dhcp_message_type": { - "path_match": "netflow.ntop_dhcp_message_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_rtp_in_packets_drop": { - "path_match": "netflow.ntop_rtp_in_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_out_packets_drop": { - "path_match": "netflow.ntop_rtp_out_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_out_mos": { - "path_match": "netflow.ntop_rtp_out_mos", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_out_r_factor": { - "path_match": "netflow.ntop_rtp_out_r_factor", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_mos": { - "path_match": "netflow.ntop_rtp_mos", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gptv2_s5_s8_gtpc_teid": { - "path_match": "netflow.ntop_gptv2_s5_s8_gtpc_teid", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_rtp_r_factor": { - "path_match": "netflow.ntop_rtp_r_factor", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_ssrc": { - "path_match": "netflow.ntop_rtp_ssrc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_payload_hash": { - "path_match": "netflow.ntop_payload_hash", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_c2s_s5_s8_gtpu_teid": { - "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_s2c_s5_s8_gtpu_teid": { - "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_c2s_s5_s8_gtpu_ip": { - "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv2_s2c_s5_s8_gtpu_ip": { - "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_src_as_map": { - "path_match": "netflow.ntop_src_as_map", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dst_as_map": { - "path_match": "netflow.ntop_dst_as_map", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_diameter_hop_by_hop_id": { - "path_match": "netflow.ntop_diameter_hop_by_hop_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_upstream_sess_id": { - "path_match": "netflow.ntop_upstream_sess_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_downstream_sess_id": { - "path_match": "netflow.ntop_downstream_sess_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_long": { - "path_match": "netflow.ntop_src_long", - "mapping": { - "type": "float" - } - } - }, - { - "netflow.ntop_src_lat": { - "path_match": "netflow.ntop_src_lat", - "mapping": { - "type": "float" - } - } - }, - { - "netflow.ntop_dst_long": { - "path_match": "netflow.ntop_dst_long", - "mapping": { - "type": "float" - } - } - }, - { - "netflow.ntop_dst_lat": { - "path_match": "netflow.ntop_dst_lat", - "mapping": { - "type": "float" - } - } - }, - { - "netflow.ntop_diameter_clr_cancel_type": { - "path_match": "netflow.ntop_diameter_clr_cancel_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_diameter_clr_flags": { - "path_match": "netflow.ntop_diameter_clr_flags", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_c2s_s5_s8_gtpc_ip": { - "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_gtpc_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv2_s2c_s5_s8_gtpc_ip": { - "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_gtpc_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid": { - "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid": { - "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip": { - "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip": { - "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_http_x_forwarded_for": { - "path_match": "netflow.ntop_http_x_forwarded_for", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_http_via": { - "path_match": "netflow.ntop_http_via", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ssdp_host": { - "path_match": "netflow.ntop_ssdp_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ssdp_usn": { - "path_match": "netflow.ntop_ssdp_usn", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_netbios_query": { - "path_match": "netflow.ntop_netbios_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_netbios_query_type": { - "path_match": "netflow.ntop_netbios_query_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_netbios_resp": { - "path_match": "netflow.ntop_netbios_resp", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_netbios_query_os": { - "path_match": "netflow.ntop_netbios_query_os", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ssdp_server": { - "path_match": "netflow.ntop_ssdp_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ssdp_type": { - "path_match": "netflow.ntop_ssdp_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ssdp_method": { - "path_match": "netflow.ntop_ssdp_method", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_nprobe_ipv4_addr": { - "path_match": "netflow.ntop_nprobe_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, + + { + "netflow.ntop_src_frags": { + "path_match": "netflow.ntop_src_frags", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_frags": { + "path_match": "netflow.ntop_dst_frags", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_to_dst_max_throughput": { + "path_match": "netflow.ntop_src_to_dst_max_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_to_dst_min_throughput": { + "path_match": "netflow.ntop_src_to_dst_min_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_to_dst_avg_throughput": { + "path_match": "netflow.ntop_src_to_dst_avg_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_to_src_max_throughput": { + "path_match": "netflow.ntop_dst_to_src_max_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_to_src_min_throughput": { + "path_match": "netflow.ntop_dst_to_src_min_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_to_src_avg_throughput": { + "path_match": "netflow.ntop_dst_to_src_avg_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_upto_128_bytes": { + "path_match": "netflow.ntop_packets_upto_128_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_128_to_256_bytes": { + "path_match": "netflow.ntop_packets_128_to_256_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_256_to_512_bytes": { + "path_match": "netflow.ntop_packets_256_to_512_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_512_to_1024_bytes": { + "path_match": "netflow.ntop_packets_512_to_1024_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_1024_to_1514_bytes": { + "path_match": "netflow.ntop_packets_1024_to_1514_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_over_1514_bytes": { + "path_match": "netflow.ntop_packets_over_1514_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_cumulative_icmp_type": { + "path_match": "netflow.ntop_cumulative_icmp_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_country": { + "path_match": "netflow.ntop_src_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_src_city": { + "path_match": "netflow.ntop_src_city", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dst_country": { + "path_match": "netflow.ntop_dst_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dst_city": { + "path_match": "netflow.ntop_dst_city", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_flow_proto_port": { + "path_match": "netflow.ntop_flow_proto_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tunnel_id": { + "path_match": "netflow.ntop_tunnel_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_longest_flow_packet": { + "path_match": "netflow.ntop_longest_flow_packet", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_shortest_flow_packet": { + "path_match": "netflow.ntop_shortest_flow_packet", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_retrans_in_packets": { + "path_match": "netflow.ntop_retrans_in_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_retrans_out_packets": { + "path_match": "netflow.ntop_retrans_out_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_ooorder_in_packets": { + "path_match": "netflow.ntop_ooorder_in_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_ooorder_out_packets": { + "path_match": "netflow.ntop_ooorder_out_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_untunneled_protocol": { + "path_match": "netflow.ntop_untunneled_protocol", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_untunneled_ipv4_src_addr": { + "path_match": "netflow.ntop_untunneled_ipv4_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_untunneled_l4_src_port": { + "path_match": "netflow.ntop_untunneled_l4_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_untunneled_ipv4_dst_addr": { + "path_match": "netflow.ntop_untunneled_ipv4_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_untunneled_l4_dst_port": { + "path_match": "netflow.ntop_untunneled_l4_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_l7_proto": { + "path_match": "netflow.ntop_l7_proto", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_l7_proto_name": { + "path_match": "netflow.ntop_l7_proto_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_downstram_tunnel_id": { + "path_match": "netflow.ntop_downstram_tunnel_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_flow_user": { + "path_match": "netflow.ntop_flow_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_flow_server": { + "path_match": "netflow.ntop_flow_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_client_nw_latency_ms": { + "path_match": "netflow.ntop_client_nw_latency_ms", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_server_nw_latency_ms": { + "path_match": "netflow.ntop_server_nw_latency_ms", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_appl_latency_ms": { + "path_match": "netflow.ntop_appl_latency_ms", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_plugin": { + "path_match": "netflow.ntop_plugin", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_retrans_in_bytes": { + "path_match": "netflow.ntop_retrans_in_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_retrans_out_bytes": { + "path_match": "netflow.ntop_retrans_out_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_call_id": { + "path_match": "netflow.ntop_sip_call_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_sip_calling_party": { + "path_match": "netflow.ntop_sip_calling_party", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_sip_called_party": { + "path_match": "netflow.ntop_sip_called_party", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_sip_rtp_codecs": { + "path_match": "netflow.ntop_sip_rtp_codecs", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_sip_invite_time": { + "path_match": "netflow.ntop_sip_invite_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_trying_time": { + "path_match": "netflow.ntop_sip_trying_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_ringing_time": { + "path_match": "netflow.ntop_sip_ringing_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_ok_time": { + "path_match": "netflow.ntop_sip_ok_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_invite_failure_time": { + "path_match": "netflow.ntop_sip_invite_failure_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_bye_time": { + "path_match": "netflow.ntop_sip_bye_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_bye_ok_time": { + "path_match": "netflow.ntop_sip_bye_ok_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_cancel_time": { + "path_match": "netflow.ntop_sip_cancel_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_cancel_ok_time": { + "path_match": "netflow.ntop_sip_cancel_ok_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_rtp_ipv4_src_addr": { + "path_match": "netflow.ntop_sip_rtp_ipv4_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_sip_rtp_l4_src_port": { + "path_match": "netflow.ntop_sip_rtp_l4_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_rtp_ipv4_dst_addr": { + "path_match": "netflow.ntop_sip_rtp_ipv4_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_sip_rtp_l4_dst_port": { + "path_match": "netflow.ntop_sip_rtp_l4_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_resp_code": { + "path_match": "netflow.ntop_sip_resp_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_reason_cause": { + "path_match": "netflow.ntop_sip_reason_cause", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_first_seq": { + "path_match": "netflow.ntop_rtp_first_seq", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_first_ts": { + "path_match": "netflow.ntop_rtp_first_ts", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_last_seq": { + "path_match": "netflow.ntop_rtp_last_seq", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_last_ts": { + "path_match": "netflow.ntop_rtp_last_ts", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_in_jitter": { + "path_match": "netflow.ntop_rtp_in_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_out_jitter": { + "path_match": "netflow.ntop_rtp_out_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_in_packets_lost": { + "path_match": "netflow.ntop_rtp_in_packets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_out_packets_lost": { + "path_match": "netflow.ntop_rtp_out_packets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_out_payload_type": { + "path_match": "netflow.ntop_rtp_out_payload_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_in_max_delta": { + "path_match": "netflow.ntop_rtp_in_max_delta", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_out_max_delta": { + "path_match": "netflow.ntop_rtp_out_max_delta", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_in_payload_type": { + "path_match": "netflow.ntop_rtp_in_payload_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_proc_id": { + "path_match": "netflow.ntop_src_proc_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_proc": { + "path_match": "netflow.ntop_src_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_http_url": { + "path_match": "netflow.ntop_http_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_http_ret_code": { + "path_match": "netflow.ntop_http_ret_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_http_referrer": { + "path_match": "netflow.ntop_http_referrer", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_http_user_agent": { + "path_match": "netflow.ntop_http_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_http_mime": { + "path_match": "netflow.ntop_http_mime", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_smtp_mail_from": { + "path_match": "netflow.ntop_smtp_mail_from", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_smtp_rcpt_to": { + "path_match": "netflow.ntop_smtp_rcpt_to", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_http_host": { + "path_match": "netflow.ntop_http_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ssl_server": { + "path_match": "netflow.ntop_ssl_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_bittorrent_hash": { + "path_match": "netflow.ntop_bittorrent_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_mysql_server_ver": { + "path_match": "netflow.ntop_mysql_server_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_mysql_user": { + "path_match": "netflow.ntop_mysql_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_mysql_db": { + "path_match": "netflow.ntop_mysql_db", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_mysql_query": { + "path_match": "netflow.ntop_mysql_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_mysql_resp": { + "path_match": "netflow.ntop_mysql_resp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_oracle_user": { + "path_match": "netflow.ntop_oracle_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_oracle_query": { + "path_match": "netflow.ntop_oracle_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_oracle_resp_code": { + "path_match": "netflow.ntop_oracle_resp_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_oracle_resp_string": { + "path_match": "netflow.ntop_oracle_resp_string", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_oracle_query_duration": { + "path_match": "netflow.ntop_oracle_query_duration", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dns_query": { + "path_match": "netflow.ntop_dns_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dns_query_id": { + "path_match": "netflow.ntop_dns_query_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dns_query_type": { + "path_match": "netflow.ntop_dns_query_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dns_ret_code": { + "path_match": "netflow.ntop_dns_ret_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dns_answers": { + "path_match": "netflow.ntop_dns_answers", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_pop_user": { + "path_match": "netflow.ntop_pop_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv1_req_msg_type": { + "path_match": "netflow.ntop_gtpv1_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_resp_msg_type": { + "path_match": "netflow.ntop_gtpv1_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_c2s_teid_data": { + "path_match": "netflow.ntop_gtpv1_c2s_teid_data", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_c2s_teid_ctrl": { + "path_match": "netflow.ntop_gtpv1_c2s_teid_ctrl", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_s2c_teid_data": { + "path_match": "netflow.ntop_gtpv1_s2c_teid_data", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_s2c_teid_ctrl": { + "path_match": "netflow.ntop_gtpv1_s2c_teid_ctrl", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_end_user_ip": { + "path_match": "netflow.ntop_gtpv1_end_user_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv1_end_user_imsi": { + "path_match": "netflow.ntop_gtpv1_end_user_imsi", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv1_end_user_msisdn": { + "path_match": "netflow.ntop_gtpv1_end_user_msisdn", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv1_end_user_imei": { + "path_match": "netflow.ntop_gtpv1_end_user_imei", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv1_apn": { + "path_match": "netflow.ntop_gtpv1_apn", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv1_rai_mcc": { + "path_match": "netflow.ntop_gtpv1_rai_mcc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_rai_mnc": { + "path_match": "netflow.ntop_gtpv1_rai_mnc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_uli_cell_lac": { + "path_match": "netflow.ntop_gtpv1_uli_cell_lac", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_uli_cell_ci": { + "path_match": "netflow.ntop_gtpv1_uli_cell_ci", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_uli_sac": { + "path_match": "netflow.ntop_gtpv1_uli_sac", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_rai_type": { + "path_match": "netflow.ntop_gtpv1_rai_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_radius_req_msg_type": { + "path_match": "netflow.ntop_radius_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_radius_resp_msg_type": { + "path_match": "netflow.ntop_radius_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_radius_user": { + "path_match": "netflow.ntop_radius_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_radius_calling_station_id": { + "path_match": "netflow.ntop_radius_calling_station_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_radius_called_station_id": { + "path_match": "netflow.ntop_radius_called_station_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_radius_nas_ip": { + "path_match": "netflow.ntop_radius_nas_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_radius_nas_id": { + "path_match": "netflow.ntop_radius_nas_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_radius_user_imsi": { + "path_match": "netflow.ntop_radius_user_imsi", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_radius_user_imei": { + "path_match": "netflow.ntop_radius_user_imei", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_radius_framed_ip": { + "path_match": "netflow.ntop_radius_framed_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_radius_acct_sess_id": { + "path_match": "netflow.ntop_radius_acct_sess_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_radius_acct_status_type": { + "path_match": "netflow.ntop_radius_acct_status_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_radius_acct_in_octets": { + "path_match": "netflow.ntop_radius_acct_in_octets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_radius_acct_out_octets": { + "path_match": "netflow.ntop_radius_acct_out_octets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_radius_acct_in_packets": { + "path_match": "netflow.ntop_radius_acct_in_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_radius_acct_out_packets": { + "path_match": "netflow.ntop_radius_acct_out_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_imap_login": { + "path_match": "netflow.ntop_imap_login", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv2_req_msg_type": { + "path_match": "netflow.ntop_gtpv2_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_resp_msg_type": { + "path_match": "netflow.ntop_gtpv2_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_c2s_s1u_gtpu_teid": { + "path_match": "netflow.ntop_gtpv2_c2s_s1u_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_c2s_s1u_gtpu_ip": { + "path_match": "netflow.ntop_gtpv2_c2s_s1u_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv2_s2c_s1u_gtpu_teid": { + "path_match": "netflow.ntop_gtpv2_s2c_s1u_gtpu_teid", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv2_s2c_s1u_gtpu_ip": { + "path_match": "netflow.ntop_gtpv2_s2c_s1u_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv2_end_user_imsi": { + "path_match": "netflow.ntop_gtpv2_end_user_imsi", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv2_and_user_msisdn": { + "path_match": "netflow.ntop_gtpv2_and_user_msisdn", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv2_apn": { + "path_match": "netflow.ntop_gtpv2_apn", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv2_uli_mcc": { + "path_match": "netflow.ntop_gtpv2_uli_mcc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_uli_mnc": { + "path_match": "netflow.ntop_gtpv2_uli_mnc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_uli_cell_tac": { + "path_match": "netflow.ntop_gtpv2_uli_cell_tac", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_uli_cell_id": { + "path_match": "netflow.ntop_gtpv2_uli_cell_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_rat_type": { + "path_match": "netflow.ntop_gtpv2_rat_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_pdn_ip": { + "path_match": "netflow.ntop_gtpv2_pdn_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv2_end_user_imei": { + "path_match": "netflow.ntop_gtpv2_end_user_imei", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_src_as_path_1": { + "path_match": "netflow.ntop_src_as_path_1", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_2": { + "path_match": "netflow.ntop_src_as_path_2", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_3": { + "path_match": "netflow.ntop_src_as_path_3", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_4": { + "path_match": "netflow.ntop_src_as_path_4", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_5": { + "path_match": "netflow.ntop_src_as_path_5", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_6": { + "path_match": "netflow.ntop_src_as_path_6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_7": { + "path_match": "netflow.ntop_src_as_path_7", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_8": { + "path_match": "netflow.ntop_src_as_path_8", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_9": { + "path_match": "netflow.ntop_src_as_path_9", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_10": { + "path_match": "netflow.ntop_src_as_path_10", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_1": { + "path_match": "netflow.ntop_dst_as_path_1", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_2": { + "path_match": "netflow.ntop_dst_as_path_2", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_3": { + "path_match": "netflow.ntop_dst_as_path_3", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_4": { + "path_match": "netflow.ntop_dst_as_path_4", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_5": { + "path_match": "netflow.ntop_dst_as_path_5", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_6": { + "path_match": "netflow.ntop_dst_as_path_6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_7": { + "path_match": "netflow.ntop_dst_as_path_7", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_8": { + "path_match": "netflow.ntop_dst_as_path_8", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_9": { + "path_match": "netflow.ntop_dst_as_path_9", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_10": { + "path_match": "netflow.ntop_dst_as_path_10", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_mysql_appl_latency_usec": { + "path_match": "netflow.ntop_mysql_appl_latency_usec", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv0_req_msg_type": { + "path_match": "netflow.ntop_gtpv0_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv0_resp_msg_type": { + "path_match": "netflow.ntop_gtpv0_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv0_tid": { + "path_match": "netflow.ntop_gtpv0_tid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv0_end_user_ip": { + "path_match": "netflow.ntop_gtpv0_end_user_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv0_end_user_msisdn": { + "path_match": "netflow.ntop_gtpv0_end_user_msisdn", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv0_apn": { + "path_match": "netflow.ntop_gtpv0_apn", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv0_rai_mcc": { + "path_match": "netflow.ntop_gtpv0_rai_mcc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv0_rai_mnc": { + "path_match": "netflow.ntop_gtpv0_rai_mnc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv0_rai_cell_lac": { + "path_match": "netflow.ntop_gtpv0_rai_cell_lac", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv0_rai_cell_rac": { + "path_match": "netflow.ntop_gtpv0_rai_cell_rac", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv0_resp_cause": { + "path_match": "netflow.ntop_gtpv0_resp_cause", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_resp_cause": { + "path_match": "netflow.ntop_gtpv1_resp_cause", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_resp_cause": { + "path_match": "netflow.ntop_gtpv2_resp_cause", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_5_32": { + "path_match": "netflow.ntop_packets_ttl_5_32", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_32_64": { + "path_match": "netflow.ntop_packets_ttl_32_64", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_64_96": { + "path_match": "netflow.ntop_packets_ttl_64_96", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_96_128": { + "path_match": "netflow.ntop_packets_ttl_96_128", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_128_160": { + "path_match": "netflow.ntop_packets_ttl_128_160", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_160_192": { + "path_match": "netflow.ntop_packets_ttl_160_192", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_192_224": { + "path_match": "netflow.ntop_packets_ttl_192_224", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_224_225": { + "path_match": "netflow.ntop_packets_ttl_224_225", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_rai_lac": { + "path_match": "netflow.ntop_gtpv1_rai_lac", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_rai_rac": { + "path_match": "netflow.ntop_gtpv1_rai_rac", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_uli_mcc": { + "path_match": "netflow.ntop_gtpv1_uli_mcc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_uli_mnc": { + "path_match": "netflow.ntop_gtpv1_uli_mnc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_2_5": { + "path_match": "netflow.ntop_packets_ttl_2_5", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_eq_1": { + "path_match": "netflow.ntop_packets_ttl_eq_1", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_sip_call_id": { + "path_match": "netflow.ntop_rtp_sip_call_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_in_src_osi_sap": { + "path_match": "netflow.ntop_in_src_osi_sap", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_out_dst_osi_sap": { + "path_match": "netflow.ntop_out_dst_osi_sap", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_whois_das_domain": { + "path_match": "netflow.ntop_whois_das_domain", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dns_ttl_answer": { + "path_match": "netflow.ntop_dns_ttl_answer", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dhcp_client_mac": { + "path_match": "netflow.ntop_dhcp_client_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dhcp_client_ip": { + "path_match": "netflow.ntop_dhcp_client_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_dhcp_client": { + "path_match": "netflow.ntop_dhcp_client", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ftp_login": { + "path_match": "netflow.ntop_ftp_login", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ftp_password": { + "path_match": "netflow.ntop_ftp_password", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ftp_command": { + "path_match": "netflow.ntop_ftp_command", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ftp_command_ret_code": { + "path_match": "netflow.ntop_ftp_command_ret_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_http_method": { + "path_match": "netflow.ntop_http_method", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_http_site": { + "path_match": "netflow.ntop_http_site", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_sip_c_ip": { + "path_match": "netflow.ntop_sip_c_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_sip_call_state": { + "path_match": "netflow.ntop_sip_call_state", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_rtp_in_mos": { + "path_match": "netflow.ntop_rtp_in_mos", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_in_r_factor": { + "path_match": "netflow.ntop_rtp_in_r_factor", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_proc_user": { + "path_match": "netflow.ntop_src_proc_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_src_father_proc_pid": { + "path_match": "netflow.ntop_src_father_proc_pid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_father_proc": { + "path_match": "netflow.ntop_src_father_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dst_proc_pid": { + "path_match": "netflow.ntop_dst_proc_pid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_proc": { + "path_match": "netflow.ntop_dst_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dst_proc_user": { + "path_match": "netflow.ntop_dst_proc_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dst_father_proc_pid": { + "path_match": "netflow.ntop_dst_father_proc_pid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_father_proc": { + "path_match": "netflow.ntop_dst_father_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_rtp_rtt": { + "path_match": "netflow.ntop_rtp_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_in_transit": { + "path_match": "netflow.ntop_rtp_in_transit", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_out_transit": { + "path_match": "netflow.ntop_rtp_out_transit", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_proc_actual_memory": { + "path_match": "netflow.ntop_src_proc_actual_memory", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_proc_peak_memory": { + "path_match": "netflow.ntop_src_proc_peak_memory", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_proc_avg_cpu_load": { + "path_match": "netflow.ntop_src_proc_avg_cpu_load", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_proc_page_faults": { + "path_match": "netflow.ntop_src_proc_page_faults", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_proc_actual_memory": { + "path_match": "netflow.ntop_dst_proc_actual_memory", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_proc_peak_memory": { + "path_match": "netflow.ntop_dst_proc_peak_memory", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_proc_avg_cpu_load": { + "path_match": "netflow.ntop_dst_proc_avg_cpu_load", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_proc_page_faults": { + "path_match": "netflow.ntop_dst_proc_page_faults", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_duration_in": { + "path_match": "netflow.ntop_duration_in", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_duration_out": { + "path_match": "netflow.ntop_duration_out", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_proc_pctg_iowait": { + "path_match": "netflow.ntop_src_proc_pctg_iowait", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_proc_pctg_iowait": { + "path_match": "netflow.ntop_dst_proc_pctg_iowait", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_dtmf_tones": { + "path_match": "netflow.ntop_rtp_dtmf_tones", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_untunneled_ipv6_src_addr": { + "path_match": "netflow.ntop_untunneled_ipv6_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_untunneled_ipv6_dst_addr": { + "path_match": "netflow.ntop_untunneled_ipv6_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_dns_resp": { + "path_match": "netflow.ntop_dns_resp", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_diameter_req_msg_type": { + "path_match": "netflow.ntop_diameter_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_diameter_resp_msg_type": { + "path_match": "netflow.ntop_diameter_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_diameter_req_origin_host": { + "path_match": "netflow.ntop_diameter_req_origin_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_diameter_resp_origin_host": { + "path_match": "netflow.ntop_diameter_resp_origin_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_diameter_req_user": { + "path_match": "netflow.ntop_diameter_req_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_diameter_resp_result_code": { + "path_match": "netflow.ntop_diameter_resp_result_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_diameter_exp_res_vendor_id": { + "path_match": "netflow.ntop_diameter_exp_res_vendor_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_diameter_exp_res_result_code": { + "path_match": "netflow.ntop_diameter_exp_res_result_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_s1ap_enb_ue_s1ap_id": { + "path_match": "netflow.ntop_s1ap_enb_ue_s1ap_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_s1ap_mme_ue_s1ap_id": { + "path_match": "netflow.ntop_s1ap_mme_ue_s1ap_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_s1ap_msg_emm_type_mme_to_enb": { + "path_match": "netflow.ntop_s1ap_msg_emm_type_mme_to_enb", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_s1ap_msg_esm_type_mme_to_enb": { + "path_match": "netflow.ntop_s1ap_msg_esm_type_mme_to_enb", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_s1ap_msg_emm_type_enb_to_mme": { + "path_match": "netflow.ntop_s1ap_msg_emm_type_enb_to_mme", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_s1ap_msg_esm_type_enb_to_mme": { + "path_match": "netflow.ntop_s1ap_msg_esm_type_enb_to_mme", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_s1ap_cause_enb_to_mme": { + "path_match": "netflow.ntop_s1ap_cause_enb_to_mme", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_s1ap_detailed_cause_enb_to_mme": { + "path_match": "netflow.ntop_s1ap_detailed_cause_enb_to_mme", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tcp_win_min_in": { + "path_match": "netflow.ntop_tcp_win_min_in", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tcp_win_max_in": { + "path_match": "netflow.ntop_tcp_win_max_in", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tcp_win_mss_in": { + "path_match": "netflow.ntop_tcp_win_mss_in", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tcp_win_scale_in": { + "path_match": "netflow.ntop_tcp_win_scale_in", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tcp_win_min_out": { + "path_match": "netflow.ntop_tcp_win_min_out", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tcp_win_max_out": { + "path_match": "netflow.ntop_tcp_win_max_out", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tcp_win_mss_out": { + "path_match": "netflow.ntop_tcp_win_mss_out", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tcp_win_scale_out": { + "path_match": "netflow.ntop_tcp_win_scale_out", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dhcp_remote_id": { + "path_match": "netflow.ntop_dhcp_remote_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dhcp_subscriber_id": { + "path_match": "netflow.ntop_dhcp_subscriber_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_src_proc_uid": { + "path_match": "netflow.ntop_src_proc_uid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_proc_uid": { + "path_match": "netflow.ntop_dst_proc_uid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_application": { + "path_match": "netflow.ntop_application", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_user": { + "path_match": "netflow.ntop_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dhcp_message_type": { + "path_match": "netflow.ntop_dhcp_message_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_rtp_in_packets_drop": { + "path_match": "netflow.ntop_rtp_in_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_out_packets_drop": { + "path_match": "netflow.ntop_rtp_out_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_out_mos": { + "path_match": "netflow.ntop_rtp_out_mos", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_out_r_factor": { + "path_match": "netflow.ntop_rtp_out_r_factor", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_mos": { + "path_match": "netflow.ntop_rtp_mos", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gptv2_s5_s8_gtpc_teid": { + "path_match": "netflow.ntop_gptv2_s5_s8_gtpc_teid", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_rtp_r_factor": { + "path_match": "netflow.ntop_rtp_r_factor", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_ssrc": { + "path_match": "netflow.ntop_rtp_ssrc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_payload_hash": { + "path_match": "netflow.ntop_payload_hash", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_c2s_s5_s8_gtpu_teid": { + "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_s2c_s5_s8_gtpu_teid": { + "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_c2s_s5_s8_gtpu_ip": { + "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv2_s2c_s5_s8_gtpu_ip": { + "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_src_as_map": { + "path_match": "netflow.ntop_src_as_map", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dst_as_map": { + "path_match": "netflow.ntop_dst_as_map", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_diameter_hop_by_hop_id": { + "path_match": "netflow.ntop_diameter_hop_by_hop_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_upstream_sess_id": { + "path_match": "netflow.ntop_upstream_sess_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_downstream_sess_id": { + "path_match": "netflow.ntop_downstream_sess_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_long": { + "path_match": "netflow.ntop_src_long", + "mapping": { + "type": "float" + } + } + }, + { + "netflow.ntop_src_lat": { + "path_match": "netflow.ntop_src_lat", + "mapping": { + "type": "float" + } + } + }, + { + "netflow.ntop_dst_long": { + "path_match": "netflow.ntop_dst_long", + "mapping": { + "type": "float" + } + } + }, + { + "netflow.ntop_dst_lat": { + "path_match": "netflow.ntop_dst_lat", + "mapping": { + "type": "float" + } + } + }, + { + "netflow.ntop_diameter_clr_cancel_type": { + "path_match": "netflow.ntop_diameter_clr_cancel_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_diameter_clr_flags": { + "path_match": "netflow.ntop_diameter_clr_flags", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_c2s_s5_s8_gtpc_ip": { + "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_gtpc_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv2_s2c_s5_s8_gtpc_ip": { + "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_gtpc_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid": { + "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid": { + "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip": { + "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip": { + "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_http_x_forwarded_for": { + "path_match": "netflow.ntop_http_x_forwarded_for", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_http_via": { + "path_match": "netflow.ntop_http_via", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ssdp_host": { + "path_match": "netflow.ntop_ssdp_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ssdp_usn": { + "path_match": "netflow.ntop_ssdp_usn", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_netbios_query": { + "path_match": "netflow.ntop_netbios_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_netbios_query_type": { + "path_match": "netflow.ntop_netbios_query_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_netbios_resp": { + "path_match": "netflow.ntop_netbios_resp", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_netbios_query_os": { + "path_match": "netflow.ntop_netbios_query_os", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ssdp_server": { + "path_match": "netflow.ntop_ssdp_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ssdp_type": { + "path_match": "netflow.ntop_ssdp_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ssdp_method": { + "path_match": "netflow.ntop_ssdp_method", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_nprobe_ipv4_addr": { + "path_match": "netflow.ntop_nprobe_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, - { - "netflow.pan_app": { - "path_match": "netflow.pan_app", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.pan_user": { - "path_match": "netflow.pan_user", - "mapping": { - "type": "keyword" - } - } - }, + { + "netflow.pan_app": { + "path_match": "netflow.pan_app", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.pan_user": { + "path_match": "netflow.pan_user", + "mapping": { + "type": "keyword" + } + } + }, - { - "netflow.riverbed_passthru_reason": { - "path_match": "netflow.riverbed_passthru_reason", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.riverbed_wan_visibility": { - "path_match": "netflow.riverbed_wan_visibility", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.riverbed_cfe_inpath_addr": { - "path_match": "netflow.riverbed_cfe_inpath_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.riverbed_sfe_inpath_addr": { - "path_match": "netflow.riverbed_sfe_inpath_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.riverbed_cfe_tcp_port": { - "path_match": "netflow.riverbed_cfe_tcp_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.riverbed_cfe_tcp_port_name": { - "path_match": "netflow.riverbed_cfe_tcp_port_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.riverbed_sfe_tcp_port": { - "path_match": "netflow.riverbed_sfe_tcp_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.riverbed_sfe_tcp_port_name": { - "path_match": "netflow.riverbed_sfe_tcp_port_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.riverbed_outer_inpath_addr": { - "path_match": "netflow.riverbed_outer_inpath_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.riverbed_outer_tcp_port": { - "path_match": "netflow.riverbed_outer_tcp_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.riverbed_outer_tcp_port_name": { - "path_match": "netflow.riverbed_outer_tcp_port_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.riverbed_retrans_packets": { - "path_match": "netflow.riverbed_retrans_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.riverbed_retrans_bytes": { - "path_match": "netflow.riverbed_retrans_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.riverbed_tcp_conn_rtt": { - "path_match": "netflow.riverbed_tcp_conn_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.riverbed_fe_type": { - "path_match": "netflow.riverbed_fe_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.riverbed_unk_51130": { - "path_match": "netflow.riverbed_unk_51130", - "mapping": { - "type": "long" - } - } - }, + { + "netflow.riverbed_passthru_reason": { + "path_match": "netflow.riverbed_passthru_reason", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.riverbed_wan_visibility": { + "path_match": "netflow.riverbed_wan_visibility", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.riverbed_cfe_inpath_addr": { + "path_match": "netflow.riverbed_cfe_inpath_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.riverbed_sfe_inpath_addr": { + "path_match": "netflow.riverbed_sfe_inpath_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.riverbed_cfe_tcp_port": { + "path_match": "netflow.riverbed_cfe_tcp_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.riverbed_cfe_tcp_port_name": { + "path_match": "netflow.riverbed_cfe_tcp_port_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.riverbed_sfe_tcp_port": { + "path_match": "netflow.riverbed_sfe_tcp_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.riverbed_sfe_tcp_port_name": { + "path_match": "netflow.riverbed_sfe_tcp_port_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.riverbed_outer_inpath_addr": { + "path_match": "netflow.riverbed_outer_inpath_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.riverbed_outer_tcp_port": { + "path_match": "netflow.riverbed_outer_tcp_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.riverbed_outer_tcp_port_name": { + "path_match": "netflow.riverbed_outer_tcp_port_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.riverbed_retrans_packets": { + "path_match": "netflow.riverbed_retrans_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.riverbed_retrans_bytes": { + "path_match": "netflow.riverbed_retrans_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.riverbed_tcp_conn_rtt": { + "path_match": "netflow.riverbed_tcp_conn_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.riverbed_fe_type": { + "path_match": "netflow.riverbed_fe_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.riverbed_unk_51130": { + "path_match": "netflow.riverbed_unk_51130", + "mapping": { + "type": "long" + } + } + }, - { - "netflow.streamcore_wan_rtt": { - "path_match": "netflow.streamcore_wan_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_net_app_resp_time": { - "path_match": "netflow.streamcore_net_app_resp_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_total_app_resp_time": { - "path_match": "netflow.streamcore_total_app_resp_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_tcp_retrans_rate": { - "path_match": "netflow.streamcore_tcp_retrans_rate", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_call_direction": { - "path_match": "netflow.streamcore_call_direction", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_hostname": { - "path_match": "netflow.streamcore_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.streamcore_url": { - "path_match": "netflow.streamcore_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.streamcore_ssl_cn": { - "path_match": "netflow.streamcore_ssl_cn", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.streamcore_ssl_org": { - "path_match": "netflow.streamcore_ssl_org", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.streamcore_mos_lq": { - "path_match": "netflow.streamcore_mos_lq", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_net_delay": { - "path_match": "netflow.streamcore_net_delay", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_net_loss": { - "path_match": "netflow.streamcore_net_loss", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_net_jitter": { - "path_match": "netflow.streamcore_net_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_net_discard": { - "path_match": "netflow.streamcore_net_discard", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_rtp_clockrate_in": { - "path_match": "netflow.streamcore_rtp_clockrate_in", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_rtp_clockrate_out": { - "path_match": "netflow.streamcore_rtp_clockrate_out", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_codec_in": { - "path_match": "netflow.streamcore_codec_in", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_codec_out": { - "path_match": "netflow.streamcore_codec_out", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_1": { - "path_match": "netflow.streamcore_id_rule_1", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_2": { - "path_match": "netflow.streamcore_id_rule_2", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_3": { - "path_match": "netflow.streamcore_id_rule_3", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_4": { - "path_match": "netflow.streamcore_id_rule_4", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_5": { - "path_match": "netflow.streamcore_id_rule_5", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_6": { - "path_match": "netflow.streamcore_id_rule_6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_7": { - "path_match": "netflow.streamcore_id_rule_7", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_8": { - "path_match": "netflow.streamcore_id_rule_8", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_9": { - "path_match": "netflow.streamcore_id_rule_9", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_10": { - "path_match": "netflow.streamcore_id_rule_10", - "mapping": { - "type": "long" - } - } - }, - + { + "netflow.streamcore_wan_rtt": { + "path_match": "netflow.streamcore_wan_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_net_app_resp_time": { + "path_match": "netflow.streamcore_net_app_resp_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_total_app_resp_time": { + "path_match": "netflow.streamcore_total_app_resp_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_tcp_retrans_rate": { + "path_match": "netflow.streamcore_tcp_retrans_rate", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_call_direction": { + "path_match": "netflow.streamcore_call_direction", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_hostname": { + "path_match": "netflow.streamcore_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.streamcore_url": { + "path_match": "netflow.streamcore_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.streamcore_ssl_cn": { + "path_match": "netflow.streamcore_ssl_cn", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.streamcore_ssl_org": { + "path_match": "netflow.streamcore_ssl_org", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.streamcore_mos_lq": { + "path_match": "netflow.streamcore_mos_lq", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_net_delay": { + "path_match": "netflow.streamcore_net_delay", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_net_loss": { + "path_match": "netflow.streamcore_net_loss", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_net_jitter": { + "path_match": "netflow.streamcore_net_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_net_discard": { + "path_match": "netflow.streamcore_net_discard", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_rtp_clockrate_in": { + "path_match": "netflow.streamcore_rtp_clockrate_in", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_rtp_clockrate_out": { + "path_match": "netflow.streamcore_rtp_clockrate_out", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_codec_in": { + "path_match": "netflow.streamcore_codec_in", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_codec_out": { + "path_match": "netflow.streamcore_codec_out", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_1": { + "path_match": "netflow.streamcore_id_rule_1", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_2": { + "path_match": "netflow.streamcore_id_rule_2", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_3": { + "path_match": "netflow.streamcore_id_rule_3", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_4": { + "path_match": "netflow.streamcore_id_rule_4", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_5": { + "path_match": "netflow.streamcore_id_rule_5", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_6": { + "path_match": "netflow.streamcore_id_rule_6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_7": { + "path_match": "netflow.streamcore_id_rule_7", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_8": { + "path_match": "netflow.streamcore_id_rule_8", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_9": { + "path_match": "netflow.streamcore_id_rule_9", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_10": { + "path_match": "netflow.streamcore_id_rule_10", + "mapping": { + "type": "long" + } + } + }, + - { - "sflow.agent_ip": { - "path_match": "sflow.agent_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "sflow.drops": { - "path_match": "sflow.drops", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.dst_ip": { - "path_match": "sflow.dst_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "sflow.dst_mac": { - "path_match": "sflow.dst_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.dst_mask_len": { - "path_match": "sflow.dst_mask_len", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.dst_port": { - "path_match": "sflow.dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.dst_priority": { - "path_match": "sflow.dst_priority", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.dst_vlan": { - "path_match": "sflow.dst_vlan", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.eth_dst": { - "path_match": "sflow.eth_dst", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.eth_src": { - "path_match": "sflow.eth_src", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.eth_type": { - "path_match": "sflow.eth_type", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.flow_sequence_number": { - "path_match": "sflow.flow_sequence_number", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.frame_length": { - "path_match": "sflow.frame_length", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.frame_length_times_sampling_rate": { - "path_match": "sflow.frame_length_times_sampling_rate", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.header_size": { - "path_match": "sflow.header_size", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.input_interface": { - "path_match": "sflow.input_interface", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.input_interface_format": { - "path_match": "sflow.input_interface_format", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.input_interface_value": { - "path_match": "sflow.input_interface_value", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_address_next_hop_router": { - "path_match": "sflow.ip_address_next_hop_router", - "mapping": { - "type": "ip" - } - } - }, - { - "sflow.ip_checksum": { - "path_match": "sflow.ip_checksum", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_dscp": { - "path_match": "sflow.ip_dscp", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_ecn": { - "path_match": "sflow.ip_ecn", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_flags": { - "path_match": "sflow.ip_flags", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_fragment_offset": { - "path_match": "sflow.ip_fragment_offset", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_header_length": { - "path_match": "sflow.ip_header_length", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_identification": { - "path_match": "sflow.ip_identification", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_next_header": { - "path_match": "sflow.ip_next_header", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_options": { - "path_match": "sflow.ip_options", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_packet_length": { - "path_match": "sflow.ip_packet_length", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_priority": { - "path_match": "sflow.ip_priority", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_protocol": { - "path_match": "sflow.ip_protocol", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_total_length": { - "path_match": "sflow.ip_total_length", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_ttl": { - "path_match": "sflow.ip_ttl", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_type": { - "path_match": "sflow.ip_type", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_version": { - "path_match": "sflow.ip_version", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.output_interface": { - "path_match": "sflow.output_interface", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.output_interface_format": { - "path_match": "sflow.output_interface_format", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.output_interface_value": { - "path_match": "sflow.output_interface_value", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.packet_length": { - "path_match": "sflow.packet_length", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.padded": { - "path_match": "sflow.padded", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.protocol": { - "path_match": "sflow.protocol", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.protocol_name": { - "path_match": "sflow.protocol_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.sample_length": { - "path_match": "sflow.sample_length", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.sample_pool": { - "path_match": "sflow.sample_pool", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.sample_seq_number": { - "path_match": "sflow.sample_seq_number", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.sampling_rate": { - "path_match": "sflow.sampling_rate", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.sequence_number": { - "path_match": "sflow.sequence_number", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.sflow_type": { - "path_match": "sflow.sflow_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.sflow_version": { - "path_match": "sflow.sflow_version", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.size_header": { - "path_match": "sflow.size_header", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.source_id_index": { - "path_match": "sflow.source_id_index", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.source_id_index_name": { - "path_match": "sflow.source_id_index_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.source_id_type": { - "path_match": "sflow.source_id_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.src_ip": { - "path_match": "sflow.src_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "sflow.src_mac": { - "path_match": "sflow.src_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.src_mask_len": { - "path_match": "sflow.src_mask_len", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.src_port": { - "path_match": "sflow.src_port", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.src_priority": { - "path_match": "sflow.src_priority", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.src_vlan": { - "path_match": "sflow.src_vlan", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.stripped": { - "path_match": "sflow.stripped", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.sub_agent_id": { - "path_match": "sflow.sub_agent_id", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_ack_number": { - "path_match": "sflow.tcp_ack_number", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_checksum": { - "path_match": "sflow.tcp_checksum", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_flags": { - "path_match": "sflow.tcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_header_length": { - "path_match": "sflow.tcp_header_length", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_is_ack": { - "path_match": "sflow.tcp_is_ack", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_is_cwr": { - "path_match": "sflow.tcp_is_cwr", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_is_ecn_echo": { - "path_match": "sflow.tcp_is_ecn_echo", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_is_fin": { - "path_match": "sflow.tcp_is_fin", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_is_nonce": { - "path_match": "sflow.tcp_is_nonce", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_is_push": { - "path_match": "sflow.tcp_is_push", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_is_reset": { - "path_match": "sflow.tcp_is_reset", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_is_syn": { - "path_match": "sflow.tcp_is_syn", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_is_urgent": { - "path_match": "sflow.tcp_is_urgent", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_options": { - "path_match": "sflow.tcp_options", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_reserved": { - "path_match": "sflow.tcp_reserved", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_seq_number": { - "path_match": "sflow.tcp_seq_number", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_urgent_pointer": { - "path_match": "sflow.tcp_urgent_pointer", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_window_size": { - "path_match": "sflow.tcp_window_size", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.udp_checksum": { - "path_match": "sflow.udp_checksum", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.udp_length": { - "path_match": "sflow.udp_length", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.uptime_in_ms": { - "path_match": "sflow.uptime_in_ms", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.vlan_cfi": { - "path_match": "sflow.vlan_cfi", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.vlan_id": { - "path_match": "sflow.vlan_id", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.vlan_priority": { - "path_match": "sflow.vlan_priority", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.vlan_type": { - "path_match": "sflow.vlan_type", - "mapping": { - "type": "long" - } - } - }, + { + "sflow.agent_ip": { + "path_match": "sflow.agent_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "sflow.drops": { + "path_match": "sflow.drops", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.dst_ip": { + "path_match": "sflow.dst_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "sflow.dst_mac": { + "path_match": "sflow.dst_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.dst_mask_len": { + "path_match": "sflow.dst_mask_len", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.dst_port": { + "path_match": "sflow.dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.dst_priority": { + "path_match": "sflow.dst_priority", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.dst_vlan": { + "path_match": "sflow.dst_vlan", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.eth_dst": { + "path_match": "sflow.eth_dst", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.eth_src": { + "path_match": "sflow.eth_src", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.eth_type": { + "path_match": "sflow.eth_type", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.flow_sequence_number": { + "path_match": "sflow.flow_sequence_number", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.frame_length": { + "path_match": "sflow.frame_length", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.frame_length_times_sampling_rate": { + "path_match": "sflow.frame_length_times_sampling_rate", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.header_size": { + "path_match": "sflow.header_size", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.input_interface": { + "path_match": "sflow.input_interface", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.input_interface_format": { + "path_match": "sflow.input_interface_format", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.input_interface_value": { + "path_match": "sflow.input_interface_value", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_address_next_hop_router": { + "path_match": "sflow.ip_address_next_hop_router", + "mapping": { + "type": "ip" + } + } + }, + { + "sflow.ip_checksum": { + "path_match": "sflow.ip_checksum", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_dscp": { + "path_match": "sflow.ip_dscp", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_ecn": { + "path_match": "sflow.ip_ecn", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_flags": { + "path_match": "sflow.ip_flags", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_fragment_offset": { + "path_match": "sflow.ip_fragment_offset", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_header_length": { + "path_match": "sflow.ip_header_length", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_identification": { + "path_match": "sflow.ip_identification", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_next_header": { + "path_match": "sflow.ip_next_header", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_options": { + "path_match": "sflow.ip_options", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_packet_length": { + "path_match": "sflow.ip_packet_length", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_priority": { + "path_match": "sflow.ip_priority", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_protocol": { + "path_match": "sflow.ip_protocol", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_total_length": { + "path_match": "sflow.ip_total_length", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_ttl": { + "path_match": "sflow.ip_ttl", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_type": { + "path_match": "sflow.ip_type", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_version": { + "path_match": "sflow.ip_version", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.output_interface": { + "path_match": "sflow.output_interface", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.output_interface_format": { + "path_match": "sflow.output_interface_format", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.output_interface_value": { + "path_match": "sflow.output_interface_value", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.packet_length": { + "path_match": "sflow.packet_length", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.padded": { + "path_match": "sflow.padded", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.protocol": { + "path_match": "sflow.protocol", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.protocol_name": { + "path_match": "sflow.protocol_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.sample_length": { + "path_match": "sflow.sample_length", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.sample_pool": { + "path_match": "sflow.sample_pool", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.sample_seq_number": { + "path_match": "sflow.sample_seq_number", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.sampling_rate": { + "path_match": "sflow.sampling_rate", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.sequence_number": { + "path_match": "sflow.sequence_number", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.sflow_type": { + "path_match": "sflow.sflow_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.sflow_version": { + "path_match": "sflow.sflow_version", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.size_header": { + "path_match": "sflow.size_header", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.source_id_index": { + "path_match": "sflow.source_id_index", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.source_id_index_name": { + "path_match": "sflow.source_id_index_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.source_id_type": { + "path_match": "sflow.source_id_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.src_ip": { + "path_match": "sflow.src_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "sflow.src_mac": { + "path_match": "sflow.src_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.src_mask_len": { + "path_match": "sflow.src_mask_len", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.src_port": { + "path_match": "sflow.src_port", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.src_priority": { + "path_match": "sflow.src_priority", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.src_vlan": { + "path_match": "sflow.src_vlan", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.stripped": { + "path_match": "sflow.stripped", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.sub_agent_id": { + "path_match": "sflow.sub_agent_id", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_ack_number": { + "path_match": "sflow.tcp_ack_number", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_checksum": { + "path_match": "sflow.tcp_checksum", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_flags": { + "path_match": "sflow.tcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_header_length": { + "path_match": "sflow.tcp_header_length", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_is_ack": { + "path_match": "sflow.tcp_is_ack", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_is_cwr": { + "path_match": "sflow.tcp_is_cwr", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_is_ecn_echo": { + "path_match": "sflow.tcp_is_ecn_echo", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_is_fin": { + "path_match": "sflow.tcp_is_fin", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_is_nonce": { + "path_match": "sflow.tcp_is_nonce", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_is_push": { + "path_match": "sflow.tcp_is_push", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_is_reset": { + "path_match": "sflow.tcp_is_reset", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_is_syn": { + "path_match": "sflow.tcp_is_syn", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_is_urgent": { + "path_match": "sflow.tcp_is_urgent", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_options": { + "path_match": "sflow.tcp_options", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_reserved": { + "path_match": "sflow.tcp_reserved", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_seq_number": { + "path_match": "sflow.tcp_seq_number", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_urgent_pointer": { + "path_match": "sflow.tcp_urgent_pointer", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_window_size": { + "path_match": "sflow.tcp_window_size", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.udp_checksum": { + "path_match": "sflow.udp_checksum", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.udp_length": { + "path_match": "sflow.udp_length", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.uptime_in_ms": { + "path_match": "sflow.uptime_in_ms", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.vlan_cfi": { + "path_match": "sflow.vlan_cfi", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.vlan_id": { + "path_match": "sflow.vlan_id", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.vlan_priority": { + "path_match": "sflow.vlan_priority", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.vlan_type": { + "path_match": "sflow.vlan_type", + "mapping": { + "type": "long" + } + } + }, - { - "string_fields": { - "mapping": { - "type": "keyword" - }, - "match_mapping_type": "string", - "match": "*" - } - } - ], - "properties": { - "@timestamp": { - "type": "date" - }, - "@version": { - "type": "keyword" - }, - "event": { - "dynamic": true, - "type": "object", - "properties": { - "host": { - "type": "keyword" - }, - "type": { - "type": "keyword" - } - } - }, - "flow": { - "dynamic": true, - "type": "object", - "properties": { - "application": { - "type": "keyword" - }, - "autonomous_system": { - "type": "keyword" - }, - "bgp_next_hop": { - "type": "ip" - }, - "bgp_valid_state": { - "type": "long" - }, - "bytes": { - "type": "long" - }, - "city": { - "type": "keyword" - }, - "client_addr": { - "type": "ip" - }, - "client_asn": { - "type": "long" - }, - "client_autonomous_system": { - "type": "keyword" - }, - "client_city": { - "type": "keyword" - }, - "client_country": { - "type": "keyword" - }, - "client_country_code": { - "type": "keyword" - }, - "client_geo_location": { - "type": "geo_point" - }, - "client_hostname": { - "type": "keyword" - }, - "client_rep_tags": { - "type": "keyword" - }, - "country": { - "type": "keyword" - }, - "country_code": { - "type": "keyword" - }, - "direction": { - "type": "keyword" - }, - "dst_addr": { - "type": "ip" - }, - "dst_addr_trans": { - "type": "ip" - }, - "dst_asn": { - "type": "long" - }, - "dst_autonomous_system": { - "type": "keyword" - }, - "dst_city": { - "type": "keyword" - }, - "dst_country": { - "type": "keyword" - }, - "dst_country_code": { - "type": "keyword" - }, - "dst_geo_location": { - "type": "geo_point" - }, - "dst_hostname": { - "type": "keyword" - }, - "dst_mac": { - "type": "keyword" - }, - "dst_mask_len": { - "type": "long" - }, - "dst_port": { - "type": "long" - }, - "dst_port_trans": { - "type": "long" - }, - "dst_port_name": { - "type": "keyword" - }, - "dst_rep_tags": { - "type": "keyword" - }, - "input_ifname": { - "type": "keyword" - }, - "input_snmp": { - "type": "keyword" - }, - "ip_protocol": { - "type": "keyword" - }, - "ip_version": { - "type": "keyword" - }, - "next_hop": { - "type": "ip" - }, - "output_ifname": { - "type": "keyword" - }, - "output_snmp": { - "type": "keyword" - }, - "packets": { - "type": "long" - }, - "rep_tags": { - "type": "keyword" - }, - "sampling_interval": { - "type": "long" - }, - "server_addr": { - "type": "ip" - }, - "server_asn": { - "type": "long" - }, - "server_autonomous_system": { - "type": "keyword" - }, - "server_city": { - "type": "keyword" - }, - "server_country": { - "type": "keyword" - }, - "server_country_code": { - "type": "keyword" - }, - "server_geo_location": { - "type": "geo_point" - }, - "server_hostname": { - "type": "keyword" - }, - "server_rep_tags": { - "type": "keyword" - }, - "service_name": { - "type": "keyword" - }, - "service_port": { - "type": "long" - }, - "src_addr": { - "type": "ip" - }, - "src_addr_trans": { - "type": "ip" - }, - "src_asn": { - "type": "long" - }, - "src_autonomous_system": { - "type": "keyword" - }, - "src_city": { - "type": "keyword" - }, - "src_country": { - "type": "keyword" - }, - "src_country_code": { - "type": "keyword" - }, - "src_geo_location": { - "type": "geo_point" - }, - "src_hostname": { - "type": "keyword" - }, - "src_mac": { - "type": "keyword" - }, - "src_mask_len": { - "type": "long" - }, - "src_port": { - "type": "long" - }, - "src_port_trans": { - "type": "long" - }, - "src_port_name": { - "type": "keyword" - }, - "src_rep_tags": { - "type": "keyword" - }, - "tcp_flags": { - "type": "keyword" - }, - "tos": { - "type": "long" - }, - "traffic_direction": { - "type": "keyword" - }, - "traffic_locality": { - "type": "keyword" - }, - "vlan": { - "type": "long" - } - } - }, - "node": { - "dynamic": true, - "type": "object", - "properties": { - "ipaddr": { - "type": "ip" - }, - "hostname": { - "type": "keyword" - } - } - }, - "tags": { - "type": "keyword" + { + "string_fields": { + "mapping": { + "type": "keyword" + }, + "match_mapping_type": "string", + "match": "*" + } + } + ], + "properties": { + "@timestamp": { + "type": "date" + }, + "@version": { + "type": "keyword" + }, + "event": { + "dynamic": true, + "type": "object", + "properties": { + "host": { + "type": "keyword" + }, + "type": { + "type": "keyword" + } + } + }, + "flow": { + "dynamic": true, + "type": "object", + "properties": { + "application": { + "type": "keyword" + }, + "autonomous_system": { + "type": "keyword" + }, + "bgp_next_hop": { + "type": "ip" + }, + "bgp_valid_state": { + "type": "long" + }, + "bytes": { + "type": "long" + }, + "city": { + "type": "keyword" + }, + "client_addr": { + "type": "ip" + }, + "client_asn": { + "type": "long" + }, + "client_autonomous_system": { + "type": "keyword" + }, + "client_city": { + "type": "keyword" + }, + "client_country": { + "type": "keyword" + }, + "client_country_code": { + "type": "keyword" + }, + "client_geo_location": { + "type": "geo_point" + }, + "client_hostname": { + "type": "keyword" + }, + "client_rep_tags": { + "type": "keyword" + }, + "country": { + "type": "keyword" + }, + "country_code": { + "type": "keyword" + }, + "direction": { + "type": "keyword" + }, + "dst_addr": { + "type": "ip" + }, + "dst_addr_trans": { + "type": "ip" + }, + "dst_asn": { + "type": "long" + }, + "dst_autonomous_system": { + "type": "keyword" + }, + "dst_city": { + "type": "keyword" + }, + "dst_country": { + "type": "keyword" + }, + "dst_country_code": { + "type": "keyword" + }, + "dst_geo_location": { + "type": "geo_point" + }, + "dst_hostname": { + "type": "keyword" + }, + "dst_mac": { + "type": "keyword" + }, + "dst_mask_len": { + "type": "long" + }, + "dst_port": { + "type": "long" + }, + "dst_port_trans": { + "type": "long" + }, + "dst_port_name": { + "type": "keyword" + }, + "dst_rep_tags": { + "type": "keyword" + }, + "input_ifname": { + "type": "keyword" + }, + "input_snmp": { + "type": "keyword" + }, + "ip_protocol": { + "type": "keyword" + }, + "ip_version": { + "type": "keyword" + }, + "next_hop": { + "type": "ip" + }, + "output_ifname": { + "type": "keyword" + }, + "output_snmp": { + "type": "keyword" + }, + "packets": { + "type": "long" + }, + "rep_tags": { + "type": "keyword" + }, + "sampling_interval": { + "type": "long" + }, + "server_addr": { + "type": "ip" + }, + "server_asn": { + "type": "long" + }, + "server_autonomous_system": { + "type": "keyword" + }, + "server_city": { + "type": "keyword" + }, + "server_country": { + "type": "keyword" + }, + "server_country_code": { + "type": "keyword" + }, + "server_geo_location": { + "type": "geo_point" + }, + "server_hostname": { + "type": "keyword" + }, + "server_rep_tags": { + "type": "keyword" + }, + "service_name": { + "type": "keyword" + }, + "service_port": { + "type": "long" + }, + "src_addr": { + "type": "ip" + }, + "src_addr_trans": { + "type": "ip" + }, + "src_asn": { + "type": "long" + }, + "src_autonomous_system": { + "type": "keyword" + }, + "src_city": { + "type": "keyword" + }, + "src_country": { + "type": "keyword" + }, + "src_country_code": { + "type": "keyword" + }, + "src_geo_location": { + "type": "geo_point" + }, + "src_hostname": { + "type": "keyword" + }, + "src_mac": { + "type": "keyword" + }, + "src_mask_len": { + "type": "long" + }, + "src_port": { + "type": "long" + }, + "src_port_trans": { + "type": "long" + }, + "src_port_name": { + "type": "keyword" + }, + "src_rep_tags": { + "type": "keyword" + }, + "tcp_flags": { + "type": "keyword" + }, + "tos": { + "type": "long" + }, + "traffic_direction": { + "type": "keyword" + }, + "traffic_locality": { + "type": "keyword" + }, + "vlan": { + "type": "long" + } + } + }, + "node": { + "dynamic": true, + "type": "object", + "properties": { + "ipaddr": { + "type": "ip" + }, + "hostname": { + "type": "keyword" + } } + }, + "tags": { + "type": "keyword" } } } diff --git a/logstash/elastiflow/templates/elastiflow_dynamic.template.json b/logstash/elastiflow/templates/elastiflow_dynamic.template.json index 8322873..e996419 100755 --- a/logstash/elastiflow/templates/elastiflow_dynamic.template.json +++ b/logstash/elastiflow/templates/elastiflow_dynamic.template.json @@ -1,7 +1,7 @@ { "order": 0, - "version": 30402, - "index_patterns": "elastiflow-3.4.2-*", + "version": 30500, + "index_patterns": "elastiflow-3.5.0-*", "settings": { "index": { "number_of_shards": 3, @@ -12,28653 +12,28703 @@ "total_fields" : { "limit": 5000 } + }, + "query": { + "default_field": [ + "@timestamp", + "@version", + "event.host", + "event.type", + "flow.application", + "flow.autonomous_system", + "flow.bgp_next_hop", + "flow.bgp_valid_state", + "flow.city", + "flow.country", + "flow.country_code", + "flow.direction", + "flow.dst_addr", + "flow.dst_addr_trans", + "flow.dst_asn", + "flow.dst_hostname", + "flow.dst_mac", + "flow.dst_mask_len", + "flow.dst_port", + "flow.dst_port_trans", + "flow.dst_port_name", + "flow.input_ifname", + "flow.input_snmp", + "flow.ip_protocol", + "flow.ip_version", + "flow.next_hop", + "flow.output_ifname", + "flow.output_snmp", + "flow.rep_tags", + "flow.sampling_interval", + "flow.service_name", + "flow.src_addr", + "flow.src_addr_trans", + "flow.src_asn", + "flow.src_hostname", + "flow.src_mac", + "flow.src_mask_len", + "flow.src_port", + "flow.src_port_trans", + "flow.src_port_name", + "flow.tcp_flags", + "flow.tos", + "flow.traffic_direction", + "flow.traffic_locality", + "flow.vlan", + "node.ipaddr", + "node.hostname", + "tags" + ] } } }, "mappings": { - "doc": { - "numeric_detection": true, - "dynamic_templates": [ - { - "ipfix.octetDeltaCount": { - "path_match": "ipfix.octetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.packetDeltaCount": { - "path_match": "ipfix.packetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.deltaFlowCount": { - "path_match": "ipfix.deltaFlowCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.protocolIdentifier": { - "path_match": "ipfix.protocolIdentifier", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipClassOfService": { - "path_match": "ipfix.ipClassOfService", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpControlBits": { - "path_match": "ipfix.tcpControlBits", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sourceTransportPort": { - "path_match": "ipfix.sourceTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sourceIPv4Address": { - "path_match": "ipfix.sourceIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sourceIPv4PrefixLength": { - "path_match": "ipfix.sourceIPv4PrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ingressInterface": { - "path_match": "ipfix.ingressInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.destinationTransportPort": { - "path_match": "ipfix.destinationTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.destinationIPv4Address": { - "path_match": "ipfix.destinationIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.destinationIPv4PrefixLength": { - "path_match": "ipfix.destinationIPv4PrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.egressInterface": { - "path_match": "ipfix.egressInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipNextHopIPv4Address": { - "path_match": "ipfix.ipNextHopIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.bgpSourceAsNumber": { - "path_match": "ipfix.bgpSourceAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.bgpDestinationAsNumber": { - "path_match": "ipfix.bgpDestinationAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.bgpNextHopIPv4Address": { - "path_match": "ipfix.bgpNextHopIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.postMCastPacketDeltaCount": { - "path_match": "ipfix.postMCastPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postMCastOctetDeltaCount": { - "path_match": "ipfix.postMCastOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowEndSysUpTime": { - "path_match": "ipfix.flowEndSysUpTime", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowStartSysUpTime": { - "path_match": "ipfix.flowStartSysUpTime", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postOctetDeltaCount": { - "path_match": "ipfix.postOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postPacketDeltaCount": { - "path_match": "ipfix.postPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.minimumIpTotalLength": { - "path_match": "ipfix.minimumIpTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maximumIpTotalLength": { - "path_match": "ipfix.maximumIpTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sourceIPv6Address": { - "path_match": "ipfix.sourceIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.destinationIPv6Address": { - "path_match": "ipfix.destinationIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sourceIPv6PrefixLength": { - "path_match": "ipfix.sourceIPv6PrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.destinationIPv6PrefixLength": { - "path_match": "ipfix.destinationIPv6PrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowLabelIPv6": { - "path_match": "ipfix.flowLabelIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.icmpTypeCodeIPv4": { - "path_match": "ipfix.icmpTypeCodeIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.igmpType": { - "path_match": "ipfix.igmpType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingInterval": { - "path_match": "ipfix.samplingInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingAlgorithm": { - "path_match": "ipfix.samplingAlgorithm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowActiveTimeout": { - "path_match": "ipfix.flowActiveTimeout", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowIdleTimeout": { - "path_match": "ipfix.flowIdleTimeout", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.engineType": { - "path_match": "ipfix.engineType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.engineId": { - "path_match": "ipfix.engineId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exportedOctetTotalCount": { - "path_match": "ipfix.exportedOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exportedMessageTotalCount": { - "path_match": "ipfix.exportedMessageTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exportedFlowRecordTotalCount": { - "path_match": "ipfix.exportedFlowRecordTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipv4RouterSc": { - "path_match": "ipfix.ipv4RouterSc", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sourceIPv4Prefix": { - "path_match": "ipfix.sourceIPv4Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.destinationIPv4Prefix": { - "path_match": "ipfix.destinationIPv4Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.mplsTopLabelType": { - "path_match": "ipfix.mplsTopLabelType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsTopLabelIPv4Address": { - "path_match": "ipfix.mplsTopLabelIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.samplerId": { - "path_match": "ipfix.samplerId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplerMode": { - "path_match": "ipfix.samplerMode", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplerRandomInterval": { - "path_match": "ipfix.samplerRandomInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.classId": { - "path_match": "ipfix.classId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.minimumTTL": { - "path_match": "ipfix.minimumTTL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maximumTTL": { - "path_match": "ipfix.maximumTTL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.fragmentIdentification": { - "path_match": "ipfix.fragmentIdentification", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postIpClassOfService": { - "path_match": "ipfix.postIpClassOfService", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sourceMacAddress": { - "path_match": "ipfix.sourceMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.postDestinationMacAddress": { - "path_match": "ipfix.postDestinationMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.vlanId": { - "path_match": "ipfix.vlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postVlanId": { - "path_match": "ipfix.postVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipVersion": { - "path_match": "ipfix.ipVersion", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowDirection": { - "path_match": "ipfix.flowDirection", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipNextHopIPv6Address": { - "path_match": "ipfix.ipNextHopIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.bgpNextHopIPv6Address": { - "path_match": "ipfix.bgpNextHopIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ipv6ExtensionHeaders": { - "path_match": "ipfix.ipv6ExtensionHeaders", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.transportPacketLoss": { - "path_match": "ipfix.transportPacketLoss", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.transportUnreachability": { - "path_match": "ipfix.transportUnreachability", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.transportLatency": { - "path_match": "ipfix.transportLatency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsTopLabelStackSection": { - "path_match": "ipfix.mplsTopLabelStackSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection2": { - "path_match": "ipfix.mplsLabelStackSection2", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection3": { - "path_match": "ipfix.mplsLabelStackSection3", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection4": { - "path_match": "ipfix.mplsLabelStackSection4", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection5": { - "path_match": "ipfix.mplsLabelStackSection5", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection6": { - "path_match": "ipfix.mplsLabelStackSection6", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection7": { - "path_match": "ipfix.mplsLabelStackSection7", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection8": { - "path_match": "ipfix.mplsLabelStackSection8", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection9": { - "path_match": "ipfix.mplsLabelStackSection9", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection10": { - "path_match": "ipfix.mplsLabelStackSection10", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.destinationMacAddress": { - "path_match": "ipfix.destinationMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.postSourceMacAddress": { - "path_match": "ipfix.postSourceMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.interfaceName": { - "path_match": "ipfix.interfaceName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.interfaceDescription": { - "path_match": "ipfix.interfaceDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.samplerName": { - "path_match": "ipfix.samplerName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.octetTotalCount": { - "path_match": "ipfix.octetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.packetTotalCount": { - "path_match": "ipfix.packetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flagsAndSamplerId": { - "path_match": "ipfix.flagsAndSamplerId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.fragmentOffset": { - "path_match": "ipfix.fragmentOffset", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.forwardingStatus": { - "path_match": "ipfix.forwardingStatus", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsVpnRouteDistinguisher": { - "path_match": "ipfix.mplsVpnRouteDistinguisher", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsTopLabelPrefixLength": { - "path_match": "ipfix.mplsTopLabelPrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.srcTrafficIndex": { - "path_match": "ipfix.srcTrafficIndex", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dstTrafficIndex": { - "path_match": "ipfix.dstTrafficIndex", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.applicationDescription": { - "path_match": "ipfix.applicationDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.applicationId": { - "path_match": "ipfix.applicationId", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.applicationName": { - "path_match": "ipfix.applicationName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.subApplicationTag": { - "path_match": "ipfix.subApplicationTag", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.postIpDiffServCodePoint": { - "path_match": "ipfix.postIpDiffServCodePoint", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.multicastReplicationFactor": { - "path_match": "ipfix.multicastReplicationFactor", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.className": { - "path_match": "ipfix.className", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.classificationEngineId": { - "path_match": "ipfix.classificationEngineId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2packetSectionOffset": { - "path_match": "ipfix.layer2packetSectionOffset", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2packetSectionSize": { - "path_match": "ipfix.layer2packetSectionSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2packetSectionData": { - "path_match": "ipfix.layer2packetSectionData", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.applicationVersion": { - "path_match": "ipfix.applicationVersion", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.applicationVersionName": { - "path_match": "ipfix.applicationVersionName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.applicationVendor": { - "path_match": "ipfix.applicationVendor", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.subApplicationName": { - "path_match": "ipfix.subApplicationName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.subApplicationDescription": { - "path_match": "ipfix.subApplicationDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.templateParameterRangeEnd": { - "path_match": "ipfix.templateParameterRangeEnd", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.bgpNextAdjacentAsNumber": { - "path_match": "ipfix.bgpNextAdjacentAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.bgpPrevAdjacentAsNumber": { - "path_match": "ipfix.bgpPrevAdjacentAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exporterIPv4Address": { - "path_match": "ipfix.exporterIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.exporterIPv6Address": { - "path_match": "ipfix.exporterIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.droppedOctetDeltaCount": { - "path_match": "ipfix.droppedOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.droppedPacketDeltaCount": { - "path_match": "ipfix.droppedPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.droppedOctetTotalCount": { - "path_match": "ipfix.droppedOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.droppedPacketTotalCount": { - "path_match": "ipfix.droppedPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowEndReason": { - "path_match": "ipfix.flowEndReason", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.commonPropertiesId": { - "path_match": "ipfix.commonPropertiesId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.observationPointId": { - "path_match": "ipfix.observationPointId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.icmpTypeCodeIPv6": { - "path_match": "ipfix.icmpTypeCodeIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsTopLabelIPv6Address": { - "path_match": "ipfix.mplsTopLabelIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.lineCardId": { - "path_match": "ipfix.lineCardId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.portId": { - "path_match": "ipfix.portId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.meteringProcessId": { - "path_match": "ipfix.meteringProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exportingProcessId": { - "path_match": "ipfix.exportingProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.templateId": { - "path_match": "ipfix.templateId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.wlanChannelId": { - "path_match": "ipfix.wlanChannelId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.wlanSSID": { - "path_match": "ipfix.wlanSSID", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.flowId": { - "path_match": "ipfix.flowId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.observationDomainId": { - "path_match": "ipfix.observationDomainId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowStartSeconds": { - "path_match": "ipfix.flowStartSeconds", - "mapping": { - "type": "date" - } - } - }, - { - "ipfix.flowEndSeconds": { - "path_match": "ipfix.flowEndSeconds", - "mapping": { - "type": "date" - } - } - }, - { - "ipfix.flowStartMilliseconds": { - "path_match": "ipfix.flowStartMilliseconds", - "mapping": { - "type": "date" - } - } - }, - { - "ipfix.flowEndMilliseconds": { - "path_match": "ipfix.flowEndMilliseconds", - "mapping": { - "type": "date" - } - } - }, - { - "ipfix.flowStartMicroseconds": { - "path_match": "ipfix.flowStartMicroseconds", - "mapping": { - "type": "date" - } - } - }, - { - "ipfix.flowEndMicroseconds": { - "path_match": "ipfix.flowEndMicroseconds", - "mapping": { - "type": "date" - } - } - }, - { - "ipfix.flowStartNanoseconds": { - "path_match": "ipfix.flowStartNanoseconds", - "mapping": { - "type": "date" - } - } - }, - { - "ipfix.flowEndNanoseconds": { - "path_match": "ipfix.flowEndNanoseconds", - "mapping": { - "type": "date" - } - } - }, - { - "ipfix.flowStartDeltaMicroseconds": { - "path_match": "ipfix.flowStartDeltaMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowEndDeltaMicroseconds": { - "path_match": "ipfix.flowEndDeltaMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.systemInitTimeMilliseconds": { - "path_match": "ipfix.systemInitTimeMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowDurationMilliseconds": { - "path_match": "ipfix.flowDurationMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowDurationMicroseconds": { - "path_match": "ipfix.flowDurationMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.observedFlowTotalCount": { - "path_match": "ipfix.observedFlowTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ignoredPacketTotalCount": { - "path_match": "ipfix.ignoredPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ignoredOctetTotalCount": { - "path_match": "ipfix.ignoredOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.notSentFlowTotalCount": { - "path_match": "ipfix.notSentFlowTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.notSentPacketTotalCount": { - "path_match": "ipfix.notSentPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.notSentOctetTotalCount": { - "path_match": "ipfix.notSentOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.destinationIPv6Prefix": { - "path_match": "ipfix.destinationIPv6Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sourceIPv6Prefix": { - "path_match": "ipfix.sourceIPv6Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.postOctetTotalCount": { - "path_match": "ipfix.postOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postPacketTotalCount": { - "path_match": "ipfix.postPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowKeyIndicator": { - "path_match": "ipfix.flowKeyIndicator", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postMCastPacketTotalCount": { - "path_match": "ipfix.postMCastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postMCastOctetTotalCount": { - "path_match": "ipfix.postMCastOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.icmpTypeIPv4": { - "path_match": "ipfix.icmpTypeIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.icmpCodeIPv4": { - "path_match": "ipfix.icmpCodeIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.icmpTypeIPv6": { - "path_match": "ipfix.icmpTypeIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.icmpCodeIPv6": { - "path_match": "ipfix.icmpCodeIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.udpSourcePort": { - "path_match": "ipfix.udpSourcePort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.udpDestinationPort": { - "path_match": "ipfix.udpDestinationPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpSourcePort": { - "path_match": "ipfix.tcpSourcePort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpDestinationPort": { - "path_match": "ipfix.tcpDestinationPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpSequenceNumber": { - "path_match": "ipfix.tcpSequenceNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpAcknowledgementNumber": { - "path_match": "ipfix.tcpAcknowledgementNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpWindowSize": { - "path_match": "ipfix.tcpWindowSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpUrgentPointer": { - "path_match": "ipfix.tcpUrgentPointer", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpHeaderLength": { - "path_match": "ipfix.tcpHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipHeaderLength": { - "path_match": "ipfix.ipHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.totalLengthIPv4": { - "path_match": "ipfix.totalLengthIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.payloadLengthIPv6": { - "path_match": "ipfix.payloadLengthIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipTTL": { - "path_match": "ipfix.ipTTL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.nextHeaderIPv6": { - "path_match": "ipfix.nextHeaderIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsPayloadLength": { - "path_match": "ipfix.mplsPayloadLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipDiffServCodePoint": { - "path_match": "ipfix.ipDiffServCodePoint", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipPrecedence": { - "path_match": "ipfix.ipPrecedence", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.fragmentFlags": { - "path_match": "ipfix.fragmentFlags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.octetDeltaSumOfSquares": { - "path_match": "ipfix.octetDeltaSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.octetTotalSumOfSquares": { - "path_match": "ipfix.octetTotalSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsTopLabelTTL": { - "path_match": "ipfix.mplsTopLabelTTL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsLabelStackLength": { - "path_match": "ipfix.mplsLabelStackLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsLabelStackDepth": { - "path_match": "ipfix.mplsLabelStackDepth", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mplsTopLabelExp": { - "path_match": "ipfix.mplsTopLabelExp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipPayloadLength": { - "path_match": "ipfix.ipPayloadLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.udpMessageLength": { - "path_match": "ipfix.udpMessageLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.isMulticast": { - "path_match": "ipfix.isMulticast", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipv4IHL": { - "path_match": "ipfix.ipv4IHL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipv4Options": { - "path_match": "ipfix.ipv4Options", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpOptions": { - "path_match": "ipfix.tcpOptions", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.collectorIPv4Address": { - "path_match": "ipfix.collectorIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.collectorIPv6Address": { - "path_match": "ipfix.collectorIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.collectorTransportPort": { - "path_match": "ipfix.collectorTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exportInterface": { - "path_match": "ipfix.exportInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exportProtocolVersion": { - "path_match": "ipfix.exportProtocolVersion", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exportTransportProtocol": { - "path_match": "ipfix.exportTransportProtocol", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exporterTransportPort": { - "path_match": "ipfix.exporterTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpSynTotalCount": { - "path_match": "ipfix.tcpSynTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpFinTotalCount": { - "path_match": "ipfix.tcpFinTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpRstTotalCount": { - "path_match": "ipfix.tcpRstTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpPshTotalCount": { - "path_match": "ipfix.tcpPshTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpAckTotalCount": { - "path_match": "ipfix.tcpAckTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpUrgTotalCount": { - "path_match": "ipfix.tcpUrgTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipTotalLength": { - "path_match": "ipfix.ipTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postNATSourceIPv4Address": { - "path_match": "ipfix.postNATSourceIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.postNATDestinationIPv4Address": { - "path_match": "ipfix.postNATDestinationIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.postNAPTSourceTransportPort": { - "path_match": "ipfix.postNAPTSourceTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postNAPTDestinationTransportPort": { - "path_match": "ipfix.postNAPTDestinationTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.natOriginatingAddressRealm": { - "path_match": "ipfix.natOriginatingAddressRealm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.natEvent": { - "path_match": "ipfix.natEvent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.initiatorOctets": { - "path_match": "ipfix.initiatorOctets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.responderOctets": { - "path_match": "ipfix.responderOctets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.firewallEvent": { - "path_match": "ipfix.firewallEvent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ingressVRFID": { - "path_match": "ipfix.ingressVRFID", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.egressVRFID": { - "path_match": "ipfix.egressVRFID", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.VRFname": { - "path_match": "ipfix.VRFname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.postMplsTopLabelExp": { - "path_match": "ipfix.postMplsTopLabelExp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.tcpWindowScale": { - "path_match": "ipfix.tcpWindowScale", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.biflowDirection": { - "path_match": "ipfix.biflowDirection", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ethernetHeaderLength": { - "path_match": "ipfix.ethernetHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ethernetPayloadLength": { - "path_match": "ipfix.ethernetPayloadLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ethernetTotalLength": { - "path_match": "ipfix.ethernetTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qVlanId": { - "path_match": "ipfix.dot1qVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qPriority": { - "path_match": "ipfix.dot1qPriority", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qCustomerVlanId": { - "path_match": "ipfix.dot1qCustomerVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qCustomerPriority": { - "path_match": "ipfix.dot1qCustomerPriority", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.metroEvcId": { - "path_match": "ipfix.metroEvcId", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.metroEvcType": { - "path_match": "ipfix.metroEvcType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.pseudoWireId": { - "path_match": "ipfix.pseudoWireId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.pseudoWireType": { - "path_match": "ipfix.pseudoWireType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.pseudoWireControlWord": { - "path_match": "ipfix.pseudoWireControlWord", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ingressPhysicalInterface": { - "path_match": "ipfix.ingressPhysicalInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.egressPhysicalInterface": { - "path_match": "ipfix.egressPhysicalInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postDot1qVlanId": { - "path_match": "ipfix.postDot1qVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postDot1qCustomerVlanId": { - "path_match": "ipfix.postDot1qCustomerVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ethernetType": { - "path_match": "ipfix.ethernetType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postIpPrecedence": { - "path_match": "ipfix.postIpPrecedence", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.collectionTimeMilliseconds": { - "path_match": "ipfix.collectionTimeMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.exportSctpStreamId": { - "path_match": "ipfix.exportSctpStreamId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxExportSeconds": { - "path_match": "ipfix.maxExportSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxFlowEndSeconds": { - "path_match": "ipfix.maxFlowEndSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.messageMD5Checksum": { - "path_match": "ipfix.messageMD5Checksum", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.messageScope": { - "path_match": "ipfix.messageScope", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.minExportSeconds": { - "path_match": "ipfix.minExportSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.minFlowStartSeconds": { - "path_match": "ipfix.minFlowStartSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.opaqueOctets": { - "path_match": "ipfix.opaqueOctets", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sessionScope": { - "path_match": "ipfix.sessionScope", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxFlowEndMicroseconds": { - "path_match": "ipfix.maxFlowEndMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxFlowEndMilliseconds": { - "path_match": "ipfix.maxFlowEndMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxFlowEndNanoseconds": { - "path_match": "ipfix.maxFlowEndNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.minFlowStartMicroseconds": { - "path_match": "ipfix.minFlowStartMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.minFlowStartMilliseconds": { - "path_match": "ipfix.minFlowStartMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.minFlowStartNanoseconds": { - "path_match": "ipfix.minFlowStartNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.collectorCertificate": { - "path_match": "ipfix.collectorCertificate", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.exporterCertificate": { - "path_match": "ipfix.exporterCertificate", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.dataRecordsReliability": { - "path_match": "ipfix.dataRecordsReliability", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.observationPointType": { - "path_match": "ipfix.observationPointType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.newConnectionDeltaCount": { - "path_match": "ipfix.newConnectionDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.connectionSumDurationSeconds": { - "path_match": "ipfix.connectionSumDurationSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.connectionTransactionId": { - "path_match": "ipfix.connectionTransactionId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postNATSourceIPv6Address": { - "path_match": "ipfix.postNATSourceIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.postNATDestinationIPv6Address": { - "path_match": "ipfix.postNATDestinationIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.natPoolId": { - "path_match": "ipfix.natPoolId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.natPoolName": { - "path_match": "ipfix.natPoolName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.anonymizationFlags": { - "path_match": "ipfix.anonymizationFlags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.anonymizationTechnique": { - "path_match": "ipfix.anonymizationTechnique", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.informationElementIndex": { - "path_match": "ipfix.informationElementIndex", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.p2pTechnology": { - "path_match": "ipfix.p2pTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.tunnelTechnology": { - "path_match": "ipfix.tunnelTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.encryptedTechnology": { - "path_match": "ipfix.encryptedTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.bgpValidityState": { - "path_match": "ipfix.bgpValidityState", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.IPSecSPI": { - "path_match": "ipfix.IPSecSPI", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.greKey": { - "path_match": "ipfix.greKey", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.natType": { - "path_match": "ipfix.natType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.initiatorPackets": { - "path_match": "ipfix.initiatorPackets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.responderPackets": { - "path_match": "ipfix.responderPackets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.observationDomainName": { - "path_match": "ipfix.observationDomainName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.selectionSequenceId": { - "path_match": "ipfix.selectionSequenceId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.selectorId": { - "path_match": "ipfix.selectorId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.informationElementId": { - "path_match": "ipfix.informationElementId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.selectorAlgorithm": { - "path_match": "ipfix.selectorAlgorithm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingPacketInterval": { - "path_match": "ipfix.samplingPacketInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingPacketSpace": { - "path_match": "ipfix.samplingPacketSpace", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingTimeInterval": { - "path_match": "ipfix.samplingTimeInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingTimeSpace": { - "path_match": "ipfix.samplingTimeSpace", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingSize": { - "path_match": "ipfix.samplingSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingPopulation": { - "path_match": "ipfix.samplingPopulation", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingProbability": { - "path_match": "ipfix.samplingProbability", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.dataLinkFrameSize": { - "path_match": "ipfix.dataLinkFrameSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipHeaderPacketSection": { - "path_match": "ipfix.ipHeaderPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ipPayloadPacketSection": { - "path_match": "ipfix.ipPayloadPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.dataLinkFrameSection": { - "path_match": "ipfix.dataLinkFrameSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsLabelStackSection": { - "path_match": "ipfix.mplsLabelStackSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mplsPayloadPacketSection": { - "path_match": "ipfix.mplsPayloadPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.selectorIdTotalPktsObserved": { - "path_match": "ipfix.selectorIdTotalPktsObserved", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.selectorIdTotalPktsSelected": { - "path_match": "ipfix.selectorIdTotalPktsSelected", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.absoluteError": { - "path_match": "ipfix.absoluteError", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.relativeError": { - "path_match": "ipfix.relativeError", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.observationTimeSeconds": { - "path_match": "ipfix.observationTimeSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.observationTimeMilliseconds": { - "path_match": "ipfix.observationTimeMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.observationTimeMicroseconds": { - "path_match": "ipfix.observationTimeMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.observationTimeNanoseconds": { - "path_match": "ipfix.observationTimeNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.digestHashValue": { - "path_match": "ipfix.digestHashValue", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashIPPayloadOffset": { - "path_match": "ipfix.hashIPPayloadOffset", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashIPPayloadSize": { - "path_match": "ipfix.hashIPPayloadSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashOutputRangeMin": { - "path_match": "ipfix.hashOutputRangeMin", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashOutputRangeMax": { - "path_match": "ipfix.hashOutputRangeMax", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashSelectedRangeMin": { - "path_match": "ipfix.hashSelectedRangeMin", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashSelectedRangeMax": { - "path_match": "ipfix.hashSelectedRangeMax", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashDigestOutput": { - "path_match": "ipfix.hashDigestOutput", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashInitialiserValue": { - "path_match": "ipfix.hashInitialiserValue", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.selectorName": { - "path_match": "ipfix.selectorName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.upperCILimit": { - "path_match": "ipfix.upperCILimit", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.lowerCILimit": { - "path_match": "ipfix.lowerCILimit", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.confidenceLevel": { - "path_match": "ipfix.confidenceLevel", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.informationElementDataType": { - "path_match": "ipfix.informationElementDataType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.informationElementDescription": { - "path_match": "ipfix.informationElementDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.informationElementName": { - "path_match": "ipfix.informationElementName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.informationElementRangeBegin": { - "path_match": "ipfix.informationElementRangeBegin", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.informationElementRangeEnd": { - "path_match": "ipfix.informationElementRangeEnd", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.informationElementSemantics": { - "path_match": "ipfix.informationElementSemantics", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.informationElementUnits": { - "path_match": "ipfix.informationElementUnits", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.privateEnterpriseNumber": { - "path_match": "ipfix.privateEnterpriseNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.virtualStationInterfaceId": { - "path_match": "ipfix.virtualStationInterfaceId", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.virtualStationInterfaceName": { - "path_match": "ipfix.virtualStationInterfaceName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.virtualStationUUID": { - "path_match": "ipfix.virtualStationUUID", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.virtualStationName": { - "path_match": "ipfix.virtualStationName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.layer2SegmentId": { - "path_match": "ipfix.layer2SegmentId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2OctetDeltaCount": { - "path_match": "ipfix.layer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2OctetTotalCount": { - "path_match": "ipfix.layer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ingressUnicastPacketTotalCount": { - "path_match": "ipfix.ingressUnicastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ingressMulticastPacketTotalCount": { - "path_match": "ipfix.ingressMulticastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ingressBroadcastPacketTotalCount": { - "path_match": "ipfix.ingressBroadcastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.egressUnicastPacketTotalCount": { - "path_match": "ipfix.egressUnicastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.egressBroadcastPacketTotalCount": { - "path_match": "ipfix.egressBroadcastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.monitoringIntervalStartMilliSeconds": { - "path_match": "ipfix.monitoringIntervalStartMilliSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.monitoringIntervalEndMilliSeconds": { - "path_match": "ipfix.monitoringIntervalEndMilliSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.portRangeStart": { - "path_match": "ipfix.portRangeStart", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.portRangeEnd": { - "path_match": "ipfix.portRangeEnd", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.portRangeStepSize": { - "path_match": "ipfix.portRangeStepSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.portRangeNumPorts": { - "path_match": "ipfix.portRangeNumPorts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.staMacAddress": { - "path_match": "ipfix.staMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.staIPv4Address": { - "path_match": "ipfix.staIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.wtpMacAddress": { - "path_match": "ipfix.wtpMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ingressInterfaceType": { - "path_match": "ipfix.ingressInterfaceType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.egressInterfaceType": { - "path_match": "ipfix.egressInterfaceType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.rtpSequenceNumber": { - "path_match": "ipfix.rtpSequenceNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.userName": { - "path_match": "ipfix.userName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.applicationCategoryName": { - "path_match": "ipfix.applicationCategoryName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.applicationSubCategoryName": { - "path_match": "ipfix.applicationSubCategoryName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.applicationGroupName": { - "path_match": "ipfix.applicationGroupName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.originalFlowsPresent": { - "path_match": "ipfix.originalFlowsPresent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.originalFlowsInitiated": { - "path_match": "ipfix.originalFlowsInitiated", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.originalFlowsCompleted": { - "path_match": "ipfix.originalFlowsCompleted", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.distinctCountOfSourceIPAddress": { - "path_match": "ipfix.distinctCountOfSourceIPAddress", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.distinctCountOfDestinationIPAddress": { - "path_match": "ipfix.distinctCountOfDestinationIPAddress", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.distinctCountOfSourceIPv4Address": { - "path_match": "ipfix.distinctCountOfSourceIPv4Address", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.distinctCountOfDestinationIPv4Address": { - "path_match": "ipfix.distinctCountOfDestinationIPv4Address", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.distinctCountOfSourceIPv6Address": { - "path_match": "ipfix.distinctCountOfSourceIPv6Address", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.distinctCountOfDestinationIPv6Address": { - "path_match": "ipfix.distinctCountOfDestinationIPv6Address", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.valueDistributionMethod": { - "path_match": "ipfix.valueDistributionMethod", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.rfc3550JitterMilliseconds": { - "path_match": "ipfix.rfc3550JitterMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.rfc3550JitterMicroseconds": { - "path_match": "ipfix.rfc3550JitterMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.rfc3550JitterNanoseconds": { - "path_match": "ipfix.rfc3550JitterNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qDEI": { - "path_match": "ipfix.dot1qDEI", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qCustomerDEI": { - "path_match": "ipfix.dot1qCustomerDEI", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowSelectorAlgorithm": { - "path_match": "ipfix.flowSelectorAlgorithm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowSelectedOctetDeltaCount": { - "path_match": "ipfix.flowSelectedOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowSelectedPacketDeltaCount": { - "path_match": "ipfix.flowSelectedPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowSelectedFlowDeltaCount": { - "path_match": "ipfix.flowSelectedFlowDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.selectorIDTotalFlowsObserved": { - "path_match": "ipfix.selectorIDTotalFlowsObserved", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.selectorIDTotalFlowsSelected": { - "path_match": "ipfix.selectorIDTotalFlowsSelected", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingFlowInterval": { - "path_match": "ipfix.samplingFlowInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.samplingFlowSpacing": { - "path_match": "ipfix.samplingFlowSpacing", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowSamplingTimeInterval": { - "path_match": "ipfix.flowSamplingTimeInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.flowSamplingTimeSpacing": { - "path_match": "ipfix.flowSamplingTimeSpacing", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.hashFlowDomain": { - "path_match": "ipfix.hashFlowDomain", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.transportOctetDeltaCount": { - "path_match": "ipfix.transportOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.transportPacketDeltaCount": { - "path_match": "ipfix.transportPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.originalExporterIPv4Address": { - "path_match": "ipfix.originalExporterIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.originalExporterIPv6Address": { - "path_match": "ipfix.originalExporterIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.originalObservationDomainId": { - "path_match": "ipfix.originalObservationDomainId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.intermediateProcessId": { - "path_match": "ipfix.intermediateProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ignoredDataRecordTotalCount": { - "path_match": "ipfix.ignoredDataRecordTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dataLinkFrameType": { - "path_match": "ipfix.dataLinkFrameType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sectionOffset": { - "path_match": "ipfix.sectionOffset", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sectionExportedOctets": { - "path_match": "ipfix.sectionExportedOctets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qServiceInstanceTag": { - "path_match": "ipfix.dot1qServiceInstanceTag", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.dot1qServiceInstanceId": { - "path_match": "ipfix.dot1qServiceInstanceId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qServiceInstancePriority": { - "path_match": "ipfix.dot1qServiceInstancePriority", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.dot1qCustomerSourceMacAddress": { - "path_match": "ipfix.dot1qCustomerSourceMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.dot1qCustomerDestinationMacAddress": { - "path_match": "ipfix.dot1qCustomerDestinationMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.postLayer2OctetDeltaCount": { - "path_match": "ipfix.postLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postMCastLayer2OctetDeltaCount": { - "path_match": "ipfix.postMCastLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postLayer2OctetTotalCount": { - "path_match": "ipfix.postLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.postMCastLayer2OctetTotalCount": { - "path_match": "ipfix.postMCastLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.minimumLayer2TotalLength": { - "path_match": "ipfix.minimumLayer2TotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maximumLayer2TotalLength": { - "path_match": "ipfix.maximumLayer2TotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.droppedLayer2OctetDeltaCount": { - "path_match": "ipfix.droppedLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.droppedLayer2OctetTotalCount": { - "path_match": "ipfix.droppedLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ignoredLayer2OctetTotalCount": { - "path_match": "ipfix.ignoredLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.notSentLayer2OctetTotalCount": { - "path_match": "ipfix.notSentLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2OctetDeltaSumOfSquares": { - "path_match": "ipfix.layer2OctetDeltaSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2OctetTotalSumOfSquares": { - "path_match": "ipfix.layer2OctetTotalSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2FrameDeltaCount": { - "path_match": "ipfix.layer2FrameDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.layer2FrameTotalCount": { - "path_match": "ipfix.layer2FrameTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.pseudoWireDestinationIPv4Address": { - "path_match": "ipfix.pseudoWireDestinationIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ignoredLayer2FrameTotalCount": { - "path_match": "ipfix.ignoredLayer2FrameTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibObjectValueInteger": { - "path_match": "ipfix.mibObjectValueInteger", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibObjectValueOctetString": { - "path_match": "ipfix.mibObjectValueOctetString", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibObjectValueOID": { - "path_match": "ipfix.mibObjectValueOID", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibObjectValueBits": { - "path_match": "ipfix.mibObjectValueBits", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibObjectValueIPAddress": { - "path_match": "ipfix.mibObjectValueIPAddress", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.mibObjectValueCounter": { - "path_match": "ipfix.mibObjectValueCounter", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibObjectValueGauge": { - "path_match": "ipfix.mibObjectValueGauge", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibObjectValueTimeTicks": { - "path_match": "ipfix.mibObjectValueTimeTicks", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibObjectValueUnsigned": { - "path_match": "ipfix.mibObjectValueUnsigned", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibObjectValueTable": { - "path_match": "ipfix.mibObjectValueTable", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibObjectValueRow": { - "path_match": "ipfix.mibObjectValueRow", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibObjectIdentifier": { - "path_match": "ipfix.mibObjectIdentifier", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibSubIdentifier": { - "path_match": "ipfix.mibSubIdentifier", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibIndexIndicator": { - "path_match": "ipfix.mibIndexIndicator", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibCaptureTimeSemantics": { - "path_match": "ipfix.mibCaptureTimeSemantics", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.mibContextEngineID": { - "path_match": "ipfix.mibContextEngineID", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibContextName": { - "path_match": "ipfix.mibContextName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibObjectName": { - "path_match": "ipfix.mibObjectName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibObjectDescription": { - "path_match": "ipfix.mibObjectDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibObjectSyntax": { - "path_match": "ipfix.mibObjectSyntax", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mibModuleName": { - "path_match": "ipfix.mibModuleName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mobileIMSI": { - "path_match": "ipfix.mobileIMSI", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.mobileMSISDN": { - "path_match": "ipfix.mobileMSISDN", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.httpStatusCode": { - "path_match": "ipfix.httpStatusCode", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sourceTransportPortsLimit": { - "path_match": "ipfix.sourceTransportPortsLimit", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.httpRequestMethod": { - "path_match": "ipfix.httpRequestMethod", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.httpRequestHost": { - "path_match": "ipfix.httpRequestHost", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.httpRequestTarget": { - "path_match": "ipfix.httpRequestTarget", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.httpMessageVersion": { - "path_match": "ipfix.httpMessageVersion", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.natInstanceID": { - "path_match": "ipfix.natInstanceID", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.internalAddressRealm": { - "path_match": "ipfix.internalAddressRealm", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.externalAddressRealm": { - "path_match": "ipfix.externalAddressRealm", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.natQuotaExceededEvent": { - "path_match": "ipfix.natQuotaExceededEvent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.natThresholdEvent": { - "path_match": "ipfix.natThresholdEvent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.httpUserAgent": { - "path_match": "ipfix.httpUserAgent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.httpContentType": { - "path_match": "ipfix.httpContentType", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.httpReasonPhrase": { - "path_match": "ipfix.httpReasonPhrase", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.maxSessionEntries": { - "path_match": "ipfix.maxSessionEntries", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxBIBEntries": { - "path_match": "ipfix.maxBIBEntries", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxEntriesPerUser": { - "path_match": "ipfix.maxEntriesPerUser", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxSubscribers": { - "path_match": "ipfix.maxSubscribers", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.maxFragmentsPendingReassembly": { - "path_match": "ipfix.maxFragmentsPendingReassembly", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.addressPoolHighThreshold": { - "path_match": "ipfix.addressPoolHighThreshold", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.addressPoolLowThreshold": { - "path_match": "ipfix.addressPoolLowThreshold", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.addressPortMappingHighThreshold": { - "path_match": "ipfix.addressPortMappingHighThreshold", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.addressPortMappingLowThreshold": { - "path_match": "ipfix.addressPortMappingLowThreshold", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.addressPortMappingPerUserHighThreshold": { - "path_match": "ipfix.addressPortMappingPerUserHighThreshold", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.globalAddressMappingHighThreshold": { - "path_match": "ipfix.globalAddressMappingHighThreshold", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vpnIdentifier": { - "path_match": "ipfix.vpnIdentifier", - "mapping": { - "type": "keyword" - } - } - }, + "numeric_detection": true, + "dynamic_templates": [ + { + "ipfix.octetDeltaCount": { + "path_match": "ipfix.octetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.packetDeltaCount": { + "path_match": "ipfix.packetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.deltaFlowCount": { + "path_match": "ipfix.deltaFlowCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.protocolIdentifier": { + "path_match": "ipfix.protocolIdentifier", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipClassOfService": { + "path_match": "ipfix.ipClassOfService", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpControlBits": { + "path_match": "ipfix.tcpControlBits", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sourceTransportPort": { + "path_match": "ipfix.sourceTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sourceIPv4Address": { + "path_match": "ipfix.sourceIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sourceIPv4PrefixLength": { + "path_match": "ipfix.sourceIPv4PrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ingressInterface": { + "path_match": "ipfix.ingressInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.destinationTransportPort": { + "path_match": "ipfix.destinationTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.destinationIPv4Address": { + "path_match": "ipfix.destinationIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.destinationIPv4PrefixLength": { + "path_match": "ipfix.destinationIPv4PrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.egressInterface": { + "path_match": "ipfix.egressInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipNextHopIPv4Address": { + "path_match": "ipfix.ipNextHopIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.bgpSourceAsNumber": { + "path_match": "ipfix.bgpSourceAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.bgpDestinationAsNumber": { + "path_match": "ipfix.bgpDestinationAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.bgpNextHopIPv4Address": { + "path_match": "ipfix.bgpNextHopIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.postMCastPacketDeltaCount": { + "path_match": "ipfix.postMCastPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postMCastOctetDeltaCount": { + "path_match": "ipfix.postMCastOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowEndSysUpTime": { + "path_match": "ipfix.flowEndSysUpTime", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowStartSysUpTime": { + "path_match": "ipfix.flowStartSysUpTime", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postOctetDeltaCount": { + "path_match": "ipfix.postOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postPacketDeltaCount": { + "path_match": "ipfix.postPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.minimumIpTotalLength": { + "path_match": "ipfix.minimumIpTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maximumIpTotalLength": { + "path_match": "ipfix.maximumIpTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sourceIPv6Address": { + "path_match": "ipfix.sourceIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.destinationIPv6Address": { + "path_match": "ipfix.destinationIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sourceIPv6PrefixLength": { + "path_match": "ipfix.sourceIPv6PrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.destinationIPv6PrefixLength": { + "path_match": "ipfix.destinationIPv6PrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowLabelIPv6": { + "path_match": "ipfix.flowLabelIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.icmpTypeCodeIPv4": { + "path_match": "ipfix.icmpTypeCodeIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.igmpType": { + "path_match": "ipfix.igmpType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingInterval": { + "path_match": "ipfix.samplingInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingAlgorithm": { + "path_match": "ipfix.samplingAlgorithm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowActiveTimeout": { + "path_match": "ipfix.flowActiveTimeout", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowIdleTimeout": { + "path_match": "ipfix.flowIdleTimeout", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.engineType": { + "path_match": "ipfix.engineType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.engineId": { + "path_match": "ipfix.engineId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exportedOctetTotalCount": { + "path_match": "ipfix.exportedOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exportedMessageTotalCount": { + "path_match": "ipfix.exportedMessageTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exportedFlowRecordTotalCount": { + "path_match": "ipfix.exportedFlowRecordTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipv4RouterSc": { + "path_match": "ipfix.ipv4RouterSc", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sourceIPv4Prefix": { + "path_match": "ipfix.sourceIPv4Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.destinationIPv4Prefix": { + "path_match": "ipfix.destinationIPv4Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.mplsTopLabelType": { + "path_match": "ipfix.mplsTopLabelType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsTopLabelIPv4Address": { + "path_match": "ipfix.mplsTopLabelIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.samplerId": { + "path_match": "ipfix.samplerId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplerMode": { + "path_match": "ipfix.samplerMode", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplerRandomInterval": { + "path_match": "ipfix.samplerRandomInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.classId": { + "path_match": "ipfix.classId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.minimumTTL": { + "path_match": "ipfix.minimumTTL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maximumTTL": { + "path_match": "ipfix.maximumTTL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.fragmentIdentification": { + "path_match": "ipfix.fragmentIdentification", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postIpClassOfService": { + "path_match": "ipfix.postIpClassOfService", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sourceMacAddress": { + "path_match": "ipfix.sourceMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.postDestinationMacAddress": { + "path_match": "ipfix.postDestinationMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.vlanId": { + "path_match": "ipfix.vlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postVlanId": { + "path_match": "ipfix.postVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipVersion": { + "path_match": "ipfix.ipVersion", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowDirection": { + "path_match": "ipfix.flowDirection", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipNextHopIPv6Address": { + "path_match": "ipfix.ipNextHopIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.bgpNextHopIPv6Address": { + "path_match": "ipfix.bgpNextHopIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ipv6ExtensionHeaders": { + "path_match": "ipfix.ipv6ExtensionHeaders", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.transportPacketLoss": { + "path_match": "ipfix.transportPacketLoss", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.transportUnreachability": { + "path_match": "ipfix.transportUnreachability", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.transportLatency": { + "path_match": "ipfix.transportLatency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsTopLabelStackSection": { + "path_match": "ipfix.mplsTopLabelStackSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection2": { + "path_match": "ipfix.mplsLabelStackSection2", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection3": { + "path_match": "ipfix.mplsLabelStackSection3", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection4": { + "path_match": "ipfix.mplsLabelStackSection4", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection5": { + "path_match": "ipfix.mplsLabelStackSection5", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection6": { + "path_match": "ipfix.mplsLabelStackSection6", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection7": { + "path_match": "ipfix.mplsLabelStackSection7", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection8": { + "path_match": "ipfix.mplsLabelStackSection8", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection9": { + "path_match": "ipfix.mplsLabelStackSection9", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection10": { + "path_match": "ipfix.mplsLabelStackSection10", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.destinationMacAddress": { + "path_match": "ipfix.destinationMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.postSourceMacAddress": { + "path_match": "ipfix.postSourceMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.interfaceName": { + "path_match": "ipfix.interfaceName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.interfaceDescription": { + "path_match": "ipfix.interfaceDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.samplerName": { + "path_match": "ipfix.samplerName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.octetTotalCount": { + "path_match": "ipfix.octetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.packetTotalCount": { + "path_match": "ipfix.packetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flagsAndSamplerId": { + "path_match": "ipfix.flagsAndSamplerId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.fragmentOffset": { + "path_match": "ipfix.fragmentOffset", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.forwardingStatus": { + "path_match": "ipfix.forwardingStatus", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsVpnRouteDistinguisher": { + "path_match": "ipfix.mplsVpnRouteDistinguisher", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsTopLabelPrefixLength": { + "path_match": "ipfix.mplsTopLabelPrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.srcTrafficIndex": { + "path_match": "ipfix.srcTrafficIndex", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dstTrafficIndex": { + "path_match": "ipfix.dstTrafficIndex", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.applicationDescription": { + "path_match": "ipfix.applicationDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.applicationId": { + "path_match": "ipfix.applicationId", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.applicationName": { + "path_match": "ipfix.applicationName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.subApplicationTag": { + "path_match": "ipfix.subApplicationTag", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.postIpDiffServCodePoint": { + "path_match": "ipfix.postIpDiffServCodePoint", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.multicastReplicationFactor": { + "path_match": "ipfix.multicastReplicationFactor", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.className": { + "path_match": "ipfix.className", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.classificationEngineId": { + "path_match": "ipfix.classificationEngineId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2packetSectionOffset": { + "path_match": "ipfix.layer2packetSectionOffset", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2packetSectionSize": { + "path_match": "ipfix.layer2packetSectionSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2packetSectionData": { + "path_match": "ipfix.layer2packetSectionData", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.applicationVersion": { + "path_match": "ipfix.applicationVersion", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.applicationVersionName": { + "path_match": "ipfix.applicationVersionName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.applicationVendor": { + "path_match": "ipfix.applicationVendor", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.subApplicationName": { + "path_match": "ipfix.subApplicationName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.subApplicationDescription": { + "path_match": "ipfix.subApplicationDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.templateParameterRangeEnd": { + "path_match": "ipfix.templateParameterRangeEnd", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.bgpNextAdjacentAsNumber": { + "path_match": "ipfix.bgpNextAdjacentAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.bgpPrevAdjacentAsNumber": { + "path_match": "ipfix.bgpPrevAdjacentAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exporterIPv4Address": { + "path_match": "ipfix.exporterIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.exporterIPv6Address": { + "path_match": "ipfix.exporterIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.droppedOctetDeltaCount": { + "path_match": "ipfix.droppedOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.droppedPacketDeltaCount": { + "path_match": "ipfix.droppedPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.droppedOctetTotalCount": { + "path_match": "ipfix.droppedOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.droppedPacketTotalCount": { + "path_match": "ipfix.droppedPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowEndReason": { + "path_match": "ipfix.flowEndReason", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.commonPropertiesId": { + "path_match": "ipfix.commonPropertiesId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.observationPointId": { + "path_match": "ipfix.observationPointId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.icmpTypeCodeIPv6": { + "path_match": "ipfix.icmpTypeCodeIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsTopLabelIPv6Address": { + "path_match": "ipfix.mplsTopLabelIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.lineCardId": { + "path_match": "ipfix.lineCardId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.portId": { + "path_match": "ipfix.portId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.meteringProcessId": { + "path_match": "ipfix.meteringProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exportingProcessId": { + "path_match": "ipfix.exportingProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.templateId": { + "path_match": "ipfix.templateId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.wlanChannelId": { + "path_match": "ipfix.wlanChannelId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.wlanSSID": { + "path_match": "ipfix.wlanSSID", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.flowId": { + "path_match": "ipfix.flowId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.observationDomainId": { + "path_match": "ipfix.observationDomainId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowStartSeconds": { + "path_match": "ipfix.flowStartSeconds", + "mapping": { + "type": "date" + } + } + }, + { + "ipfix.flowEndSeconds": { + "path_match": "ipfix.flowEndSeconds", + "mapping": { + "type": "date" + } + } + }, + { + "ipfix.flowStartMilliseconds": { + "path_match": "ipfix.flowStartMilliseconds", + "mapping": { + "type": "date" + } + } + }, + { + "ipfix.flowEndMilliseconds": { + "path_match": "ipfix.flowEndMilliseconds", + "mapping": { + "type": "date" + } + } + }, + { + "ipfix.flowStartMicroseconds": { + "path_match": "ipfix.flowStartMicroseconds", + "mapping": { + "type": "date" + } + } + }, + { + "ipfix.flowEndMicroseconds": { + "path_match": "ipfix.flowEndMicroseconds", + "mapping": { + "type": "date" + } + } + }, + { + "ipfix.flowStartNanoseconds": { + "path_match": "ipfix.flowStartNanoseconds", + "mapping": { + "type": "date" + } + } + }, + { + "ipfix.flowEndNanoseconds": { + "path_match": "ipfix.flowEndNanoseconds", + "mapping": { + "type": "date" + } + } + }, + { + "ipfix.flowStartDeltaMicroseconds": { + "path_match": "ipfix.flowStartDeltaMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowEndDeltaMicroseconds": { + "path_match": "ipfix.flowEndDeltaMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.systemInitTimeMilliseconds": { + "path_match": "ipfix.systemInitTimeMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowDurationMilliseconds": { + "path_match": "ipfix.flowDurationMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowDurationMicroseconds": { + "path_match": "ipfix.flowDurationMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.observedFlowTotalCount": { + "path_match": "ipfix.observedFlowTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ignoredPacketTotalCount": { + "path_match": "ipfix.ignoredPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ignoredOctetTotalCount": { + "path_match": "ipfix.ignoredOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.notSentFlowTotalCount": { + "path_match": "ipfix.notSentFlowTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.notSentPacketTotalCount": { + "path_match": "ipfix.notSentPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.notSentOctetTotalCount": { + "path_match": "ipfix.notSentOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.destinationIPv6Prefix": { + "path_match": "ipfix.destinationIPv6Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sourceIPv6Prefix": { + "path_match": "ipfix.sourceIPv6Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.postOctetTotalCount": { + "path_match": "ipfix.postOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postPacketTotalCount": { + "path_match": "ipfix.postPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowKeyIndicator": { + "path_match": "ipfix.flowKeyIndicator", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postMCastPacketTotalCount": { + "path_match": "ipfix.postMCastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postMCastOctetTotalCount": { + "path_match": "ipfix.postMCastOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.icmpTypeIPv4": { + "path_match": "ipfix.icmpTypeIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.icmpCodeIPv4": { + "path_match": "ipfix.icmpCodeIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.icmpTypeIPv6": { + "path_match": "ipfix.icmpTypeIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.icmpCodeIPv6": { + "path_match": "ipfix.icmpCodeIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.udpSourcePort": { + "path_match": "ipfix.udpSourcePort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.udpDestinationPort": { + "path_match": "ipfix.udpDestinationPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpSourcePort": { + "path_match": "ipfix.tcpSourcePort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpDestinationPort": { + "path_match": "ipfix.tcpDestinationPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpSequenceNumber": { + "path_match": "ipfix.tcpSequenceNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpAcknowledgementNumber": { + "path_match": "ipfix.tcpAcknowledgementNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpWindowSize": { + "path_match": "ipfix.tcpWindowSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpUrgentPointer": { + "path_match": "ipfix.tcpUrgentPointer", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpHeaderLength": { + "path_match": "ipfix.tcpHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipHeaderLength": { + "path_match": "ipfix.ipHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.totalLengthIPv4": { + "path_match": "ipfix.totalLengthIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.payloadLengthIPv6": { + "path_match": "ipfix.payloadLengthIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipTTL": { + "path_match": "ipfix.ipTTL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.nextHeaderIPv6": { + "path_match": "ipfix.nextHeaderIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsPayloadLength": { + "path_match": "ipfix.mplsPayloadLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipDiffServCodePoint": { + "path_match": "ipfix.ipDiffServCodePoint", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipPrecedence": { + "path_match": "ipfix.ipPrecedence", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.fragmentFlags": { + "path_match": "ipfix.fragmentFlags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.octetDeltaSumOfSquares": { + "path_match": "ipfix.octetDeltaSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.octetTotalSumOfSquares": { + "path_match": "ipfix.octetTotalSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsTopLabelTTL": { + "path_match": "ipfix.mplsTopLabelTTL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsLabelStackLength": { + "path_match": "ipfix.mplsLabelStackLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsLabelStackDepth": { + "path_match": "ipfix.mplsLabelStackDepth", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mplsTopLabelExp": { + "path_match": "ipfix.mplsTopLabelExp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipPayloadLength": { + "path_match": "ipfix.ipPayloadLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.udpMessageLength": { + "path_match": "ipfix.udpMessageLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.isMulticast": { + "path_match": "ipfix.isMulticast", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipv4IHL": { + "path_match": "ipfix.ipv4IHL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipv4Options": { + "path_match": "ipfix.ipv4Options", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpOptions": { + "path_match": "ipfix.tcpOptions", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.collectorIPv4Address": { + "path_match": "ipfix.collectorIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.collectorIPv6Address": { + "path_match": "ipfix.collectorIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.collectorTransportPort": { + "path_match": "ipfix.collectorTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exportInterface": { + "path_match": "ipfix.exportInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exportProtocolVersion": { + "path_match": "ipfix.exportProtocolVersion", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exportTransportProtocol": { + "path_match": "ipfix.exportTransportProtocol", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exporterTransportPort": { + "path_match": "ipfix.exporterTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpSynTotalCount": { + "path_match": "ipfix.tcpSynTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpFinTotalCount": { + "path_match": "ipfix.tcpFinTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpRstTotalCount": { + "path_match": "ipfix.tcpRstTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpPshTotalCount": { + "path_match": "ipfix.tcpPshTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpAckTotalCount": { + "path_match": "ipfix.tcpAckTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpUrgTotalCount": { + "path_match": "ipfix.tcpUrgTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipTotalLength": { + "path_match": "ipfix.ipTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postNATSourceIPv4Address": { + "path_match": "ipfix.postNATSourceIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.postNATDestinationIPv4Address": { + "path_match": "ipfix.postNATDestinationIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.postNAPTSourceTransportPort": { + "path_match": "ipfix.postNAPTSourceTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postNAPTDestinationTransportPort": { + "path_match": "ipfix.postNAPTDestinationTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.natOriginatingAddressRealm": { + "path_match": "ipfix.natOriginatingAddressRealm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.natEvent": { + "path_match": "ipfix.natEvent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.initiatorOctets": { + "path_match": "ipfix.initiatorOctets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.responderOctets": { + "path_match": "ipfix.responderOctets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.firewallEvent": { + "path_match": "ipfix.firewallEvent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ingressVRFID": { + "path_match": "ipfix.ingressVRFID", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.egressVRFID": { + "path_match": "ipfix.egressVRFID", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.VRFname": { + "path_match": "ipfix.VRFname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.postMplsTopLabelExp": { + "path_match": "ipfix.postMplsTopLabelExp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.tcpWindowScale": { + "path_match": "ipfix.tcpWindowScale", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.biflowDirection": { + "path_match": "ipfix.biflowDirection", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ethernetHeaderLength": { + "path_match": "ipfix.ethernetHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ethernetPayloadLength": { + "path_match": "ipfix.ethernetPayloadLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ethernetTotalLength": { + "path_match": "ipfix.ethernetTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qVlanId": { + "path_match": "ipfix.dot1qVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qPriority": { + "path_match": "ipfix.dot1qPriority", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qCustomerVlanId": { + "path_match": "ipfix.dot1qCustomerVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qCustomerPriority": { + "path_match": "ipfix.dot1qCustomerPriority", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.metroEvcId": { + "path_match": "ipfix.metroEvcId", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.metroEvcType": { + "path_match": "ipfix.metroEvcType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.pseudoWireId": { + "path_match": "ipfix.pseudoWireId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.pseudoWireType": { + "path_match": "ipfix.pseudoWireType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.pseudoWireControlWord": { + "path_match": "ipfix.pseudoWireControlWord", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ingressPhysicalInterface": { + "path_match": "ipfix.ingressPhysicalInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.egressPhysicalInterface": { + "path_match": "ipfix.egressPhysicalInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postDot1qVlanId": { + "path_match": "ipfix.postDot1qVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postDot1qCustomerVlanId": { + "path_match": "ipfix.postDot1qCustomerVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ethernetType": { + "path_match": "ipfix.ethernetType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postIpPrecedence": { + "path_match": "ipfix.postIpPrecedence", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.collectionTimeMilliseconds": { + "path_match": "ipfix.collectionTimeMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.exportSctpStreamId": { + "path_match": "ipfix.exportSctpStreamId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxExportSeconds": { + "path_match": "ipfix.maxExportSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxFlowEndSeconds": { + "path_match": "ipfix.maxFlowEndSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.messageMD5Checksum": { + "path_match": "ipfix.messageMD5Checksum", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.messageScope": { + "path_match": "ipfix.messageScope", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.minExportSeconds": { + "path_match": "ipfix.minExportSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.minFlowStartSeconds": { + "path_match": "ipfix.minFlowStartSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.opaqueOctets": { + "path_match": "ipfix.opaqueOctets", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sessionScope": { + "path_match": "ipfix.sessionScope", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxFlowEndMicroseconds": { + "path_match": "ipfix.maxFlowEndMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxFlowEndMilliseconds": { + "path_match": "ipfix.maxFlowEndMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxFlowEndNanoseconds": { + "path_match": "ipfix.maxFlowEndNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.minFlowStartMicroseconds": { + "path_match": "ipfix.minFlowStartMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.minFlowStartMilliseconds": { + "path_match": "ipfix.minFlowStartMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.minFlowStartNanoseconds": { + "path_match": "ipfix.minFlowStartNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.collectorCertificate": { + "path_match": "ipfix.collectorCertificate", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.exporterCertificate": { + "path_match": "ipfix.exporterCertificate", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.dataRecordsReliability": { + "path_match": "ipfix.dataRecordsReliability", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.observationPointType": { + "path_match": "ipfix.observationPointType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.newConnectionDeltaCount": { + "path_match": "ipfix.newConnectionDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.connectionSumDurationSeconds": { + "path_match": "ipfix.connectionSumDurationSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.connectionTransactionId": { + "path_match": "ipfix.connectionTransactionId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postNATSourceIPv6Address": { + "path_match": "ipfix.postNATSourceIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.postNATDestinationIPv6Address": { + "path_match": "ipfix.postNATDestinationIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.natPoolId": { + "path_match": "ipfix.natPoolId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.natPoolName": { + "path_match": "ipfix.natPoolName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.anonymizationFlags": { + "path_match": "ipfix.anonymizationFlags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.anonymizationTechnique": { + "path_match": "ipfix.anonymizationTechnique", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.informationElementIndex": { + "path_match": "ipfix.informationElementIndex", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.p2pTechnology": { + "path_match": "ipfix.p2pTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.tunnelTechnology": { + "path_match": "ipfix.tunnelTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.encryptedTechnology": { + "path_match": "ipfix.encryptedTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.bgpValidityState": { + "path_match": "ipfix.bgpValidityState", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.IPSecSPI": { + "path_match": "ipfix.IPSecSPI", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.greKey": { + "path_match": "ipfix.greKey", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.natType": { + "path_match": "ipfix.natType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.initiatorPackets": { + "path_match": "ipfix.initiatorPackets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.responderPackets": { + "path_match": "ipfix.responderPackets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.observationDomainName": { + "path_match": "ipfix.observationDomainName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.selectionSequenceId": { + "path_match": "ipfix.selectionSequenceId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.selectorId": { + "path_match": "ipfix.selectorId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.informationElementId": { + "path_match": "ipfix.informationElementId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.selectorAlgorithm": { + "path_match": "ipfix.selectorAlgorithm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingPacketInterval": { + "path_match": "ipfix.samplingPacketInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingPacketSpace": { + "path_match": "ipfix.samplingPacketSpace", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingTimeInterval": { + "path_match": "ipfix.samplingTimeInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingTimeSpace": { + "path_match": "ipfix.samplingTimeSpace", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingSize": { + "path_match": "ipfix.samplingSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingPopulation": { + "path_match": "ipfix.samplingPopulation", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingProbability": { + "path_match": "ipfix.samplingProbability", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.dataLinkFrameSize": { + "path_match": "ipfix.dataLinkFrameSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipHeaderPacketSection": { + "path_match": "ipfix.ipHeaderPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ipPayloadPacketSection": { + "path_match": "ipfix.ipPayloadPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.dataLinkFrameSection": { + "path_match": "ipfix.dataLinkFrameSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsLabelStackSection": { + "path_match": "ipfix.mplsLabelStackSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mplsPayloadPacketSection": { + "path_match": "ipfix.mplsPayloadPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.selectorIdTotalPktsObserved": { + "path_match": "ipfix.selectorIdTotalPktsObserved", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.selectorIdTotalPktsSelected": { + "path_match": "ipfix.selectorIdTotalPktsSelected", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.absoluteError": { + "path_match": "ipfix.absoluteError", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.relativeError": { + "path_match": "ipfix.relativeError", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.observationTimeSeconds": { + "path_match": "ipfix.observationTimeSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.observationTimeMilliseconds": { + "path_match": "ipfix.observationTimeMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.observationTimeMicroseconds": { + "path_match": "ipfix.observationTimeMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.observationTimeNanoseconds": { + "path_match": "ipfix.observationTimeNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.digestHashValue": { + "path_match": "ipfix.digestHashValue", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashIPPayloadOffset": { + "path_match": "ipfix.hashIPPayloadOffset", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashIPPayloadSize": { + "path_match": "ipfix.hashIPPayloadSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashOutputRangeMin": { + "path_match": "ipfix.hashOutputRangeMin", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashOutputRangeMax": { + "path_match": "ipfix.hashOutputRangeMax", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashSelectedRangeMin": { + "path_match": "ipfix.hashSelectedRangeMin", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashSelectedRangeMax": { + "path_match": "ipfix.hashSelectedRangeMax", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashDigestOutput": { + "path_match": "ipfix.hashDigestOutput", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashInitialiserValue": { + "path_match": "ipfix.hashInitialiserValue", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.selectorName": { + "path_match": "ipfix.selectorName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.upperCILimit": { + "path_match": "ipfix.upperCILimit", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.lowerCILimit": { + "path_match": "ipfix.lowerCILimit", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.confidenceLevel": { + "path_match": "ipfix.confidenceLevel", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.informationElementDataType": { + "path_match": "ipfix.informationElementDataType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.informationElementDescription": { + "path_match": "ipfix.informationElementDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.informationElementName": { + "path_match": "ipfix.informationElementName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.informationElementRangeBegin": { + "path_match": "ipfix.informationElementRangeBegin", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.informationElementRangeEnd": { + "path_match": "ipfix.informationElementRangeEnd", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.informationElementSemantics": { + "path_match": "ipfix.informationElementSemantics", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.informationElementUnits": { + "path_match": "ipfix.informationElementUnits", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.privateEnterpriseNumber": { + "path_match": "ipfix.privateEnterpriseNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.virtualStationInterfaceId": { + "path_match": "ipfix.virtualStationInterfaceId", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.virtualStationInterfaceName": { + "path_match": "ipfix.virtualStationInterfaceName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.virtualStationUUID": { + "path_match": "ipfix.virtualStationUUID", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.virtualStationName": { + "path_match": "ipfix.virtualStationName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.layer2SegmentId": { + "path_match": "ipfix.layer2SegmentId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2OctetDeltaCount": { + "path_match": "ipfix.layer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2OctetTotalCount": { + "path_match": "ipfix.layer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ingressUnicastPacketTotalCount": { + "path_match": "ipfix.ingressUnicastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ingressMulticastPacketTotalCount": { + "path_match": "ipfix.ingressMulticastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ingressBroadcastPacketTotalCount": { + "path_match": "ipfix.ingressBroadcastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.egressUnicastPacketTotalCount": { + "path_match": "ipfix.egressUnicastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.egressBroadcastPacketTotalCount": { + "path_match": "ipfix.egressBroadcastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.monitoringIntervalStartMilliSeconds": { + "path_match": "ipfix.monitoringIntervalStartMilliSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.monitoringIntervalEndMilliSeconds": { + "path_match": "ipfix.monitoringIntervalEndMilliSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.portRangeStart": { + "path_match": "ipfix.portRangeStart", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.portRangeEnd": { + "path_match": "ipfix.portRangeEnd", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.portRangeStepSize": { + "path_match": "ipfix.portRangeStepSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.portRangeNumPorts": { + "path_match": "ipfix.portRangeNumPorts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.staMacAddress": { + "path_match": "ipfix.staMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.staIPv4Address": { + "path_match": "ipfix.staIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.wtpMacAddress": { + "path_match": "ipfix.wtpMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ingressInterfaceType": { + "path_match": "ipfix.ingressInterfaceType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.egressInterfaceType": { + "path_match": "ipfix.egressInterfaceType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.rtpSequenceNumber": { + "path_match": "ipfix.rtpSequenceNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.userName": { + "path_match": "ipfix.userName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.applicationCategoryName": { + "path_match": "ipfix.applicationCategoryName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.applicationSubCategoryName": { + "path_match": "ipfix.applicationSubCategoryName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.applicationGroupName": { + "path_match": "ipfix.applicationGroupName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.originalFlowsPresent": { + "path_match": "ipfix.originalFlowsPresent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.originalFlowsInitiated": { + "path_match": "ipfix.originalFlowsInitiated", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.originalFlowsCompleted": { + "path_match": "ipfix.originalFlowsCompleted", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.distinctCountOfSourceIPAddress": { + "path_match": "ipfix.distinctCountOfSourceIPAddress", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.distinctCountOfDestinationIPAddress": { + "path_match": "ipfix.distinctCountOfDestinationIPAddress", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.distinctCountOfSourceIPv4Address": { + "path_match": "ipfix.distinctCountOfSourceIPv4Address", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.distinctCountOfDestinationIPv4Address": { + "path_match": "ipfix.distinctCountOfDestinationIPv4Address", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.distinctCountOfSourceIPv6Address": { + "path_match": "ipfix.distinctCountOfSourceIPv6Address", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.distinctCountOfDestinationIPv6Address": { + "path_match": "ipfix.distinctCountOfDestinationIPv6Address", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.valueDistributionMethod": { + "path_match": "ipfix.valueDistributionMethod", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.rfc3550JitterMilliseconds": { + "path_match": "ipfix.rfc3550JitterMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.rfc3550JitterMicroseconds": { + "path_match": "ipfix.rfc3550JitterMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.rfc3550JitterNanoseconds": { + "path_match": "ipfix.rfc3550JitterNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qDEI": { + "path_match": "ipfix.dot1qDEI", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qCustomerDEI": { + "path_match": "ipfix.dot1qCustomerDEI", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowSelectorAlgorithm": { + "path_match": "ipfix.flowSelectorAlgorithm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowSelectedOctetDeltaCount": { + "path_match": "ipfix.flowSelectedOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowSelectedPacketDeltaCount": { + "path_match": "ipfix.flowSelectedPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowSelectedFlowDeltaCount": { + "path_match": "ipfix.flowSelectedFlowDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.selectorIDTotalFlowsObserved": { + "path_match": "ipfix.selectorIDTotalFlowsObserved", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.selectorIDTotalFlowsSelected": { + "path_match": "ipfix.selectorIDTotalFlowsSelected", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingFlowInterval": { + "path_match": "ipfix.samplingFlowInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.samplingFlowSpacing": { + "path_match": "ipfix.samplingFlowSpacing", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowSamplingTimeInterval": { + "path_match": "ipfix.flowSamplingTimeInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.flowSamplingTimeSpacing": { + "path_match": "ipfix.flowSamplingTimeSpacing", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.hashFlowDomain": { + "path_match": "ipfix.hashFlowDomain", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.transportOctetDeltaCount": { + "path_match": "ipfix.transportOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.transportPacketDeltaCount": { + "path_match": "ipfix.transportPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.originalExporterIPv4Address": { + "path_match": "ipfix.originalExporterIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.originalExporterIPv6Address": { + "path_match": "ipfix.originalExporterIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.originalObservationDomainId": { + "path_match": "ipfix.originalObservationDomainId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.intermediateProcessId": { + "path_match": "ipfix.intermediateProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ignoredDataRecordTotalCount": { + "path_match": "ipfix.ignoredDataRecordTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dataLinkFrameType": { + "path_match": "ipfix.dataLinkFrameType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sectionOffset": { + "path_match": "ipfix.sectionOffset", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sectionExportedOctets": { + "path_match": "ipfix.sectionExportedOctets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qServiceInstanceTag": { + "path_match": "ipfix.dot1qServiceInstanceTag", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.dot1qServiceInstanceId": { + "path_match": "ipfix.dot1qServiceInstanceId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qServiceInstancePriority": { + "path_match": "ipfix.dot1qServiceInstancePriority", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.dot1qCustomerSourceMacAddress": { + "path_match": "ipfix.dot1qCustomerSourceMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.dot1qCustomerDestinationMacAddress": { + "path_match": "ipfix.dot1qCustomerDestinationMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.postLayer2OctetDeltaCount": { + "path_match": "ipfix.postLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postMCastLayer2OctetDeltaCount": { + "path_match": "ipfix.postMCastLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postLayer2OctetTotalCount": { + "path_match": "ipfix.postLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.postMCastLayer2OctetTotalCount": { + "path_match": "ipfix.postMCastLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.minimumLayer2TotalLength": { + "path_match": "ipfix.minimumLayer2TotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maximumLayer2TotalLength": { + "path_match": "ipfix.maximumLayer2TotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.droppedLayer2OctetDeltaCount": { + "path_match": "ipfix.droppedLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.droppedLayer2OctetTotalCount": { + "path_match": "ipfix.droppedLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ignoredLayer2OctetTotalCount": { + "path_match": "ipfix.ignoredLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.notSentLayer2OctetTotalCount": { + "path_match": "ipfix.notSentLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2OctetDeltaSumOfSquares": { + "path_match": "ipfix.layer2OctetDeltaSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2OctetTotalSumOfSquares": { + "path_match": "ipfix.layer2OctetTotalSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2FrameDeltaCount": { + "path_match": "ipfix.layer2FrameDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.layer2FrameTotalCount": { + "path_match": "ipfix.layer2FrameTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.pseudoWireDestinationIPv4Address": { + "path_match": "ipfix.pseudoWireDestinationIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ignoredLayer2FrameTotalCount": { + "path_match": "ipfix.ignoredLayer2FrameTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibObjectValueInteger": { + "path_match": "ipfix.mibObjectValueInteger", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibObjectValueOctetString": { + "path_match": "ipfix.mibObjectValueOctetString", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibObjectValueOID": { + "path_match": "ipfix.mibObjectValueOID", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibObjectValueBits": { + "path_match": "ipfix.mibObjectValueBits", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibObjectValueIPAddress": { + "path_match": "ipfix.mibObjectValueIPAddress", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.mibObjectValueCounter": { + "path_match": "ipfix.mibObjectValueCounter", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibObjectValueGauge": { + "path_match": "ipfix.mibObjectValueGauge", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibObjectValueTimeTicks": { + "path_match": "ipfix.mibObjectValueTimeTicks", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibObjectValueUnsigned": { + "path_match": "ipfix.mibObjectValueUnsigned", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibObjectValueTable": { + "path_match": "ipfix.mibObjectValueTable", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibObjectValueRow": { + "path_match": "ipfix.mibObjectValueRow", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibObjectIdentifier": { + "path_match": "ipfix.mibObjectIdentifier", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibSubIdentifier": { + "path_match": "ipfix.mibSubIdentifier", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibIndexIndicator": { + "path_match": "ipfix.mibIndexIndicator", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibCaptureTimeSemantics": { + "path_match": "ipfix.mibCaptureTimeSemantics", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.mibContextEngineID": { + "path_match": "ipfix.mibContextEngineID", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibContextName": { + "path_match": "ipfix.mibContextName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibObjectName": { + "path_match": "ipfix.mibObjectName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibObjectDescription": { + "path_match": "ipfix.mibObjectDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibObjectSyntax": { + "path_match": "ipfix.mibObjectSyntax", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mibModuleName": { + "path_match": "ipfix.mibModuleName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mobileIMSI": { + "path_match": "ipfix.mobileIMSI", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.mobileMSISDN": { + "path_match": "ipfix.mobileMSISDN", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.httpStatusCode": { + "path_match": "ipfix.httpStatusCode", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sourceTransportPortsLimit": { + "path_match": "ipfix.sourceTransportPortsLimit", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.httpRequestMethod": { + "path_match": "ipfix.httpRequestMethod", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.httpRequestHost": { + "path_match": "ipfix.httpRequestHost", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.httpRequestTarget": { + "path_match": "ipfix.httpRequestTarget", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.httpMessageVersion": { + "path_match": "ipfix.httpMessageVersion", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.natInstanceID": { + "path_match": "ipfix.natInstanceID", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.internalAddressRealm": { + "path_match": "ipfix.internalAddressRealm", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.externalAddressRealm": { + "path_match": "ipfix.externalAddressRealm", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.natQuotaExceededEvent": { + "path_match": "ipfix.natQuotaExceededEvent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.natThresholdEvent": { + "path_match": "ipfix.natThresholdEvent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.httpUserAgent": { + "path_match": "ipfix.httpUserAgent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.httpContentType": { + "path_match": "ipfix.httpContentType", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.httpReasonPhrase": { + "path_match": "ipfix.httpReasonPhrase", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.maxSessionEntries": { + "path_match": "ipfix.maxSessionEntries", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxBIBEntries": { + "path_match": "ipfix.maxBIBEntries", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxEntriesPerUser": { + "path_match": "ipfix.maxEntriesPerUser", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxSubscribers": { + "path_match": "ipfix.maxSubscribers", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.maxFragmentsPendingReassembly": { + "path_match": "ipfix.maxFragmentsPendingReassembly", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.addressPoolHighThreshold": { + "path_match": "ipfix.addressPoolHighThreshold", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.addressPoolLowThreshold": { + "path_match": "ipfix.addressPoolLowThreshold", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.addressPortMappingHighThreshold": { + "path_match": "ipfix.addressPortMappingHighThreshold", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.addressPortMappingLowThreshold": { + "path_match": "ipfix.addressPortMappingLowThreshold", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.addressPortMappingPerUserHighThreshold": { + "path_match": "ipfix.addressPortMappingPerUserHighThreshold", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.globalAddressMappingHighThreshold": { + "path_match": "ipfix.globalAddressMappingHighThreshold", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vpnIdentifier": { + "path_match": "ipfix.vpnIdentifier", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.reverseOctetDeltaCount": { - "path_match": "ipfix.reverseOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePacketDeltaCount": { - "path_match": "ipfix.reversePacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDeltaFlowCount": { - "path_match": "ipfix.reverseDeltaFlowCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseProtocolIdentifier": { - "path_match": "ipfix.reverseProtocolIdentifier", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpClassOfService": { - "path_match": "ipfix.reverseIpClassOfService", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpControlBits": { - "path_match": "ipfix.reverseTcpControlBits", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSourceTransportPort": { - "path_match": "ipfix.reverseSourceTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSourceIPv4Address": { - "path_match": "ipfix.reverseSourceIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseSourceIPv4PrefixLength": { - "path_match": "ipfix.reverseSourceIPv4PrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIngressInterface": { - "path_match": "ipfix.reverseIngressInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDestinationTransportPort": { - "path_match": "ipfix.reverseDestinationTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDestinationIPv4Address": { - "path_match": "ipfix.reverseDestinationIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseDestinationIPv4PrefixLength": { - "path_match": "ipfix.reverseDestinationIPv4PrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEgressInterface": { - "path_match": "ipfix.reverseEgressInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpNextHopIPv4Address": { - "path_match": "ipfix.reverseIpNextHopIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseBgpSourceAsNumber": { - "path_match": "ipfix.reverseBgpSourceAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseBgpDestinationAsNumber": { - "path_match": "ipfix.reverseBgpDestinationAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseBgpNextHopIPv4Address": { - "path_match": "ipfix.reverseBgpNextHopIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reversePostMCastPacketDeltaCount": { - "path_match": "ipfix.reversePostMCastPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostMCastOctetDeltaCount": { - "path_match": "ipfix.reversePostMCastOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowEndSysUpTime": { - "path_match": "ipfix.reverseFlowEndSysUpTime", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowStartSysUpTime": { - "path_match": "ipfix.reverseFlowStartSysUpTime", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostOctetDeltaCount": { - "path_match": "ipfix.reversePostOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostPacketDeltaCount": { - "path_match": "ipfix.reversePostPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMinimumIpTotalLength": { - "path_match": "ipfix.reverseMinimumIpTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMaximumIpTotalLength": { - "path_match": "ipfix.reverseMaximumIpTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSourceIPv6Address": { - "path_match": "ipfix.reverseSourceIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseDestinationIPv6Address": { - "path_match": "ipfix.reverseDestinationIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseSourceIPv6PrefixLength": { - "path_match": "ipfix.reverseSourceIPv6PrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDestinationIPv6PrefixLength": { - "path_match": "ipfix.reverseDestinationIPv6PrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowLabelIPv6": { - "path_match": "ipfix.reverseFlowLabelIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIcmpTypeCodeIPv4": { - "path_match": "ipfix.reverseIcmpTypeCodeIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIgmpType": { - "path_match": "ipfix.reverseIgmpType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingInterval": { - "path_match": "ipfix.reverseSamplingInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingAlgorithm": { - "path_match": "ipfix.reverseSamplingAlgorithm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowActiveTimeout": { - "path_match": "ipfix.reverseFlowActiveTimeout", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowIdleTimeout": { - "path_match": "ipfix.reverseFlowIdleTimeout", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEngineType": { - "path_match": "ipfix.reverseEngineType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEngineId": { - "path_match": "ipfix.reverseEngineId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpv4RouterSc": { - "path_match": "ipfix.reverseIpv4RouterSc", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseSourceIPv4Prefix": { - "path_match": "ipfix.reverseSourceIPv4Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseDestinationIPv4Prefix": { - "path_match": "ipfix.reverseDestinationIPv4Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseMplsTopLabelType": { - "path_match": "ipfix.reverseMplsTopLabelType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsTopLabelIPv4Address": { - "path_match": "ipfix.reverseMplsTopLabelIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseSamplerId": { - "path_match": "ipfix.reverseSamplerId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplerMode": { - "path_match": "ipfix.reverseSamplerMode", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplerRandomInterval": { - "path_match": "ipfix.reverseSamplerRandomInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseClassId": { - "path_match": "ipfix.reverseClassId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMinimumTTL": { - "path_match": "ipfix.reverseMinimumTTL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMaximumTTL": { - "path_match": "ipfix.reverseMaximumTTL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFragmentIdentification": { - "path_match": "ipfix.reverseFragmentIdentification", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostIpClassOfService": { - "path_match": "ipfix.reversePostIpClassOfService", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSourceMacAddress": { - "path_match": "ipfix.reverseSourceMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reversePostDestinationMacAddress": { - "path_match": "ipfix.reversePostDestinationMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseVlanId": { - "path_match": "ipfix.reverseVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostVlanId": { - "path_match": "ipfix.reversePostVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpVersion": { - "path_match": "ipfix.reverseIpVersion", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowDirection": { - "path_match": "ipfix.reverseFlowDirection", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpNextHopIPv6Address": { - "path_match": "ipfix.reverseIpNextHopIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseBgpNextHopIPv6Address": { - "path_match": "ipfix.reverseBgpNextHopIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseIpv6ExtensionHeaders": { - "path_match": "ipfix.reverseIpv6ExtensionHeaders", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsTopLabelStackSection": { - "path_match": "ipfix.reverseMplsTopLabelStackSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection2": { - "path_match": "ipfix.reverseMplsLabelStackSection2", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection3": { - "path_match": "ipfix.reverseMplsLabelStackSection3", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection4": { - "path_match": "ipfix.reverseMplsLabelStackSection4", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection5": { - "path_match": "ipfix.reverseMplsLabelStackSection5", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection6": { - "path_match": "ipfix.reverseMplsLabelStackSection6", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection7": { - "path_match": "ipfix.reverseMplsLabelStackSection7", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection8": { - "path_match": "ipfix.reverseMplsLabelStackSection8", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection9": { - "path_match": "ipfix.reverseMplsLabelStackSection9", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection10": { - "path_match": "ipfix.reverseMplsLabelStackSection10", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseDestinationMacAddress": { - "path_match": "ipfix.reverseDestinationMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reversePostSourceMacAddress": { - "path_match": "ipfix.reversePostSourceMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseInterfaceName": { - "path_match": "ipfix.reverseInterfaceName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseInterfaceDescription": { - "path_match": "ipfix.reverseInterfaceDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseSamplerName": { - "path_match": "ipfix.reverseSamplerName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseOctetTotalCount": { - "path_match": "ipfix.reverseOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePacketTotalCount": { - "path_match": "ipfix.reversePacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlagsAndSamplerId": { - "path_match": "ipfix.reverseFlagsAndSamplerId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFragmentOffset": { - "path_match": "ipfix.reverseFragmentOffset", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseForwardingStatus": { - "path_match": "ipfix.reverseForwardingStatus", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsVpnRouteDistinguisher": { - "path_match": "ipfix.reverseMplsVpnRouteDistinguisher", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsTopLabelPrefixLength": { - "path_match": "ipfix.reverseMplsTopLabelPrefixLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSrcTrafficIndex": { - "path_match": "ipfix.reverseSrcTrafficIndex", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDstTrafficIndex": { - "path_match": "ipfix.reverseDstTrafficIndex", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseApplicationDescription": { - "path_match": "ipfix.reverseApplicationDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseApplicationId": { - "path_match": "ipfix.reverseApplicationId", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseApplicationName": { - "path_match": "ipfix.reverseApplicationName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reversePostIpDiffServCodePoint": { - "path_match": "ipfix.reversePostIpDiffServCodePoint", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMulticastReplicationFactor": { - "path_match": "ipfix.reverseMulticastReplicationFactor", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseClassName": { - "path_match": "ipfix.reverseClassName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseClassificationEngineId": { - "path_match": "ipfix.reverseClassificationEngineId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2packetSectionOffset": { - "path_match": "ipfix.reverseLayer2packetSectionOffset", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2packetSectionSize": { - "path_match": "ipfix.reverseLayer2packetSectionSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2packetSectionData": { - "path_match": "ipfix.reverseLayer2packetSectionData", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseBgpNextAdjacentAsNumber": { - "path_match": "ipfix.reverseBgpNextAdjacentAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseBgpPrevAdjacentAsNumber": { - "path_match": "ipfix.reverseBgpPrevAdjacentAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDroppedOctetDeltaCount": { - "path_match": "ipfix.reverseDroppedOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDroppedPacketDeltaCount": { - "path_match": "ipfix.reverseDroppedPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDroppedPacketTotalCount": { - "path_match": "ipfix.reverseDroppedPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDroppedOctetTotalCount": { - "path_match": "ipfix.reverseDroppedOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowEndReason": { - "path_match": "ipfix.reverseFlowEndReason", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseObservationPointId": { - "path_match": "ipfix.reverseObservationPointId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIcmpTypeCodeIPv6": { - "path_match": "ipfix.reverseIcmpTypeCodeIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsTopLabelIPv6Address": { - "path_match": "ipfix.reverseMplsTopLabelIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseLineCardId": { - "path_match": "ipfix.reverseLineCardId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePortId": { - "path_match": "ipfix.reversePortId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMeteringProcessId": { - "path_match": "ipfix.reverseMeteringProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseExportingProcessId": { - "path_match": "ipfix.reverseExportingProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseWlanChannelId": { - "path_match": "ipfix.reverseWlanChannelId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseWlanSSID": { - "path_match": "ipfix.reverseWlanSSID", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseFlowStartSeconds": { - "path_match": "ipfix.reverseFlowStartSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowEndSeconds": { - "path_match": "ipfix.reverseFlowEndSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowStartMilliseconds": { - "path_match": "ipfix.reverseFlowStartMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowEndMilliseconds": { - "path_match": "ipfix.reverseFlowEndMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowStartMicroseconds": { - "path_match": "ipfix.reverseFlowStartMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowEndMicroseconds": { - "path_match": "ipfix.reverseFlowEndMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowStartNanoseconds": { - "path_match": "ipfix.reverseFlowStartNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowEndNanoseconds": { - "path_match": "ipfix.reverseFlowEndNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowStartDeltaMicroseconds": { - "path_match": "ipfix.reverseFlowStartDeltaMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowEndDeltaMicroseconds": { - "path_match": "ipfix.reverseFlowEndDeltaMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSystemInitTimeMilliseconds": { - "path_match": "ipfix.reverseSystemInitTimeMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowDurationMilliseconds": { - "path_match": "ipfix.reverseFlowDurationMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowDurationMicroseconds": { - "path_match": "ipfix.reverseFlowDurationMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDestinationIPv6Prefix": { - "path_match": "ipfix.reverseDestinationIPv6Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseSourceIPv6Prefix": { - "path_match": "ipfix.reverseSourceIPv6Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reversePostOctetTotalCount": { - "path_match": "ipfix.reversePostOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostPacketTotalCount": { - "path_match": "ipfix.reversePostPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostMCastPacketTotalCount": { - "path_match": "ipfix.reversePostMCastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostMCastOctetTotalCount": { - "path_match": "ipfix.reversePostMCastOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIcmpTypeIPv4": { - "path_match": "ipfix.reverseIcmpTypeIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIcmpCodeIPv4": { - "path_match": "ipfix.reverseIcmpCodeIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIcmpTypeIPv6": { - "path_match": "ipfix.reverseIcmpTypeIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIcmpCodeIPv6": { - "path_match": "ipfix.reverseIcmpCodeIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseUdpSourcePort": { - "path_match": "ipfix.reverseUdpSourcePort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseUdpDestinationPort": { - "path_match": "ipfix.reverseUdpDestinationPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpSourcePort": { - "path_match": "ipfix.reverseTcpSourcePort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpDestinationPort": { - "path_match": "ipfix.reverseTcpDestinationPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpSequenceNumber": { - "path_match": "ipfix.reverseTcpSequenceNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpAcknowledgementNumber": { - "path_match": "ipfix.reverseTcpAcknowledgementNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpWindowSize": { - "path_match": "ipfix.reverseTcpWindowSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpUrgentPointer": { - "path_match": "ipfix.reverseTcpUrgentPointer", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpHeaderLength": { - "path_match": "ipfix.reverseTcpHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpHeaderLength": { - "path_match": "ipfix.reverseIpHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTotalLengthIPv4": { - "path_match": "ipfix.reverseTotalLengthIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePayloadLengthIPv6": { - "path_match": "ipfix.reversePayloadLengthIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpTTL": { - "path_match": "ipfix.reverseIpTTL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseNextHeaderIPv6": { - "path_match": "ipfix.reverseNextHeaderIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsPayloadLength": { - "path_match": "ipfix.reverseMplsPayloadLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpDiffServCodePoint": { - "path_match": "ipfix.reverseIpDiffServCodePoint", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpPrecedence": { - "path_match": "ipfix.reverseIpPrecedence", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFragmentFlags": { - "path_match": "ipfix.reverseFragmentFlags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseOctetDeltaSumOfSquares": { - "path_match": "ipfix.reverseOctetDeltaSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseOctetTotalSumOfSquares": { - "path_match": "ipfix.reverseOctetTotalSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsTopLabelTTL": { - "path_match": "ipfix.reverseMplsTopLabelTTL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsLabelStackLength": { - "path_match": "ipfix.reverseMplsLabelStackLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsLabelStackDepth": { - "path_match": "ipfix.reverseMplsLabelStackDepth", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMplsTopLabelExp": { - "path_match": "ipfix.reverseMplsTopLabelExp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpPayloadLength": { - "path_match": "ipfix.reverseIpPayloadLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseUdpMessageLength": { - "path_match": "ipfix.reverseUdpMessageLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIsMulticast": { - "path_match": "ipfix.reverseIsMulticast", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpv4IHL": { - "path_match": "ipfix.reverseIpv4IHL", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpv4Options": { - "path_match": "ipfix.reverseIpv4Options", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpOptions": { - "path_match": "ipfix.reverseTcpOptions", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpSynTotalCount": { - "path_match": "ipfix.reverseTcpSynTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpFinTotalCount": { - "path_match": "ipfix.reverseTcpFinTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpRstTotalCount": { - "path_match": "ipfix.reverseTcpRstTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpPshTotalCount": { - "path_match": "ipfix.reverseTcpPshTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpAckTotalCount": { - "path_match": "ipfix.reverseTcpAckTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpUrgTotalCount": { - "path_match": "ipfix.reverseTcpUrgTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpTotalLength": { - "path_match": "ipfix.reverseIpTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostNATSourceIPv4Address": { - "path_match": "ipfix.reversePostNATSourceIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reversePostNATDestinationIPv4Address": { - "path_match": "ipfix.reversePostNATDestinationIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reversePostNAPTSourceTransportPort": { - "path_match": "ipfix.reversePostNAPTSourceTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostNAPTDestinationTransportPort": { - "path_match": "ipfix.reversePostNAPTDestinationTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseNatOriginatingAddressRealm": { - "path_match": "ipfix.reverseNatOriginatingAddressRealm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseNatEvent": { - "path_match": "ipfix.reverseNatEvent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseInitiatorOctets": { - "path_match": "ipfix.reverseInitiatorOctets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseResponderOctets": { - "path_match": "ipfix.reverseResponderOctets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFirewallEvent": { - "path_match": "ipfix.reverseFirewallEvent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIngressVRFID": { - "path_match": "ipfix.reverseIngressVRFID", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEgressVRFID": { - "path_match": "ipfix.reverseEgressVRFID", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseVRFname": { - "path_match": "ipfix.reverseVRFname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reversePostMplsTopLabelExp": { - "path_match": "ipfix.reversePostMplsTopLabelExp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTcpWindowScale": { - "path_match": "ipfix.reverseTcpWindowScale", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEthernetHeaderLength": { - "path_match": "ipfix.reverseEthernetHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEthernetPayloadLength": { - "path_match": "ipfix.reverseEthernetPayloadLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEthernetTotalLength": { - "path_match": "ipfix.reverseEthernetTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qVlanId": { - "path_match": "ipfix.reverseDot1qVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qPriority": { - "path_match": "ipfix.reverseDot1qPriority", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qCustomerVlanId": { - "path_match": "ipfix.reverseDot1qCustomerVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qCustomerPriority": { - "path_match": "ipfix.reverseDot1qCustomerPriority", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMetroEvcId": { - "path_match": "ipfix.reverseMetroEvcId", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMetroEvcType": { - "path_match": "ipfix.reverseMetroEvcType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePseudoWireId": { - "path_match": "ipfix.reversePseudoWireId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePseudoWireType": { - "path_match": "ipfix.reversePseudoWireType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePseudoWireControlWord": { - "path_match": "ipfix.reversePseudoWireControlWord", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIngressPhysicalInterface": { - "path_match": "ipfix.reverseIngressPhysicalInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEgressPhysicalInterface": { - "path_match": "ipfix.reverseEgressPhysicalInterface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostDot1qVlanId": { - "path_match": "ipfix.reversePostDot1qVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostDot1qCustomerVlanId": { - "path_match": "ipfix.reversePostDot1qCustomerVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEthernetType": { - "path_match": "ipfix.reverseEthernetType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostIpPrecedence": { - "path_match": "ipfix.reversePostIpPrecedence", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseCollectionTimeMilliseconds": { - "path_match": "ipfix.reverseCollectionTimeMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseExportSctpStreamId": { - "path_match": "ipfix.reverseExportSctpStreamId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMaxExportSeconds": { - "path_match": "ipfix.reverseMaxExportSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMaxFlowEndSeconds": { - "path_match": "ipfix.reverseMaxFlowEndSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMessageMD5Checksum": { - "path_match": "ipfix.reverseMessageMD5Checksum", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMessageScope": { - "path_match": "ipfix.reverseMessageScope", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMinExportSeconds": { - "path_match": "ipfix.reverseMinExportSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMinFlowStartSeconds": { - "path_match": "ipfix.reverseMinFlowStartSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseOpaqueOctets": { - "path_match": "ipfix.reverseOpaqueOctets", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseSessionScope": { - "path_match": "ipfix.reverseSessionScope", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMaxFlowEndMicroseconds": { - "path_match": "ipfix.reverseMaxFlowEndMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMaxFlowEndMilliseconds": { - "path_match": "ipfix.reverseMaxFlowEndMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMaxFlowEndNanoseconds": { - "path_match": "ipfix.reverseMaxFlowEndNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMinFlowStartMicroseconds": { - "path_match": "ipfix.reverseMinFlowStartMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMinFlowStartMilliseconds": { - "path_match": "ipfix.reverseMinFlowStartMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMinFlowStartNanoseconds": { - "path_match": "ipfix.reverseMinFlowStartNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseCollectorCertificate": { - "path_match": "ipfix.reverseCollectorCertificate", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseExporterCertificate": { - "path_match": "ipfix.reverseExporterCertificate", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseDataRecordsReliability": { - "path_match": "ipfix.reverseDataRecordsReliability", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseObservationPointType": { - "path_match": "ipfix.reverseObservationPointType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseNewConnectionDeltaCount": { - "path_match": "ipfix.reverseNewConnectionDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseConnectionSumDurationSeconds": { - "path_match": "ipfix.reverseConnectionSumDurationSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseConnectionTransactionId": { - "path_match": "ipfix.reverseConnectionTransactionId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostNATSourceIPv6Address": { - "path_match": "ipfix.reversePostNATSourceIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reversePostNATDestinationIPv6Address": { - "path_match": "ipfix.reversePostNATDestinationIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseNatPoolId": { - "path_match": "ipfix.reverseNatPoolId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseNatPoolName": { - "path_match": "ipfix.reverseNatPoolName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseAnonymizationFlags": { - "path_match": "ipfix.reverseAnonymizationFlags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseAnonymizationTechnique": { - "path_match": "ipfix.reverseAnonymizationTechnique", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseInformationElementIndex": { - "path_match": "ipfix.reverseInformationElementIndex", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseP2pTechnology": { - "path_match": "ipfix.reverseP2pTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseTunnelTechnology": { - "path_match": "ipfix.reverseTunnelTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseEncryptedTechnology": { - "path_match": "ipfix.reverseEncryptedTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseBgpValidityState": { - "path_match": "ipfix.reverseBgpValidityState", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIPSecSPI": { - "path_match": "ipfix.reverseIPSecSPI", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseGreKey": { - "path_match": "ipfix.reverseGreKey", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseNatType": { - "path_match": "ipfix.reverseNatType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseInitiatorPackets": { - "path_match": "ipfix.reverseInitiatorPackets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseResponderPackets": { - "path_match": "ipfix.reverseResponderPackets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseObservationDomainName": { - "path_match": "ipfix.reverseObservationDomainName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseSelectionSequenceId": { - "path_match": "ipfix.reverseSelectionSequenceId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSelectorId": { - "path_match": "ipfix.reverseSelectorId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseInformationElementId": { - "path_match": "ipfix.reverseInformationElementId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSelectorAlgorithm": { - "path_match": "ipfix.reverseSelectorAlgorithm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingPacketInterval": { - "path_match": "ipfix.reverseSamplingPacketInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingPacketSpace": { - "path_match": "ipfix.reverseSamplingPacketSpace", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingTimeInterval": { - "path_match": "ipfix.reverseSamplingTimeInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingTimeSpace": { - "path_match": "ipfix.reverseSamplingTimeSpace", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingSize": { - "path_match": "ipfix.reverseSamplingSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingPopulation": { - "path_match": "ipfix.reverseSamplingPopulation", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingProbability": { - "path_match": "ipfix.reverseSamplingProbability", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDataLinkFrameSize": { - "path_match": "ipfix.reverseDataLinkFrameSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIpHeaderPacketSection": { - "path_match": "ipfix.reverseIpHeaderPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseIpPayloadPacketSection": { - "path_match": "ipfix.reverseIpPayloadPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseDataLinkFrameSection": { - "path_match": "ipfix.reverseDataLinkFrameSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsLabelStackSection": { - "path_match": "ipfix.reverseMplsLabelStackSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseMplsPayloadPacketSection": { - "path_match": "ipfix.reverseMplsPayloadPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseSelectorIdTotalPktsObserved": { - "path_match": "ipfix.reverseSelectorIdTotalPktsObserved", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSelectorIdTotalPktsSelected": { - "path_match": "ipfix.reverseSelectorIdTotalPktsSelected", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseAbsoluteError": { - "path_match": "ipfix.reverseAbsoluteError", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.reverseRelativeError": { - "path_match": "ipfix.reverseRelativeError", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.reverseObservationTimeSeconds": { - "path_match": "ipfix.reverseObservationTimeSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseObservationTimeMilliseconds": { - "path_match": "ipfix.reverseObservationTimeMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseObservationTimeMicroseconds": { - "path_match": "ipfix.reverseObservationTimeMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseObservationTimeNanoseconds": { - "path_match": "ipfix.reverseObservationTimeNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDigestHashValue": { - "path_match": "ipfix.reverseDigestHashValue", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashIPPayloadOffset": { - "path_match": "ipfix.reverseHashIPPayloadOffset", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashIPPayloadSize": { - "path_match": "ipfix.reverseHashIPPayloadSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashOutputRangeMin": { - "path_match": "ipfix.reverseHashOutputRangeMin", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashOutputRangeMax": { - "path_match": "ipfix.reverseHashOutputRangeMax", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashSelectedRangeMin": { - "path_match": "ipfix.reverseHashSelectedRangeMin", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashSelectedRangeMax": { - "path_match": "ipfix.reverseHashSelectedRangeMax", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashDigestOutput": { - "path_match": "ipfix.reverseHashDigestOutput", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashInitialiserValue": { - "path_match": "ipfix.reverseHashInitialiserValue", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSelectorName": { - "path_match": "ipfix.reverseSelectorName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseUpperCILimit": { - "path_match": "ipfix.reverseUpperCILimit", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.reverseLowerCILimit": { - "path_match": "ipfix.reverseLowerCILimit", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.reverseConfidenceLevel": { - "path_match": "ipfix.reverseConfidenceLevel", - "mapping": { - "type": "double" - } - } - }, - { - "ipfix.reverseInformationElementDataType": { - "path_match": "ipfix.reverseInformationElementDataType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseInformationElementDescription": { - "path_match": "ipfix.reverseInformationElementDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseInformationElementName": { - "path_match": "ipfix.reverseInformationElementName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseInformationElementRangeBegin": { - "path_match": "ipfix.reverseInformationElementRangeBegin", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseInformationElementRangeEnd": { - "path_match": "ipfix.reverseInformationElementRangeEnd", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseInformationElementSemantics": { - "path_match": "ipfix.reverseInformationElementSemantics", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseInformationElementUnits": { - "path_match": "ipfix.reverseInformationElementUnits", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePrivateEnterpriseNumber": { - "path_match": "ipfix.reversePrivateEnterpriseNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseVirtualStationInterfaceId": { - "path_match": "ipfix.reverseVirtualStationInterfaceId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseVirtualStationInterfaceName": { - "path_match": "ipfix.reverseVirtualStationInterfaceName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseVirtualStationUUID": { - "path_match": "ipfix.reverseVirtualStationUUID", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseVirtualStationName": { - "path_match": "ipfix.reverseVirtualStationName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseLayer2SegmentId": { - "path_match": "ipfix.reverseLayer2SegmentId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2OctetDeltaCount": { - "path_match": "ipfix.reverseLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2OctetTotalCount": { - "path_match": "ipfix.reverseLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIngressUnicastPacketTotalCount": { - "path_match": "ipfix.reverseIngressUnicastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIngressMulticastPacketTotalCount": { - "path_match": "ipfix.reverseIngressMulticastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIngressBroadcastPacketTotalCount": { - "path_match": "ipfix.reverseIngressBroadcastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEgressUnicastPacketTotalCount": { - "path_match": "ipfix.reverseEgressUnicastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEgressBroadcastPacketTotalCount": { - "path_match": "ipfix.reverseEgressBroadcastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMonitoringIntervalStartMilliSeconds": { - "path_match": "ipfix.reverseMonitoringIntervalStartMilliSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMonitoringIntervalEndMilliSeconds": { - "path_match": "ipfix.reverseMonitoringIntervalEndMilliSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePortRangeStart": { - "path_match": "ipfix.reversePortRangeStart", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePortRangeEnd": { - "path_match": "ipfix.reversePortRangeEnd", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePortRangeStepSize": { - "path_match": "ipfix.reversePortRangeStepSize", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePortRangeNumPorts": { - "path_match": "ipfix.reversePortRangeNumPorts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseStaMacAddress": { - "path_match": "ipfix.reverseStaMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseStaIPv4Address": { - "path_match": "ipfix.reverseStaIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseWtpMacAddress": { - "path_match": "ipfix.reverseWtpMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseIngressInterfaceType": { - "path_match": "ipfix.reverseIngressInterfaceType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseEgressInterfaceType": { - "path_match": "ipfix.reverseEgressInterfaceType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseRtpSequenceNumber": { - "path_match": "ipfix.reverseRtpSequenceNumber", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseUserName": { - "path_match": "ipfix.reverseUserName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseApplicationCategoryName": { - "path_match": "ipfix.reverseApplicationCategoryName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseApplicationSubCategoryName": { - "path_match": "ipfix.reverseApplicationSubCategoryName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseApplicationGroupName": { - "path_match": "ipfix.reverseApplicationGroupName", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseOriginalFlowsPresent": { - "path_match": "ipfix.reverseOriginalFlowsPresent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseOriginalFlowsInitiated": { - "path_match": "ipfix.reverseOriginalFlowsInitiated", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseOriginalFlowsCompleted": { - "path_match": "ipfix.reverseOriginalFlowsCompleted", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDistinctCountOfSourceIPAddress": { - "path_match": "ipfix.reverseDistinctCountOfSourceIPAddress", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDistinctCountOfDestinationIPAddress": { - "path_match": "ipfix.reverseDistinctCountOfDestinationIPAddress", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDistinctCountOfSourceIPv4Address": { - "path_match": "ipfix.reverseDistinctCountOfSourceIPv4Address", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDistinctCountOfDestinationIPv4Address": { - "path_match": "ipfix.reverseDistinctCountOfDestinationIPv4Address", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDistinctCountOfSourceIPv6Address": { - "path_match": "ipfix.reverseDistinctCountOfSourceIPv6Address", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDistinctCountOfDestinationIPv6Address": { - "path_match": "ipfix.reverseDistinctCountOfDestinationIPv6Address", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseValueDistributionMethod": { - "path_match": "ipfix.reverseValueDistributionMethod", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseRfc3550JitterMilliseconds": { - "path_match": "ipfix.reverseRfc3550JitterMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseRfc3550JitterMicroseconds": { - "path_match": "ipfix.reverseRfc3550JitterMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseRfc3550JitterNanoseconds": { - "path_match": "ipfix.reverseRfc3550JitterNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qDEI": { - "path_match": "ipfix.reverseDot1qDEI", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qCustomerDEI": { - "path_match": "ipfix.reverseDot1qCustomerDEI", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowSelectorAlgorithm": { - "path_match": "ipfix.reverseFlowSelectorAlgorithm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowSelectedOctetDeltaCount": { - "path_match": "ipfix.reverseFlowSelectedOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowSelectedPacketDeltaCount": { - "path_match": "ipfix.reverseFlowSelectedPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowSelectedFlowDeltaCount": { - "path_match": "ipfix.reverseFlowSelectedFlowDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSelectorIDTotalFlowsObserved": { - "path_match": "ipfix.reverseSelectorIDTotalFlowsObserved", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSelectorIDTotalFlowsSelected": { - "path_match": "ipfix.reverseSelectorIDTotalFlowsSelected", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingFlowInterval": { - "path_match": "ipfix.reverseSamplingFlowInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSamplingFlowSpacing": { - "path_match": "ipfix.reverseSamplingFlowSpacing", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowSamplingTimeInterval": { - "path_match": "ipfix.reverseFlowSamplingTimeInterval", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseFlowSamplingTimeSpacing": { - "path_match": "ipfix.reverseFlowSamplingTimeSpacing", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseHashFlowDomain": { - "path_match": "ipfix.reverseHashFlowDomain", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTransportOctetDeltaCount": { - "path_match": "ipfix.reverseTransportOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseTransportPacketDeltaCount": { - "path_match": "ipfix.reverseTransportPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseOriginalExporterIPv4Address": { - "path_match": "ipfix.reverseOriginalExporterIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseOriginalExporterIPv6Address": { - "path_match": "ipfix.reverseOriginalExporterIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseOriginalObservationDomainId": { - "path_match": "ipfix.reverseOriginalObservationDomainId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIntermediateProcessId": { - "path_match": "ipfix.reverseIntermediateProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIgnoredDataRecordTotalCount": { - "path_match": "ipfix.reverseIgnoredDataRecordTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDataLinkFrameType": { - "path_match": "ipfix.reverseDataLinkFrameType", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSectionOffset": { - "path_match": "ipfix.reverseSectionOffset", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseSectionExportedOctets": { - "path_match": "ipfix.reverseSectionExportedOctets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qServiceInstanceTag": { - "path_match": "ipfix.reverseDot1qServiceInstanceTag", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseDot1qServiceInstanceId": { - "path_match": "ipfix.reverseDot1qServiceInstanceId", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qServiceInstancePriority": { - "path_match": "ipfix.reverseDot1qServiceInstancePriority", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDot1qCustomerSourceMacAddress": { - "path_match": "ipfix.reverseDot1qCustomerSourceMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reverseDot1qCustomerDestinationMacAddress": { - "path_match": "ipfix.reverseDot1qCustomerDestinationMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.reversePostLayer2OctetDeltaCount": { - "path_match": "ipfix.reversePostLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostMCastLayer2OctetDeltaCount": { - "path_match": "ipfix.reversePostMCastLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePostLayer2OctetTotalCount": { - "path_match": "ipfix.reversePostLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - - { - "ipfix.reversePostMCastLayer2OctetTotalCount": { - "path_match": "ipfix.reversePostMCastLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMinimumLayer2TotalLength": { - "path_match": "ipfix.reverseMinimumLayer2TotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseMaximumLayer2TotalLength": { - "path_match": "ipfix.reverseMaximumLayer2TotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDroppedLayer2OctetDeltaCount": { - "path_match": "ipfix.reverseDroppedLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseDroppedLayer2OctetTotalCount": { - "path_match": "ipfix.reverseDroppedLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseIgnoredLayer2OctetTotalCount": { - "path_match": "ipfix.reverseIgnoredLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseNotSentLayer2OctetTotalCount": { - "path_match": "ipfix.reverseNotSentLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2OctetDeltaSumOfSquares": { - "path_match": "ipfix.reverseLayer2OctetDeltaSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2OctetTotalSumOfSquares": { - "path_match": "ipfix.reverseLayer2OctetTotalSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2FrameDeltaCount": { - "path_match": "ipfix.reverseLayer2FrameDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reverseLayer2FrameTotalCount": { - "path_match": "ipfix.reverseLayer2FrameTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.reversePseudoWireDestinationIPv4Address": { - "path_match": "ipfix.reversePseudoWireDestinationIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.reverseIgnoredLayer2FrameTotalCount": { - "path_match": "ipfix.reverseIgnoredLayer2FrameTotalCount", - "mapping": { - "type": "long" - } - } - }, - + { + "ipfix.reverseOctetDeltaCount": { + "path_match": "ipfix.reverseOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePacketDeltaCount": { + "path_match": "ipfix.reversePacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDeltaFlowCount": { + "path_match": "ipfix.reverseDeltaFlowCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseProtocolIdentifier": { + "path_match": "ipfix.reverseProtocolIdentifier", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpClassOfService": { + "path_match": "ipfix.reverseIpClassOfService", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpControlBits": { + "path_match": "ipfix.reverseTcpControlBits", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSourceTransportPort": { + "path_match": "ipfix.reverseSourceTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSourceIPv4Address": { + "path_match": "ipfix.reverseSourceIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseSourceIPv4PrefixLength": { + "path_match": "ipfix.reverseSourceIPv4PrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIngressInterface": { + "path_match": "ipfix.reverseIngressInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDestinationTransportPort": { + "path_match": "ipfix.reverseDestinationTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDestinationIPv4Address": { + "path_match": "ipfix.reverseDestinationIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseDestinationIPv4PrefixLength": { + "path_match": "ipfix.reverseDestinationIPv4PrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEgressInterface": { + "path_match": "ipfix.reverseEgressInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpNextHopIPv4Address": { + "path_match": "ipfix.reverseIpNextHopIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseBgpSourceAsNumber": { + "path_match": "ipfix.reverseBgpSourceAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseBgpDestinationAsNumber": { + "path_match": "ipfix.reverseBgpDestinationAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseBgpNextHopIPv4Address": { + "path_match": "ipfix.reverseBgpNextHopIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reversePostMCastPacketDeltaCount": { + "path_match": "ipfix.reversePostMCastPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostMCastOctetDeltaCount": { + "path_match": "ipfix.reversePostMCastOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowEndSysUpTime": { + "path_match": "ipfix.reverseFlowEndSysUpTime", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowStartSysUpTime": { + "path_match": "ipfix.reverseFlowStartSysUpTime", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostOctetDeltaCount": { + "path_match": "ipfix.reversePostOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostPacketDeltaCount": { + "path_match": "ipfix.reversePostPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMinimumIpTotalLength": { + "path_match": "ipfix.reverseMinimumIpTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMaximumIpTotalLength": { + "path_match": "ipfix.reverseMaximumIpTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSourceIPv6Address": { + "path_match": "ipfix.reverseSourceIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseDestinationIPv6Address": { + "path_match": "ipfix.reverseDestinationIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseSourceIPv6PrefixLength": { + "path_match": "ipfix.reverseSourceIPv6PrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDestinationIPv6PrefixLength": { + "path_match": "ipfix.reverseDestinationIPv6PrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowLabelIPv6": { + "path_match": "ipfix.reverseFlowLabelIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIcmpTypeCodeIPv4": { + "path_match": "ipfix.reverseIcmpTypeCodeIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIgmpType": { + "path_match": "ipfix.reverseIgmpType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingInterval": { + "path_match": "ipfix.reverseSamplingInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingAlgorithm": { + "path_match": "ipfix.reverseSamplingAlgorithm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowActiveTimeout": { + "path_match": "ipfix.reverseFlowActiveTimeout", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowIdleTimeout": { + "path_match": "ipfix.reverseFlowIdleTimeout", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEngineType": { + "path_match": "ipfix.reverseEngineType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEngineId": { + "path_match": "ipfix.reverseEngineId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpv4RouterSc": { + "path_match": "ipfix.reverseIpv4RouterSc", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseSourceIPv4Prefix": { + "path_match": "ipfix.reverseSourceIPv4Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseDestinationIPv4Prefix": { + "path_match": "ipfix.reverseDestinationIPv4Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseMplsTopLabelType": { + "path_match": "ipfix.reverseMplsTopLabelType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsTopLabelIPv4Address": { + "path_match": "ipfix.reverseMplsTopLabelIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseSamplerId": { + "path_match": "ipfix.reverseSamplerId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplerMode": { + "path_match": "ipfix.reverseSamplerMode", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplerRandomInterval": { + "path_match": "ipfix.reverseSamplerRandomInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseClassId": { + "path_match": "ipfix.reverseClassId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMinimumTTL": { + "path_match": "ipfix.reverseMinimumTTL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMaximumTTL": { + "path_match": "ipfix.reverseMaximumTTL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFragmentIdentification": { + "path_match": "ipfix.reverseFragmentIdentification", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostIpClassOfService": { + "path_match": "ipfix.reversePostIpClassOfService", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSourceMacAddress": { + "path_match": "ipfix.reverseSourceMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reversePostDestinationMacAddress": { + "path_match": "ipfix.reversePostDestinationMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseVlanId": { + "path_match": "ipfix.reverseVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostVlanId": { + "path_match": "ipfix.reversePostVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpVersion": { + "path_match": "ipfix.reverseIpVersion", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowDirection": { + "path_match": "ipfix.reverseFlowDirection", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpNextHopIPv6Address": { + "path_match": "ipfix.reverseIpNextHopIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseBgpNextHopIPv6Address": { + "path_match": "ipfix.reverseBgpNextHopIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseIpv6ExtensionHeaders": { + "path_match": "ipfix.reverseIpv6ExtensionHeaders", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsTopLabelStackSection": { + "path_match": "ipfix.reverseMplsTopLabelStackSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection2": { + "path_match": "ipfix.reverseMplsLabelStackSection2", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection3": { + "path_match": "ipfix.reverseMplsLabelStackSection3", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection4": { + "path_match": "ipfix.reverseMplsLabelStackSection4", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection5": { + "path_match": "ipfix.reverseMplsLabelStackSection5", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection6": { + "path_match": "ipfix.reverseMplsLabelStackSection6", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection7": { + "path_match": "ipfix.reverseMplsLabelStackSection7", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection8": { + "path_match": "ipfix.reverseMplsLabelStackSection8", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection9": { + "path_match": "ipfix.reverseMplsLabelStackSection9", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection10": { + "path_match": "ipfix.reverseMplsLabelStackSection10", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseDestinationMacAddress": { + "path_match": "ipfix.reverseDestinationMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reversePostSourceMacAddress": { + "path_match": "ipfix.reversePostSourceMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseInterfaceName": { + "path_match": "ipfix.reverseInterfaceName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseInterfaceDescription": { + "path_match": "ipfix.reverseInterfaceDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseSamplerName": { + "path_match": "ipfix.reverseSamplerName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseOctetTotalCount": { + "path_match": "ipfix.reverseOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePacketTotalCount": { + "path_match": "ipfix.reversePacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlagsAndSamplerId": { + "path_match": "ipfix.reverseFlagsAndSamplerId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFragmentOffset": { + "path_match": "ipfix.reverseFragmentOffset", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseForwardingStatus": { + "path_match": "ipfix.reverseForwardingStatus", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsVpnRouteDistinguisher": { + "path_match": "ipfix.reverseMplsVpnRouteDistinguisher", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsTopLabelPrefixLength": { + "path_match": "ipfix.reverseMplsTopLabelPrefixLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSrcTrafficIndex": { + "path_match": "ipfix.reverseSrcTrafficIndex", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDstTrafficIndex": { + "path_match": "ipfix.reverseDstTrafficIndex", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseApplicationDescription": { + "path_match": "ipfix.reverseApplicationDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseApplicationId": { + "path_match": "ipfix.reverseApplicationId", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseApplicationName": { + "path_match": "ipfix.reverseApplicationName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reversePostIpDiffServCodePoint": { + "path_match": "ipfix.reversePostIpDiffServCodePoint", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMulticastReplicationFactor": { + "path_match": "ipfix.reverseMulticastReplicationFactor", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseClassName": { + "path_match": "ipfix.reverseClassName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseClassificationEngineId": { + "path_match": "ipfix.reverseClassificationEngineId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2packetSectionOffset": { + "path_match": "ipfix.reverseLayer2packetSectionOffset", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2packetSectionSize": { + "path_match": "ipfix.reverseLayer2packetSectionSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2packetSectionData": { + "path_match": "ipfix.reverseLayer2packetSectionData", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseBgpNextAdjacentAsNumber": { + "path_match": "ipfix.reverseBgpNextAdjacentAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseBgpPrevAdjacentAsNumber": { + "path_match": "ipfix.reverseBgpPrevAdjacentAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDroppedOctetDeltaCount": { + "path_match": "ipfix.reverseDroppedOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDroppedPacketDeltaCount": { + "path_match": "ipfix.reverseDroppedPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDroppedPacketTotalCount": { + "path_match": "ipfix.reverseDroppedPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDroppedOctetTotalCount": { + "path_match": "ipfix.reverseDroppedOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowEndReason": { + "path_match": "ipfix.reverseFlowEndReason", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseObservationPointId": { + "path_match": "ipfix.reverseObservationPointId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIcmpTypeCodeIPv6": { + "path_match": "ipfix.reverseIcmpTypeCodeIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsTopLabelIPv6Address": { + "path_match": "ipfix.reverseMplsTopLabelIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseLineCardId": { + "path_match": "ipfix.reverseLineCardId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePortId": { + "path_match": "ipfix.reversePortId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMeteringProcessId": { + "path_match": "ipfix.reverseMeteringProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseExportingProcessId": { + "path_match": "ipfix.reverseExportingProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseWlanChannelId": { + "path_match": "ipfix.reverseWlanChannelId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseWlanSSID": { + "path_match": "ipfix.reverseWlanSSID", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseFlowStartSeconds": { + "path_match": "ipfix.reverseFlowStartSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowEndSeconds": { + "path_match": "ipfix.reverseFlowEndSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowStartMilliseconds": { + "path_match": "ipfix.reverseFlowStartMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowEndMilliseconds": { + "path_match": "ipfix.reverseFlowEndMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowStartMicroseconds": { + "path_match": "ipfix.reverseFlowStartMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowEndMicroseconds": { + "path_match": "ipfix.reverseFlowEndMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowStartNanoseconds": { + "path_match": "ipfix.reverseFlowStartNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowEndNanoseconds": { + "path_match": "ipfix.reverseFlowEndNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowStartDeltaMicroseconds": { + "path_match": "ipfix.reverseFlowStartDeltaMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowEndDeltaMicroseconds": { + "path_match": "ipfix.reverseFlowEndDeltaMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSystemInitTimeMilliseconds": { + "path_match": "ipfix.reverseSystemInitTimeMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowDurationMilliseconds": { + "path_match": "ipfix.reverseFlowDurationMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowDurationMicroseconds": { + "path_match": "ipfix.reverseFlowDurationMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDestinationIPv6Prefix": { + "path_match": "ipfix.reverseDestinationIPv6Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseSourceIPv6Prefix": { + "path_match": "ipfix.reverseSourceIPv6Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reversePostOctetTotalCount": { + "path_match": "ipfix.reversePostOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostPacketTotalCount": { + "path_match": "ipfix.reversePostPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostMCastPacketTotalCount": { + "path_match": "ipfix.reversePostMCastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostMCastOctetTotalCount": { + "path_match": "ipfix.reversePostMCastOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIcmpTypeIPv4": { + "path_match": "ipfix.reverseIcmpTypeIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIcmpCodeIPv4": { + "path_match": "ipfix.reverseIcmpCodeIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIcmpTypeIPv6": { + "path_match": "ipfix.reverseIcmpTypeIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIcmpCodeIPv6": { + "path_match": "ipfix.reverseIcmpCodeIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseUdpSourcePort": { + "path_match": "ipfix.reverseUdpSourcePort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseUdpDestinationPort": { + "path_match": "ipfix.reverseUdpDestinationPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpSourcePort": { + "path_match": "ipfix.reverseTcpSourcePort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpDestinationPort": { + "path_match": "ipfix.reverseTcpDestinationPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpSequenceNumber": { + "path_match": "ipfix.reverseTcpSequenceNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpAcknowledgementNumber": { + "path_match": "ipfix.reverseTcpAcknowledgementNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpWindowSize": { + "path_match": "ipfix.reverseTcpWindowSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpUrgentPointer": { + "path_match": "ipfix.reverseTcpUrgentPointer", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpHeaderLength": { + "path_match": "ipfix.reverseTcpHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpHeaderLength": { + "path_match": "ipfix.reverseIpHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTotalLengthIPv4": { + "path_match": "ipfix.reverseTotalLengthIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePayloadLengthIPv6": { + "path_match": "ipfix.reversePayloadLengthIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpTTL": { + "path_match": "ipfix.reverseIpTTL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseNextHeaderIPv6": { + "path_match": "ipfix.reverseNextHeaderIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsPayloadLength": { + "path_match": "ipfix.reverseMplsPayloadLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpDiffServCodePoint": { + "path_match": "ipfix.reverseIpDiffServCodePoint", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpPrecedence": { + "path_match": "ipfix.reverseIpPrecedence", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFragmentFlags": { + "path_match": "ipfix.reverseFragmentFlags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseOctetDeltaSumOfSquares": { + "path_match": "ipfix.reverseOctetDeltaSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseOctetTotalSumOfSquares": { + "path_match": "ipfix.reverseOctetTotalSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsTopLabelTTL": { + "path_match": "ipfix.reverseMplsTopLabelTTL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsLabelStackLength": { + "path_match": "ipfix.reverseMplsLabelStackLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsLabelStackDepth": { + "path_match": "ipfix.reverseMplsLabelStackDepth", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMplsTopLabelExp": { + "path_match": "ipfix.reverseMplsTopLabelExp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpPayloadLength": { + "path_match": "ipfix.reverseIpPayloadLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseUdpMessageLength": { + "path_match": "ipfix.reverseUdpMessageLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIsMulticast": { + "path_match": "ipfix.reverseIsMulticast", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpv4IHL": { + "path_match": "ipfix.reverseIpv4IHL", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpv4Options": { + "path_match": "ipfix.reverseIpv4Options", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpOptions": { + "path_match": "ipfix.reverseTcpOptions", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpSynTotalCount": { + "path_match": "ipfix.reverseTcpSynTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpFinTotalCount": { + "path_match": "ipfix.reverseTcpFinTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpRstTotalCount": { + "path_match": "ipfix.reverseTcpRstTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpPshTotalCount": { + "path_match": "ipfix.reverseTcpPshTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpAckTotalCount": { + "path_match": "ipfix.reverseTcpAckTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpUrgTotalCount": { + "path_match": "ipfix.reverseTcpUrgTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpTotalLength": { + "path_match": "ipfix.reverseIpTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostNATSourceIPv4Address": { + "path_match": "ipfix.reversePostNATSourceIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reversePostNATDestinationIPv4Address": { + "path_match": "ipfix.reversePostNATDestinationIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reversePostNAPTSourceTransportPort": { + "path_match": "ipfix.reversePostNAPTSourceTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostNAPTDestinationTransportPort": { + "path_match": "ipfix.reversePostNAPTDestinationTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseNatOriginatingAddressRealm": { + "path_match": "ipfix.reverseNatOriginatingAddressRealm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseNatEvent": { + "path_match": "ipfix.reverseNatEvent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseInitiatorOctets": { + "path_match": "ipfix.reverseInitiatorOctets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseResponderOctets": { + "path_match": "ipfix.reverseResponderOctets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFirewallEvent": { + "path_match": "ipfix.reverseFirewallEvent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIngressVRFID": { + "path_match": "ipfix.reverseIngressVRFID", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEgressVRFID": { + "path_match": "ipfix.reverseEgressVRFID", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseVRFname": { + "path_match": "ipfix.reverseVRFname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reversePostMplsTopLabelExp": { + "path_match": "ipfix.reversePostMplsTopLabelExp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTcpWindowScale": { + "path_match": "ipfix.reverseTcpWindowScale", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEthernetHeaderLength": { + "path_match": "ipfix.reverseEthernetHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEthernetPayloadLength": { + "path_match": "ipfix.reverseEthernetPayloadLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEthernetTotalLength": { + "path_match": "ipfix.reverseEthernetTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qVlanId": { + "path_match": "ipfix.reverseDot1qVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qPriority": { + "path_match": "ipfix.reverseDot1qPriority", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qCustomerVlanId": { + "path_match": "ipfix.reverseDot1qCustomerVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qCustomerPriority": { + "path_match": "ipfix.reverseDot1qCustomerPriority", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMetroEvcId": { + "path_match": "ipfix.reverseMetroEvcId", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMetroEvcType": { + "path_match": "ipfix.reverseMetroEvcType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePseudoWireId": { + "path_match": "ipfix.reversePseudoWireId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePseudoWireType": { + "path_match": "ipfix.reversePseudoWireType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePseudoWireControlWord": { + "path_match": "ipfix.reversePseudoWireControlWord", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIngressPhysicalInterface": { + "path_match": "ipfix.reverseIngressPhysicalInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEgressPhysicalInterface": { + "path_match": "ipfix.reverseEgressPhysicalInterface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostDot1qVlanId": { + "path_match": "ipfix.reversePostDot1qVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostDot1qCustomerVlanId": { + "path_match": "ipfix.reversePostDot1qCustomerVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEthernetType": { + "path_match": "ipfix.reverseEthernetType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostIpPrecedence": { + "path_match": "ipfix.reversePostIpPrecedence", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseCollectionTimeMilliseconds": { + "path_match": "ipfix.reverseCollectionTimeMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseExportSctpStreamId": { + "path_match": "ipfix.reverseExportSctpStreamId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMaxExportSeconds": { + "path_match": "ipfix.reverseMaxExportSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMaxFlowEndSeconds": { + "path_match": "ipfix.reverseMaxFlowEndSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMessageMD5Checksum": { + "path_match": "ipfix.reverseMessageMD5Checksum", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMessageScope": { + "path_match": "ipfix.reverseMessageScope", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMinExportSeconds": { + "path_match": "ipfix.reverseMinExportSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMinFlowStartSeconds": { + "path_match": "ipfix.reverseMinFlowStartSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseOpaqueOctets": { + "path_match": "ipfix.reverseOpaqueOctets", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseSessionScope": { + "path_match": "ipfix.reverseSessionScope", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMaxFlowEndMicroseconds": { + "path_match": "ipfix.reverseMaxFlowEndMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMaxFlowEndMilliseconds": { + "path_match": "ipfix.reverseMaxFlowEndMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMaxFlowEndNanoseconds": { + "path_match": "ipfix.reverseMaxFlowEndNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMinFlowStartMicroseconds": { + "path_match": "ipfix.reverseMinFlowStartMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMinFlowStartMilliseconds": { + "path_match": "ipfix.reverseMinFlowStartMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMinFlowStartNanoseconds": { + "path_match": "ipfix.reverseMinFlowStartNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseCollectorCertificate": { + "path_match": "ipfix.reverseCollectorCertificate", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseExporterCertificate": { + "path_match": "ipfix.reverseExporterCertificate", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseDataRecordsReliability": { + "path_match": "ipfix.reverseDataRecordsReliability", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseObservationPointType": { + "path_match": "ipfix.reverseObservationPointType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseNewConnectionDeltaCount": { + "path_match": "ipfix.reverseNewConnectionDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseConnectionSumDurationSeconds": { + "path_match": "ipfix.reverseConnectionSumDurationSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseConnectionTransactionId": { + "path_match": "ipfix.reverseConnectionTransactionId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostNATSourceIPv6Address": { + "path_match": "ipfix.reversePostNATSourceIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reversePostNATDestinationIPv6Address": { + "path_match": "ipfix.reversePostNATDestinationIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseNatPoolId": { + "path_match": "ipfix.reverseNatPoolId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseNatPoolName": { + "path_match": "ipfix.reverseNatPoolName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseAnonymizationFlags": { + "path_match": "ipfix.reverseAnonymizationFlags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseAnonymizationTechnique": { + "path_match": "ipfix.reverseAnonymizationTechnique", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseInformationElementIndex": { + "path_match": "ipfix.reverseInformationElementIndex", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseP2pTechnology": { + "path_match": "ipfix.reverseP2pTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseTunnelTechnology": { + "path_match": "ipfix.reverseTunnelTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseEncryptedTechnology": { + "path_match": "ipfix.reverseEncryptedTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseBgpValidityState": { + "path_match": "ipfix.reverseBgpValidityState", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIPSecSPI": { + "path_match": "ipfix.reverseIPSecSPI", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseGreKey": { + "path_match": "ipfix.reverseGreKey", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseNatType": { + "path_match": "ipfix.reverseNatType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseInitiatorPackets": { + "path_match": "ipfix.reverseInitiatorPackets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseResponderPackets": { + "path_match": "ipfix.reverseResponderPackets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseObservationDomainName": { + "path_match": "ipfix.reverseObservationDomainName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseSelectionSequenceId": { + "path_match": "ipfix.reverseSelectionSequenceId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSelectorId": { + "path_match": "ipfix.reverseSelectorId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseInformationElementId": { + "path_match": "ipfix.reverseInformationElementId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSelectorAlgorithm": { + "path_match": "ipfix.reverseSelectorAlgorithm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingPacketInterval": { + "path_match": "ipfix.reverseSamplingPacketInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingPacketSpace": { + "path_match": "ipfix.reverseSamplingPacketSpace", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingTimeInterval": { + "path_match": "ipfix.reverseSamplingTimeInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingTimeSpace": { + "path_match": "ipfix.reverseSamplingTimeSpace", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingSize": { + "path_match": "ipfix.reverseSamplingSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingPopulation": { + "path_match": "ipfix.reverseSamplingPopulation", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingProbability": { + "path_match": "ipfix.reverseSamplingProbability", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDataLinkFrameSize": { + "path_match": "ipfix.reverseDataLinkFrameSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIpHeaderPacketSection": { + "path_match": "ipfix.reverseIpHeaderPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseIpPayloadPacketSection": { + "path_match": "ipfix.reverseIpPayloadPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseDataLinkFrameSection": { + "path_match": "ipfix.reverseDataLinkFrameSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsLabelStackSection": { + "path_match": "ipfix.reverseMplsLabelStackSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseMplsPayloadPacketSection": { + "path_match": "ipfix.reverseMplsPayloadPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseSelectorIdTotalPktsObserved": { + "path_match": "ipfix.reverseSelectorIdTotalPktsObserved", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSelectorIdTotalPktsSelected": { + "path_match": "ipfix.reverseSelectorIdTotalPktsSelected", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseAbsoluteError": { + "path_match": "ipfix.reverseAbsoluteError", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.reverseRelativeError": { + "path_match": "ipfix.reverseRelativeError", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.reverseObservationTimeSeconds": { + "path_match": "ipfix.reverseObservationTimeSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseObservationTimeMilliseconds": { + "path_match": "ipfix.reverseObservationTimeMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseObservationTimeMicroseconds": { + "path_match": "ipfix.reverseObservationTimeMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseObservationTimeNanoseconds": { + "path_match": "ipfix.reverseObservationTimeNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDigestHashValue": { + "path_match": "ipfix.reverseDigestHashValue", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashIPPayloadOffset": { + "path_match": "ipfix.reverseHashIPPayloadOffset", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashIPPayloadSize": { + "path_match": "ipfix.reverseHashIPPayloadSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashOutputRangeMin": { + "path_match": "ipfix.reverseHashOutputRangeMin", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashOutputRangeMax": { + "path_match": "ipfix.reverseHashOutputRangeMax", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashSelectedRangeMin": { + "path_match": "ipfix.reverseHashSelectedRangeMin", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashSelectedRangeMax": { + "path_match": "ipfix.reverseHashSelectedRangeMax", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashDigestOutput": { + "path_match": "ipfix.reverseHashDigestOutput", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashInitialiserValue": { + "path_match": "ipfix.reverseHashInitialiserValue", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSelectorName": { + "path_match": "ipfix.reverseSelectorName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseUpperCILimit": { + "path_match": "ipfix.reverseUpperCILimit", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.reverseLowerCILimit": { + "path_match": "ipfix.reverseLowerCILimit", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.reverseConfidenceLevel": { + "path_match": "ipfix.reverseConfidenceLevel", + "mapping": { + "type": "double" + } + } + }, + { + "ipfix.reverseInformationElementDataType": { + "path_match": "ipfix.reverseInformationElementDataType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseInformationElementDescription": { + "path_match": "ipfix.reverseInformationElementDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseInformationElementName": { + "path_match": "ipfix.reverseInformationElementName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseInformationElementRangeBegin": { + "path_match": "ipfix.reverseInformationElementRangeBegin", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseInformationElementRangeEnd": { + "path_match": "ipfix.reverseInformationElementRangeEnd", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseInformationElementSemantics": { + "path_match": "ipfix.reverseInformationElementSemantics", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseInformationElementUnits": { + "path_match": "ipfix.reverseInformationElementUnits", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePrivateEnterpriseNumber": { + "path_match": "ipfix.reversePrivateEnterpriseNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseVirtualStationInterfaceId": { + "path_match": "ipfix.reverseVirtualStationInterfaceId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseVirtualStationInterfaceName": { + "path_match": "ipfix.reverseVirtualStationInterfaceName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseVirtualStationUUID": { + "path_match": "ipfix.reverseVirtualStationUUID", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseVirtualStationName": { + "path_match": "ipfix.reverseVirtualStationName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseLayer2SegmentId": { + "path_match": "ipfix.reverseLayer2SegmentId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2OctetDeltaCount": { + "path_match": "ipfix.reverseLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2OctetTotalCount": { + "path_match": "ipfix.reverseLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIngressUnicastPacketTotalCount": { + "path_match": "ipfix.reverseIngressUnicastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIngressMulticastPacketTotalCount": { + "path_match": "ipfix.reverseIngressMulticastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIngressBroadcastPacketTotalCount": { + "path_match": "ipfix.reverseIngressBroadcastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEgressUnicastPacketTotalCount": { + "path_match": "ipfix.reverseEgressUnicastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEgressBroadcastPacketTotalCount": { + "path_match": "ipfix.reverseEgressBroadcastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMonitoringIntervalStartMilliSeconds": { + "path_match": "ipfix.reverseMonitoringIntervalStartMilliSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMonitoringIntervalEndMilliSeconds": { + "path_match": "ipfix.reverseMonitoringIntervalEndMilliSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePortRangeStart": { + "path_match": "ipfix.reversePortRangeStart", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePortRangeEnd": { + "path_match": "ipfix.reversePortRangeEnd", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePortRangeStepSize": { + "path_match": "ipfix.reversePortRangeStepSize", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePortRangeNumPorts": { + "path_match": "ipfix.reversePortRangeNumPorts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseStaMacAddress": { + "path_match": "ipfix.reverseStaMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseStaIPv4Address": { + "path_match": "ipfix.reverseStaIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseWtpMacAddress": { + "path_match": "ipfix.reverseWtpMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseIngressInterfaceType": { + "path_match": "ipfix.reverseIngressInterfaceType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseEgressInterfaceType": { + "path_match": "ipfix.reverseEgressInterfaceType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseRtpSequenceNumber": { + "path_match": "ipfix.reverseRtpSequenceNumber", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseUserName": { + "path_match": "ipfix.reverseUserName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseApplicationCategoryName": { + "path_match": "ipfix.reverseApplicationCategoryName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseApplicationSubCategoryName": { + "path_match": "ipfix.reverseApplicationSubCategoryName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseApplicationGroupName": { + "path_match": "ipfix.reverseApplicationGroupName", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseOriginalFlowsPresent": { + "path_match": "ipfix.reverseOriginalFlowsPresent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseOriginalFlowsInitiated": { + "path_match": "ipfix.reverseOriginalFlowsInitiated", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseOriginalFlowsCompleted": { + "path_match": "ipfix.reverseOriginalFlowsCompleted", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDistinctCountOfSourceIPAddress": { + "path_match": "ipfix.reverseDistinctCountOfSourceIPAddress", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDistinctCountOfDestinationIPAddress": { + "path_match": "ipfix.reverseDistinctCountOfDestinationIPAddress", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDistinctCountOfSourceIPv4Address": { + "path_match": "ipfix.reverseDistinctCountOfSourceIPv4Address", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDistinctCountOfDestinationIPv4Address": { + "path_match": "ipfix.reverseDistinctCountOfDestinationIPv4Address", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDistinctCountOfSourceIPv6Address": { + "path_match": "ipfix.reverseDistinctCountOfSourceIPv6Address", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDistinctCountOfDestinationIPv6Address": { + "path_match": "ipfix.reverseDistinctCountOfDestinationIPv6Address", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseValueDistributionMethod": { + "path_match": "ipfix.reverseValueDistributionMethod", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseRfc3550JitterMilliseconds": { + "path_match": "ipfix.reverseRfc3550JitterMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseRfc3550JitterMicroseconds": { + "path_match": "ipfix.reverseRfc3550JitterMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseRfc3550JitterNanoseconds": { + "path_match": "ipfix.reverseRfc3550JitterNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qDEI": { + "path_match": "ipfix.reverseDot1qDEI", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qCustomerDEI": { + "path_match": "ipfix.reverseDot1qCustomerDEI", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowSelectorAlgorithm": { + "path_match": "ipfix.reverseFlowSelectorAlgorithm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowSelectedOctetDeltaCount": { + "path_match": "ipfix.reverseFlowSelectedOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowSelectedPacketDeltaCount": { + "path_match": "ipfix.reverseFlowSelectedPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowSelectedFlowDeltaCount": { + "path_match": "ipfix.reverseFlowSelectedFlowDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSelectorIDTotalFlowsObserved": { + "path_match": "ipfix.reverseSelectorIDTotalFlowsObserved", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSelectorIDTotalFlowsSelected": { + "path_match": "ipfix.reverseSelectorIDTotalFlowsSelected", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingFlowInterval": { + "path_match": "ipfix.reverseSamplingFlowInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSamplingFlowSpacing": { + "path_match": "ipfix.reverseSamplingFlowSpacing", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowSamplingTimeInterval": { + "path_match": "ipfix.reverseFlowSamplingTimeInterval", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseFlowSamplingTimeSpacing": { + "path_match": "ipfix.reverseFlowSamplingTimeSpacing", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseHashFlowDomain": { + "path_match": "ipfix.reverseHashFlowDomain", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTransportOctetDeltaCount": { + "path_match": "ipfix.reverseTransportOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseTransportPacketDeltaCount": { + "path_match": "ipfix.reverseTransportPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseOriginalExporterIPv4Address": { + "path_match": "ipfix.reverseOriginalExporterIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseOriginalExporterIPv6Address": { + "path_match": "ipfix.reverseOriginalExporterIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseOriginalObservationDomainId": { + "path_match": "ipfix.reverseOriginalObservationDomainId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIntermediateProcessId": { + "path_match": "ipfix.reverseIntermediateProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIgnoredDataRecordTotalCount": { + "path_match": "ipfix.reverseIgnoredDataRecordTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDataLinkFrameType": { + "path_match": "ipfix.reverseDataLinkFrameType", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSectionOffset": { + "path_match": "ipfix.reverseSectionOffset", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseSectionExportedOctets": { + "path_match": "ipfix.reverseSectionExportedOctets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qServiceInstanceTag": { + "path_match": "ipfix.reverseDot1qServiceInstanceTag", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseDot1qServiceInstanceId": { + "path_match": "ipfix.reverseDot1qServiceInstanceId", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qServiceInstancePriority": { + "path_match": "ipfix.reverseDot1qServiceInstancePriority", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDot1qCustomerSourceMacAddress": { + "path_match": "ipfix.reverseDot1qCustomerSourceMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reverseDot1qCustomerDestinationMacAddress": { + "path_match": "ipfix.reverseDot1qCustomerDestinationMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.reversePostLayer2OctetDeltaCount": { + "path_match": "ipfix.reversePostLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostMCastLayer2OctetDeltaCount": { + "path_match": "ipfix.reversePostMCastLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePostLayer2OctetTotalCount": { + "path_match": "ipfix.reversePostLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + + { + "ipfix.reversePostMCastLayer2OctetTotalCount": { + "path_match": "ipfix.reversePostMCastLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMinimumLayer2TotalLength": { + "path_match": "ipfix.reverseMinimumLayer2TotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseMaximumLayer2TotalLength": { + "path_match": "ipfix.reverseMaximumLayer2TotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDroppedLayer2OctetDeltaCount": { + "path_match": "ipfix.reverseDroppedLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseDroppedLayer2OctetTotalCount": { + "path_match": "ipfix.reverseDroppedLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseIgnoredLayer2OctetTotalCount": { + "path_match": "ipfix.reverseIgnoredLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseNotSentLayer2OctetTotalCount": { + "path_match": "ipfix.reverseNotSentLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2OctetDeltaSumOfSquares": { + "path_match": "ipfix.reverseLayer2OctetDeltaSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2OctetTotalSumOfSquares": { + "path_match": "ipfix.reverseLayer2OctetTotalSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2FrameDeltaCount": { + "path_match": "ipfix.reverseLayer2FrameDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reverseLayer2FrameTotalCount": { + "path_match": "ipfix.reverseLayer2FrameTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.reversePseudoWireDestinationIPv4Address": { + "path_match": "ipfix.reversePseudoWireDestinationIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.reverseIgnoredLayer2FrameTotalCount": { + "path_match": "ipfix.reverseIgnoredLayer2FrameTotalCount", + "mapping": { + "type": "long" + } + } + }, + - { - "ipfix.alu_nat_inside_svcid": { - "path_match": "ipfix.alu_nat_inside_svcid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.alu_nat_outside_svcid": { - "path_match": "ipfix.alu_nat_outside_svcid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.alu_nat_sub_string": { - "path_match": "ipfix.alu_nat_sub_string", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.alu_nat_inside_svcid": { + "path_match": "ipfix.alu_nat_inside_svcid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.alu_nat_outside_svcid": { + "path_match": "ipfix.alu_nat_outside_svcid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.alu_nat_sub_string": { + "path_match": "ipfix.alu_nat_sub_string", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.barracuda_timestamp": { - "path_match": "ipfix.barracuda_timestamp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.barracuda_log_op": { - "path_match": "ipfix.barracuda_log_op", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.barracuda_traffic_type": { - "path_match": "ipfix.barracuda_traffic_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.barracuda_fw_rule": { - "path_match": "ipfix.barracuda_fw_rule", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.barracuda_service": { - "path_match": "ipfix.barracuda_service", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.barracuda_reason": { - "path_match": "ipfix.barracuda_reason", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.barracuda_reason_text": { - "path_match": "ipfix.barracuda_reason_text", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.barracuda_bind_ipv4_addr": { - "path_match": "ipfix.barracuda_bind_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.barracuda_bind_l4_port": { - "path_match": "ipfix.barracuda_bind_l4_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.barracuda_conn_ipv4_addr": { - "path_match": "ipfix.barracuda_conn_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.barracuda_conn_l4_port": { - "path_match": "ipfix.barracuda_conn_l4_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.barracuda_audit_counter": { - "path_match": "ipfix.barracuda_audit_counter", - "mapping": { - "type": "long" - } - } - }, + { + "ipfix.barracuda_timestamp": { + "path_match": "ipfix.barracuda_timestamp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.barracuda_log_op": { + "path_match": "ipfix.barracuda_log_op", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.barracuda_traffic_type": { + "path_match": "ipfix.barracuda_traffic_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.barracuda_fw_rule": { + "path_match": "ipfix.barracuda_fw_rule", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.barracuda_service": { + "path_match": "ipfix.barracuda_service", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.barracuda_reason": { + "path_match": "ipfix.barracuda_reason", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.barracuda_reason_text": { + "path_match": "ipfix.barracuda_reason_text", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.barracuda_bind_ipv4_addr": { + "path_match": "ipfix.barracuda_bind_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.barracuda_bind_l4_port": { + "path_match": "ipfix.barracuda_bind_l4_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.barracuda_conn_ipv4_addr": { + "path_match": "ipfix.barracuda_conn_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.barracuda_conn_l4_port": { + "path_match": "ipfix.barracuda_conn_l4_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.barracuda_audit_counter": { + "path_match": "ipfix.barracuda_audit_counter", + "mapping": { + "type": "long" + } + } + }, - { - "ipfix.cace_local_ipv4_addr": { - "path_match": "ipfix.cace_local_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cace_remote_ipv4_addr": { - "path_match": "ipfix.cace_remote_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cace_local_ipv6_addr": { - "path_match": "ipfix.cace_local_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cace_remote_ipv6_addr": { - "path_match": "ipfix.cace_remote_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cace_local_l4_port": { - "path_match": "ipfix.cace_local_l4_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cace_remote_l4_port": { - "path_match": "ipfix.cace_remote_l4_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cace_local_ipv4_id": { - "path_match": "ipfix.cace_local_ipv4_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cace_local_icmp_id": { - "path_match": "ipfix.cace_local_icmp_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cace_local_proc_user_id": { - "path_match": "ipfix.cace_local_proc_user_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cace_local_proc_id": { - "path_match": "ipfix.cace_local_proc_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cace_local_proc_user": { - "path_match": "ipfix.cace_local_proc_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cace_local_proc_command": { - "path_match": "ipfix.cace_local_proc_command", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.cace_local_ipv4_addr": { + "path_match": "ipfix.cace_local_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cace_remote_ipv4_addr": { + "path_match": "ipfix.cace_remote_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cace_local_ipv6_addr": { + "path_match": "ipfix.cace_local_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cace_remote_ipv6_addr": { + "path_match": "ipfix.cace_remote_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cace_local_l4_port": { + "path_match": "ipfix.cace_local_l4_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cace_remote_l4_port": { + "path_match": "ipfix.cace_remote_l4_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cace_local_ipv4_id": { + "path_match": "ipfix.cace_local_ipv4_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cace_local_icmp_id": { + "path_match": "ipfix.cace_local_icmp_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cace_local_proc_user_id": { + "path_match": "ipfix.cace_local_proc_user_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cace_local_proc_id": { + "path_match": "ipfix.cace_local_proc_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cace_local_proc_user": { + "path_match": "ipfix.cace_local_proc_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cace_local_proc_command": { + "path_match": "ipfix.cace_local_proc_command", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.cert_obsolete_rev_bytes_total": { - "path_match": "ipfix.cert_obsolete_rev_bytes_total", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_obsolete_rev_packets_total": { - "path_match": "ipfix.cert_obsolete_rev_packets_total", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_init_tcp_flags": { - "path_match": "ipfix.cert_init_tcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_union_tcp_flags": { - "path_match": "ipfix.cert_union_tcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_obsolete_rev_init_tcp_flags": { - "path_match": "ipfix.cert_obsolete_rev_init_tcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_obsolete_rev_union_tcp_flags": { - "path_match": "ipfix.cert_obsolete_rev_union_tcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_payload": { - "path_match": "ipfix.cert_payload", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_obsolete_rev_payload": { - "path_match": "ipfix.cert_obsolete_rev_payload", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_obsolete_rev_tcp_seq_num": { - "path_match": "ipfix.cert_obsolete_rev_tcp_seq_num", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_flow_delta_millis": { - "path_match": "ipfix.cert_rev_flow_delta_millis", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_obsolete_rev_vlan_id": { - "path_match": "ipfix.cert_obsolete_rev_vlan_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_silk_flow_type": { - "path_match": "ipfix.cert_silk_flow_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_silk_flow_sensor": { - "path_match": "ipfix.cert_silk_flow_sensor", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_silk_tcp_state": { - "path_match": "ipfix.cert_silk_tcp_state", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_silk_app_label": { - "path_match": "ipfix.cert_silk_app_label", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_payload_entropy": { - "path_match": "ipfix.cert_payload_entropy", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_os": { - "path_match": "ipfix.cert_os", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_os_ver": { - "path_match": "ipfix.cert_os_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_first_packet_banner": { - "path_match": "ipfix.cert_first_packet_banner", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_second_packet_banner": { - "path_match": "ipfix.cert_second_packet_banner", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_flow_attr": { - "path_match": "ipfix.cert_flow_attr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_expired_frags": { - "path_match": "ipfix.cert_expired_frags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_assembled_frags": { - "path_match": "ipfix.cert_assembled_frags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mean_flow_rate": { - "path_match": "ipfix.cert_mean_flow_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mean_packet_rate": { - "path_match": "ipfix.cert_mean_packet_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_flow_table_flushes": { - "path_match": "ipfix.cert_flow_table_flushes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_flow_table_peak": { - "path_match": "ipfix.cert_flow_table_peak", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_yaf_flow_keyhash": { - "path_match": "ipfix.cert_yaf_flow_keyhash", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_os_fingerprint": { - "path_match": "ipfix.cert_os_fingerprint", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_server_string": { - "path_match": "ipfix.cert_http_server_string", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_user_agent": { - "path_match": "ipfix.cert_http_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_get": { - "path_match": "ipfix.cert_http_get", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_conn": { - "path_match": "ipfix.cert_http_conn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_ver": { - "path_match": "ipfix.cert_http_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_referrer": { - "path_match": "ipfix.cert_http_referrer", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_location": { - "path_match": "ipfix.cert_http_location", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_host": { - "path_match": "ipfix.cert_http_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_content_len": { - "path_match": "ipfix.cert_http_content_len", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_age": { - "path_match": "ipfix.cert_http_age", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_accept": { - "path_match": "ipfix.cert_http_accept", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_accept_lang": { - "path_match": "ipfix.cert_http_accept_lang", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_content_type": { - "path_match": "ipfix.cert_http_content_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_resp": { - "path_match": "ipfix.cert_http_resp", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_pop3_text_msg": { - "path_match": "ipfix.cert_pop3_text_msg", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_irc_text_msg": { - "path_match": "ipfix.cert_irc_text_msg", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_tftp_filename": { - "path_match": "ipfix.cert_tftp_filename", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_tftp_mode": { - "path_match": "ipfix.cert_tftp_mode", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_slp_ver": { - "path_match": "ipfix.cert_slp_ver", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_slp_msg_type": { - "path_match": "ipfix.cert_slp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_slp_string": { - "path_match": "ipfix.cert_slp_string", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ftp_return": { - "path_match": "ipfix.cert_ftp_return", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ftp_user": { - "path_match": "ipfix.cert_ftp_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ftp_pass": { - "path_match": "ipfix.cert_ftp_pass", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ftp_type": { - "path_match": "ipfix.cert_ftp_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ftp_resp_code": { - "path_match": "ipfix.cert_ftp_resp_code", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_imap_capability": { - "path_match": "ipfix.cert_imap_capability", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_imap_login": { - "path_match": "ipfix.cert_imap_login", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_imap_start_tls": { - "path_match": "ipfix.cert_imap_start_tls", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_imap_auth": { - "path_match": "ipfix.cert_imap_auth", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_imap_command": { - "path_match": "ipfix.cert_imap_command", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_imap_exists": { - "path_match": "ipfix.cert_imap_exists", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_imap_recent": { - "path_match": "ipfix.cert_imap_recent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_url": { - "path_match": "ipfix.cert_rtsp_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_ver": { - "path_match": "ipfix.cert_rtsp_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_return_code": { - "path_match": "ipfix.cert_rtsp_return_code", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_content_len": { - "path_match": "ipfix.cert_rtsp_content_len", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_command": { - "path_match": "ipfix.cert_rtsp_command", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_content_type": { - "path_match": "ipfix.cert_rtsp_content_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_transport": { - "path_match": "ipfix.cert_rtsp_transport", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_cseq": { - "path_match": "ipfix.cert_rtsp_cseq", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_location": { - "path_match": "ipfix.cert_rtsp_location", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_packets_rcv": { - "path_match": "ipfix.cert_rtsp_packets_rcv", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rtsp_user_agent": { - "path_match": "ipfix.cert_rtsp_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtsp_jitter": { - "path_match": "ipfix.cert_rtsp_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_sip_invite": { - "path_match": "ipfix.cert_sip_invite", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_sip_command": { - "path_match": "ipfix.cert_sip_command", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_sip_via": { - "path_match": "ipfix.cert_sip_via", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_sip_max_forwards": { - "path_match": "ipfix.cert_sip_max_forwards", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_sip_address": { - "path_match": "ipfix.cert_sip_address", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_sip_content_len": { - "path_match": "ipfix.cert_sip_content_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_sip_user_agent": { - "path_match": "ipfix.cert_sip_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_hello": { - "path_match": "ipfix.cert_smtp_hello", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_from": { - "path_match": "ipfix.cert_smtp_from", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_to": { - "path_match": "ipfix.cert_smtp_to", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_content_type": { - "path_match": "ipfix.cert_smtp_content_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_subject": { - "path_match": "ipfix.cert_smtp_subject", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_filename": { - "path_match": "ipfix.cert_smtp_filename", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_content_disposition": { - "path_match": "ipfix.cert_smtp_content_disposition", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_resp": { - "path_match": "ipfix.cert_smtp_resp", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_enhanced": { - "path_match": "ipfix.cert_smtp_enhanced", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssh_ver": { - "path_match": "ipfix.cert_ssh_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_nntp_resp": { - "path_match": "ipfix.cert_nntp_resp", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_nntp_command": { - "path_match": "ipfix.cert_nntp_command", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_query_resp": { - "path_match": "ipfix.cert_dns_query_resp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_qrtype": { - "path_match": "ipfix.cert_dns_qrtype", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_authoritative": { - "path_match": "ipfix.cert_dns_authoritative", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_nxdomain": { - "path_match": "ipfix.cert_dns_nxdomain", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_rrsection": { - "path_match": "ipfix.cert_dns_rrsection", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_qname": { - "path_match": "ipfix.cert_dns_qname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_cname": { - "path_match": "ipfix.cert_dns_cname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_mxpref": { - "path_match": "ipfix.cert_dns_mxpref", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_mxexch": { - "path_match": "ipfix.cert_dns_mxexch", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_ns_dname": { - "path_match": "ipfix.cert_dns_ns_dname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_ptr_dname": { - "path_match": "ipfix.cert_dns_ptr_dname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cipher": { - "path_match": "ipfix.cert_ssl_cipher", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_client_ver": { - "path_match": "ipfix.cert_ssl_client_ver", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_server_cipher": { - "path_match": "ipfix.cert_ssl_server_cipher", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_compress_method": { - "path_match": "ipfix.cert_ssl_compress_method", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_cert_ver": { - "path_match": "ipfix.cert_ssl_cert_ver", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_cert_sig": { - "path_match": "ipfix.cert_ssl_cert_sig", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_issuer_country": { - "path_match": "ipfix.cert_ssl_cert_issuer_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_issuer_org": { - "path_match": "ipfix.cert_ssl_cert_issuer_org", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_issuer_org_unit": { - "path_match": "ipfix.cert_ssl_cert_issuer_org_unit", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_issuer_zipcode": { - "path_match": "ipfix.cert_ssl_cert_issuer_zipcode", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_issuer_state": { - "path_match": "ipfix.cert_ssl_cert_issuer_state", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_issuer_common": { - "path_match": "ipfix.cert_ssl_cert_issuer_common", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_issuer_locality": { - "path_match": "ipfix.cert_ssl_cert_issuer_locality", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_issuer_street": { - "path_match": "ipfix.cert_ssl_cert_issuer_street", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_ttl": { - "path_match": "ipfix.cert_dns_ttl", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_cert_sub_country": { - "path_match": "ipfix.cert_ssl_cert_sub_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_sub_org": { - "path_match": "ipfix.cert_ssl_cert_sub_org", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_sub_org_unit": { - "path_match": "ipfix.cert_ssl_cert_sub_org_unit", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_sub_zipcode": { - "path_match": "ipfix.cert_ssl_cert_sub_zipcode", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_sub_state": { - "path_match": "ipfix.cert_ssl_cert_sub_state", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_sub_common": { - "path_match": "ipfix.cert_ssl_cert_sub_common", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_sub_locality": { - "path_match": "ipfix.cert_ssl_cert_sub_locality", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_sub_street": { - "path_match": "ipfix.cert_ssl_cert_sub_street", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_txtdata": { - "path_match": "ipfix.cert_dns_txtdata", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_soa_serial": { - "path_match": "ipfix.cert_dns_soa_serial", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_soa_refresh": { - "path_match": "ipfix.cert_dns_soa_refresh", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_soa_retry": { - "path_match": "ipfix.cert_dns_soa_retry", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_soa_expire": { - "path_match": "ipfix.cert_dns_soa_expire", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_soa_min": { - "path_match": "ipfix.cert_dns_soa_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_soa_mname": { - "path_match": "ipfix.cert_dns_soa_mname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_soa_rname": { - "path_match": "ipfix.cert_dns_soa_rname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_srv_pri": { - "path_match": "ipfix.cert_dns_srv_pri", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_srv_weight": { - "path_match": "ipfix.cert_dns_srv_weight", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_srv_port": { - "path_match": "ipfix.cert_dns_srv_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_srv_target": { - "path_match": "ipfix.cert_dns_srv_target", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_cookie": { - "path_match": "ipfix.cert_http_cookie", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_set_cookie": { - "path_match": "ipfix.cert_http_set_cookie", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_smtp_size": { - "path_match": "ipfix.cert_smtp_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mysql_user": { - "path_match": "ipfix.cert_mysql_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_mysql_command_code": { - "path_match": "ipfix.cert_mysql_command_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mysql_command_text": { - "path_match": "ipfix.cert_mysql_command_text", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_id": { - "path_match": "ipfix.cert_dns_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_algorithm": { - "path_match": "ipfix.cert_dns_algorithm", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_key_tag": { - "path_match": "ipfix.cert_dns_key_tag", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_signer": { - "path_match": "ipfix.cert_dns_signer", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_sig": { - "path_match": "ipfix.cert_dns_sig", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_digest": { - "path_match": "ipfix.cert_dns_digest", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_public_key": { - "path_match": "ipfix.cert_dns_public_key", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_salt": { - "path_match": "ipfix.cert_dns_salt", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_hash_data": { - "path_match": "ipfix.cert_dns_hash_data", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_iterations": { - "path_match": "ipfix.cert_dns_iterations", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_sig_expire": { - "path_match": "ipfix.cert_dns_sig_expire", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_sig_inception": { - "path_match": "ipfix.cert_dns_sig_inception", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_digest_type": { - "path_match": "ipfix.cert_dns_digest_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_labels": { - "path_match": "ipfix.cert_dns_labels", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_type_covered": { - "path_match": "ipfix.cert_dns_type_covered", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_flags": { - "path_match": "ipfix.cert_dns_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dhcp_fingerprint": { - "path_match": "ipfix.cert_dhcp_fingerprint", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dhcp_vendor_code": { - "path_match": "ipfix.cert_dhcp_vendor_code", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_serial_num": { - "path_match": "ipfix.cert_ssl_cert_serial_num", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_object_type": { - "path_match": "ipfix.cert_ssl_object_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_object_value": { - "path_match": "ipfix.cert_ssl_object_value", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_valid_not_before": { - "path_match": "ipfix.cert_ssl_cert_valid_not_before", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_valid_not_after": { - "path_match": "ipfix.cert_ssl_cert_valid_not_after", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_public_key_alg": { - "path_match": "ipfix.cert_ssl_public_key_alg", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_public_key_len": { - "path_match": "ipfix.cert_ssl_public_key_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_smtp_date": { - "path_match": "ipfix.cert_smtp_date", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_auth": { - "path_match": "ipfix.cert_http_auth", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_via": { - "path_match": "ipfix.cert_http_via", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_x_forwarded_for": { - "path_match": "ipfix.cert_http_x_forwarded_for", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_expires": { - "path_match": "ipfix.cert_http_expires", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_refresh": { - "path_match": "ipfix.cert_http_refresh", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_imei": { - "path_match": "ipfix.cert_http_imei", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_imsi": { - "path_match": "ipfix.cert_http_imsi", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_msisdn": { - "path_match": "ipfix.cert_http_msisdn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_subscriber": { - "path_match": "ipfix.cert_http_subscriber", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_accept_charset": { - "path_match": "ipfix.cert_http_accept_charset", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_accept_encoding": { - "path_match": "ipfix.cert_http_accept_encoding", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_allow": { - "path_match": "ipfix.cert_http_allow", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_date": { - "path_match": "ipfix.cert_http_date", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_expect": { - "path_match": "ipfix.cert_http_expect", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_from": { - "path_match": "ipfix.cert_http_from", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_proxy_auth": { - "path_match": "ipfix.cert_http_proxy_auth", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_upgrade": { - "path_match": "ipfix.cert_http_upgrade", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_warning": { - "path_match": "ipfix.cert_http_warning", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_dnt": { - "path_match": "ipfix.cert_http_dnt", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_x_forwarded_proto": { - "path_match": "ipfix.cert_http_x_forwarded_proto", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_x_forwarded_host": { - "path_match": "ipfix.cert_http_x_forwarded_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_x_forwarded_server": { - "path_match": "ipfix.cert_http_x_forwarded_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_x_device_id": { - "path_match": "ipfix.cert_http_x_device_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_x_profile": { - "path_match": "ipfix.cert_http_x_profile", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_last_modified": { - "path_match": "ipfix.cert_http_last_modified", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_content_encoding": { - "path_match": "ipfix.cert_http_content_encoding", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_content_language": { - "path_match": "ipfix.cert_http_content_language", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_content_location": { - "path_match": "ipfix.cert_http_content_location", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_http_xua_compatible": { - "path_match": "ipfix.cert_http_xua_compatible", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dnp3_src_addr": { - "path_match": "ipfix.cert_dnp3_src_addr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dnp3_dst_addr": { - "path_match": "ipfix.cert_dnp3_dst_addr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dnp3_func": { - "path_match": "ipfix.cert_dnp3_func", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dnp3_object_data": { - "path_match": "ipfix.cert_dnp3_object_data", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_modbus_data": { - "path_match": "ipfix.cert_modbus_data", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ethernet_ip_data": { - "path_match": "ipfix.cert_ethernet_ip_data", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rtp_payload_type": { - "path_match": "ipfix.cert_rtp_payload_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_record_ver": { - "path_match": "ipfix.cert_ssl_record_ver", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mptcp_init_data_seq_num": { - "path_match": "ipfix.cert_mptcp_init_data_seq_num", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mptcp_rcvr_token": { - "path_match": "ipfix.cert_mptcp_rcvr_token", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mptcp_max_seg_size": { - "path_match": "ipfix.cert_mptcp_max_seg_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mptcp_addr_id": { - "path_match": "ipfix.cert_mptcp_addr_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_mptcp_flags": { - "path_match": "ipfix.cert_mptcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_server": { - "path_match": "ipfix.cert_ssl_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_hash": { - "path_match": "ipfix.cert_ssl_cert_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert": { - "path_match": "ipfix.cert_ssl_cert", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dhcp_option": { - "path_match": "ipfix.cert_dhcp_option", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ssl_cert_sha1": { - "path_match": "ipfix.cert_ssl_cert_sha1", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ssl_cert_md5": { - "path_match": "ipfix.cert_ssl_cert_md5", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_ndpi_l7_proto": { - "path_match": "ipfix.cert_ndpi_l7_proto", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_ndpi_l7_sub_proto": { - "path_match": "ipfix.cert_ndpi_l7_sub_proto", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rr_ipv4": { - "path_match": "ipfix.cert_rr_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cert_rr_ipv6": { - "path_match": "ipfix.cert_rr_ipv6", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cert_dns_key_proto_id": { - "path_match": "ipfix.cert_dns_key_proto_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_a_record": { - "path_match": "ipfix.cert_dns_a_record", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_aaaa_record": { - "path_match": "ipfix.cert_dns_aaaa_record", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_small_packets": { - "path_match": "ipfix.cert_small_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_nonempty_packets": { - "path_match": "ipfix.cert_nonempty_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_data_bytes": { - "path_match": "ipfix.cert_data_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_avg_interarrival_time": { - "path_match": "ipfix.cert_avg_interarrival_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_std_dev_interarrival_time": { - "path_match": "ipfix.cert_std_dev_interarrival_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_first_nonempty_packet_size": { - "path_match": "ipfix.cert_first_nonempty_packet_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_max_packet_size": { - "path_match": "ipfix.cert_max_packet_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_first_eight_nonempty_packet_dir": { - "path_match": "ipfix.cert_first_eight_nonempty_packet_dir", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_std_dev_payload_len": { - "path_match": "ipfix.cert_std_dev_payload_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_tcp_urgent_count": { - "path_match": "ipfix.cert_tcp_urgent_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_large_packets": { - "path_match": "ipfix.cert_large_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_tombstone_id": { - "path_match": "ipfix.cert_tombstone_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_exporter_config_id": { - "path_match": "ipfix.cert_exporter_config_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_exporter_unique_id": { - "path_match": "ipfix.cert_exporter_unique_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_dns_rname": { - "path_match": "ipfix.cert_dns_rname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_dns_hits": { - "path_match": "ipfix.cert_dns_hits", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_observed_data_total": { - "path_match": "ipfix.cert_observed_data_total", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_observed_data": { - "path_match": "ipfix.cert_observed_data", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_template": { - "path_match": "ipfix.cert_template", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_template_descr": { - "path_match": "ipfix.cert_template_descr", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_init_tcp_flags": { - "path_match": "ipfix.cert_rev_init_tcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_union_tcp_flags": { - "path_match": "ipfix.cert_rev_union_tcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_payload": { - "path_match": "ipfix.cert_rev_payload", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_payload_entropy": { - "path_match": "ipfix.cert_rev_payload_entropy", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_os": { - "path_match": "ipfix.cert_rev_os", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_os_ver": { - "path_match": "ipfix.cert_rev_os_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_first_packet_banner": { - "path_match": "ipfix.cert_rev_first_packet_banner", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_second_packet_banner": { - "path_match": "ipfix.cert_rev_second_packet_banner", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_flow_attr": { - "path_match": "ipfix.cert_rev_flow_attr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_os_fingerprint": { - "path_match": "ipfix.cert_rev_os_fingerprint", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_dhcp_fingerprint": { - "path_match": "ipfix.cert_rev_dhcp_fingerprint", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_dhcp_vendor_code": { - "path_match": "ipfix.cert_rev_dhcp_vendor_code", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cert_rev_rtp_payload_type": { - "path_match": "ipfix.cert_rev_rtp_payload_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_small_packets": { - "path_match": "ipfix.cert_rev_small_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_nonempty_packets": { - "path_match": "ipfix.cert_rev_nonempty_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_data_bytes": { - "path_match": "ipfix.cert_rev_data_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_avg_interarrival_time": { - "path_match": "ipfix.cert_rev_avg_interarrival_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_std_dev_interarrival_time": { - "path_match": "ipfix.cert_rev_std_dev_interarrival_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_first_nonempty_packet_size": { - "path_match": "ipfix.cert_rev_first_nonempty_packet_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_max_packet_size": { - "path_match": "ipfix.cert_rev_max_packet_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_first_eight_nonempty_packet_dir": { - "path_match": "ipfix.cert_rev_first_eight_nonempty_packet_dir", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_std_dev_payload_len": { - "path_match": "ipfix.cert_rev_std_dev_payload_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_tcp_urgent_count": { - "path_match": "ipfix.cert_rev_tcp_urgent_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cert_rev_large_packets": { - "path_match": "ipfix.cert_rev_large_packets", - "mapping": { - "type": "long" - } - } - }, + { + "ipfix.cert_obsolete_rev_bytes_total": { + "path_match": "ipfix.cert_obsolete_rev_bytes_total", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_obsolete_rev_packets_total": { + "path_match": "ipfix.cert_obsolete_rev_packets_total", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_init_tcp_flags": { + "path_match": "ipfix.cert_init_tcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_union_tcp_flags": { + "path_match": "ipfix.cert_union_tcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_obsolete_rev_init_tcp_flags": { + "path_match": "ipfix.cert_obsolete_rev_init_tcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_obsolete_rev_union_tcp_flags": { + "path_match": "ipfix.cert_obsolete_rev_union_tcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_payload": { + "path_match": "ipfix.cert_payload", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_obsolete_rev_payload": { + "path_match": "ipfix.cert_obsolete_rev_payload", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_obsolete_rev_tcp_seq_num": { + "path_match": "ipfix.cert_obsolete_rev_tcp_seq_num", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_flow_delta_millis": { + "path_match": "ipfix.cert_rev_flow_delta_millis", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_obsolete_rev_vlan_id": { + "path_match": "ipfix.cert_obsolete_rev_vlan_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_silk_flow_type": { + "path_match": "ipfix.cert_silk_flow_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_silk_flow_sensor": { + "path_match": "ipfix.cert_silk_flow_sensor", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_silk_tcp_state": { + "path_match": "ipfix.cert_silk_tcp_state", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_silk_app_label": { + "path_match": "ipfix.cert_silk_app_label", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_payload_entropy": { + "path_match": "ipfix.cert_payload_entropy", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_os": { + "path_match": "ipfix.cert_os", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_os_ver": { + "path_match": "ipfix.cert_os_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_first_packet_banner": { + "path_match": "ipfix.cert_first_packet_banner", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_second_packet_banner": { + "path_match": "ipfix.cert_second_packet_banner", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_flow_attr": { + "path_match": "ipfix.cert_flow_attr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_expired_frags": { + "path_match": "ipfix.cert_expired_frags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_assembled_frags": { + "path_match": "ipfix.cert_assembled_frags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mean_flow_rate": { + "path_match": "ipfix.cert_mean_flow_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mean_packet_rate": { + "path_match": "ipfix.cert_mean_packet_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_flow_table_flushes": { + "path_match": "ipfix.cert_flow_table_flushes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_flow_table_peak": { + "path_match": "ipfix.cert_flow_table_peak", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_yaf_flow_keyhash": { + "path_match": "ipfix.cert_yaf_flow_keyhash", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_os_fingerprint": { + "path_match": "ipfix.cert_os_fingerprint", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_server_string": { + "path_match": "ipfix.cert_http_server_string", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_user_agent": { + "path_match": "ipfix.cert_http_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_get": { + "path_match": "ipfix.cert_http_get", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_conn": { + "path_match": "ipfix.cert_http_conn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_ver": { + "path_match": "ipfix.cert_http_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_referrer": { + "path_match": "ipfix.cert_http_referrer", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_location": { + "path_match": "ipfix.cert_http_location", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_host": { + "path_match": "ipfix.cert_http_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_content_len": { + "path_match": "ipfix.cert_http_content_len", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_age": { + "path_match": "ipfix.cert_http_age", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_accept": { + "path_match": "ipfix.cert_http_accept", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_accept_lang": { + "path_match": "ipfix.cert_http_accept_lang", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_content_type": { + "path_match": "ipfix.cert_http_content_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_resp": { + "path_match": "ipfix.cert_http_resp", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_pop3_text_msg": { + "path_match": "ipfix.cert_pop3_text_msg", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_irc_text_msg": { + "path_match": "ipfix.cert_irc_text_msg", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_tftp_filename": { + "path_match": "ipfix.cert_tftp_filename", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_tftp_mode": { + "path_match": "ipfix.cert_tftp_mode", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_slp_ver": { + "path_match": "ipfix.cert_slp_ver", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_slp_msg_type": { + "path_match": "ipfix.cert_slp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_slp_string": { + "path_match": "ipfix.cert_slp_string", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ftp_return": { + "path_match": "ipfix.cert_ftp_return", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ftp_user": { + "path_match": "ipfix.cert_ftp_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ftp_pass": { + "path_match": "ipfix.cert_ftp_pass", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ftp_type": { + "path_match": "ipfix.cert_ftp_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ftp_resp_code": { + "path_match": "ipfix.cert_ftp_resp_code", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_imap_capability": { + "path_match": "ipfix.cert_imap_capability", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_imap_login": { + "path_match": "ipfix.cert_imap_login", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_imap_start_tls": { + "path_match": "ipfix.cert_imap_start_tls", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_imap_auth": { + "path_match": "ipfix.cert_imap_auth", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_imap_command": { + "path_match": "ipfix.cert_imap_command", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_imap_exists": { + "path_match": "ipfix.cert_imap_exists", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_imap_recent": { + "path_match": "ipfix.cert_imap_recent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_url": { + "path_match": "ipfix.cert_rtsp_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_ver": { + "path_match": "ipfix.cert_rtsp_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_return_code": { + "path_match": "ipfix.cert_rtsp_return_code", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_content_len": { + "path_match": "ipfix.cert_rtsp_content_len", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_command": { + "path_match": "ipfix.cert_rtsp_command", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_content_type": { + "path_match": "ipfix.cert_rtsp_content_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_transport": { + "path_match": "ipfix.cert_rtsp_transport", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_cseq": { + "path_match": "ipfix.cert_rtsp_cseq", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_location": { + "path_match": "ipfix.cert_rtsp_location", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_packets_rcv": { + "path_match": "ipfix.cert_rtsp_packets_rcv", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rtsp_user_agent": { + "path_match": "ipfix.cert_rtsp_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtsp_jitter": { + "path_match": "ipfix.cert_rtsp_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_sip_invite": { + "path_match": "ipfix.cert_sip_invite", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_sip_command": { + "path_match": "ipfix.cert_sip_command", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_sip_via": { + "path_match": "ipfix.cert_sip_via", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_sip_max_forwards": { + "path_match": "ipfix.cert_sip_max_forwards", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_sip_address": { + "path_match": "ipfix.cert_sip_address", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_sip_content_len": { + "path_match": "ipfix.cert_sip_content_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_sip_user_agent": { + "path_match": "ipfix.cert_sip_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_hello": { + "path_match": "ipfix.cert_smtp_hello", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_from": { + "path_match": "ipfix.cert_smtp_from", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_to": { + "path_match": "ipfix.cert_smtp_to", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_content_type": { + "path_match": "ipfix.cert_smtp_content_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_subject": { + "path_match": "ipfix.cert_smtp_subject", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_filename": { + "path_match": "ipfix.cert_smtp_filename", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_content_disposition": { + "path_match": "ipfix.cert_smtp_content_disposition", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_resp": { + "path_match": "ipfix.cert_smtp_resp", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_enhanced": { + "path_match": "ipfix.cert_smtp_enhanced", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssh_ver": { + "path_match": "ipfix.cert_ssh_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_nntp_resp": { + "path_match": "ipfix.cert_nntp_resp", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_nntp_command": { + "path_match": "ipfix.cert_nntp_command", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_query_resp": { + "path_match": "ipfix.cert_dns_query_resp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_qrtype": { + "path_match": "ipfix.cert_dns_qrtype", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_authoritative": { + "path_match": "ipfix.cert_dns_authoritative", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_nxdomain": { + "path_match": "ipfix.cert_dns_nxdomain", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_rrsection": { + "path_match": "ipfix.cert_dns_rrsection", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_qname": { + "path_match": "ipfix.cert_dns_qname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_cname": { + "path_match": "ipfix.cert_dns_cname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_mxpref": { + "path_match": "ipfix.cert_dns_mxpref", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_mxexch": { + "path_match": "ipfix.cert_dns_mxexch", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_ns_dname": { + "path_match": "ipfix.cert_dns_ns_dname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_ptr_dname": { + "path_match": "ipfix.cert_dns_ptr_dname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cipher": { + "path_match": "ipfix.cert_ssl_cipher", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_client_ver": { + "path_match": "ipfix.cert_ssl_client_ver", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_server_cipher": { + "path_match": "ipfix.cert_ssl_server_cipher", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_compress_method": { + "path_match": "ipfix.cert_ssl_compress_method", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_cert_ver": { + "path_match": "ipfix.cert_ssl_cert_ver", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_cert_sig": { + "path_match": "ipfix.cert_ssl_cert_sig", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_issuer_country": { + "path_match": "ipfix.cert_ssl_cert_issuer_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_issuer_org": { + "path_match": "ipfix.cert_ssl_cert_issuer_org", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_issuer_org_unit": { + "path_match": "ipfix.cert_ssl_cert_issuer_org_unit", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_issuer_zipcode": { + "path_match": "ipfix.cert_ssl_cert_issuer_zipcode", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_issuer_state": { + "path_match": "ipfix.cert_ssl_cert_issuer_state", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_issuer_common": { + "path_match": "ipfix.cert_ssl_cert_issuer_common", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_issuer_locality": { + "path_match": "ipfix.cert_ssl_cert_issuer_locality", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_issuer_street": { + "path_match": "ipfix.cert_ssl_cert_issuer_street", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_ttl": { + "path_match": "ipfix.cert_dns_ttl", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_cert_sub_country": { + "path_match": "ipfix.cert_ssl_cert_sub_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_sub_org": { + "path_match": "ipfix.cert_ssl_cert_sub_org", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_sub_org_unit": { + "path_match": "ipfix.cert_ssl_cert_sub_org_unit", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_sub_zipcode": { + "path_match": "ipfix.cert_ssl_cert_sub_zipcode", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_sub_state": { + "path_match": "ipfix.cert_ssl_cert_sub_state", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_sub_common": { + "path_match": "ipfix.cert_ssl_cert_sub_common", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_sub_locality": { + "path_match": "ipfix.cert_ssl_cert_sub_locality", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_sub_street": { + "path_match": "ipfix.cert_ssl_cert_sub_street", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_txtdata": { + "path_match": "ipfix.cert_dns_txtdata", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_soa_serial": { + "path_match": "ipfix.cert_dns_soa_serial", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_soa_refresh": { + "path_match": "ipfix.cert_dns_soa_refresh", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_soa_retry": { + "path_match": "ipfix.cert_dns_soa_retry", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_soa_expire": { + "path_match": "ipfix.cert_dns_soa_expire", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_soa_min": { + "path_match": "ipfix.cert_dns_soa_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_soa_mname": { + "path_match": "ipfix.cert_dns_soa_mname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_soa_rname": { + "path_match": "ipfix.cert_dns_soa_rname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_srv_pri": { + "path_match": "ipfix.cert_dns_srv_pri", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_srv_weight": { + "path_match": "ipfix.cert_dns_srv_weight", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_srv_port": { + "path_match": "ipfix.cert_dns_srv_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_srv_target": { + "path_match": "ipfix.cert_dns_srv_target", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_cookie": { + "path_match": "ipfix.cert_http_cookie", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_set_cookie": { + "path_match": "ipfix.cert_http_set_cookie", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_smtp_size": { + "path_match": "ipfix.cert_smtp_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mysql_user": { + "path_match": "ipfix.cert_mysql_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_mysql_command_code": { + "path_match": "ipfix.cert_mysql_command_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mysql_command_text": { + "path_match": "ipfix.cert_mysql_command_text", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_id": { + "path_match": "ipfix.cert_dns_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_algorithm": { + "path_match": "ipfix.cert_dns_algorithm", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_key_tag": { + "path_match": "ipfix.cert_dns_key_tag", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_signer": { + "path_match": "ipfix.cert_dns_signer", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_sig": { + "path_match": "ipfix.cert_dns_sig", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_digest": { + "path_match": "ipfix.cert_dns_digest", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_public_key": { + "path_match": "ipfix.cert_dns_public_key", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_salt": { + "path_match": "ipfix.cert_dns_salt", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_hash_data": { + "path_match": "ipfix.cert_dns_hash_data", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_iterations": { + "path_match": "ipfix.cert_dns_iterations", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_sig_expire": { + "path_match": "ipfix.cert_dns_sig_expire", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_sig_inception": { + "path_match": "ipfix.cert_dns_sig_inception", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_digest_type": { + "path_match": "ipfix.cert_dns_digest_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_labels": { + "path_match": "ipfix.cert_dns_labels", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_type_covered": { + "path_match": "ipfix.cert_dns_type_covered", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_flags": { + "path_match": "ipfix.cert_dns_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dhcp_fingerprint": { + "path_match": "ipfix.cert_dhcp_fingerprint", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dhcp_vendor_code": { + "path_match": "ipfix.cert_dhcp_vendor_code", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_serial_num": { + "path_match": "ipfix.cert_ssl_cert_serial_num", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_object_type": { + "path_match": "ipfix.cert_ssl_object_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_object_value": { + "path_match": "ipfix.cert_ssl_object_value", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_valid_not_before": { + "path_match": "ipfix.cert_ssl_cert_valid_not_before", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_valid_not_after": { + "path_match": "ipfix.cert_ssl_cert_valid_not_after", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_public_key_alg": { + "path_match": "ipfix.cert_ssl_public_key_alg", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_public_key_len": { + "path_match": "ipfix.cert_ssl_public_key_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_smtp_date": { + "path_match": "ipfix.cert_smtp_date", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_auth": { + "path_match": "ipfix.cert_http_auth", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_via": { + "path_match": "ipfix.cert_http_via", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_x_forwarded_for": { + "path_match": "ipfix.cert_http_x_forwarded_for", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_expires": { + "path_match": "ipfix.cert_http_expires", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_refresh": { + "path_match": "ipfix.cert_http_refresh", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_imei": { + "path_match": "ipfix.cert_http_imei", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_imsi": { + "path_match": "ipfix.cert_http_imsi", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_msisdn": { + "path_match": "ipfix.cert_http_msisdn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_subscriber": { + "path_match": "ipfix.cert_http_subscriber", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_accept_charset": { + "path_match": "ipfix.cert_http_accept_charset", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_accept_encoding": { + "path_match": "ipfix.cert_http_accept_encoding", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_allow": { + "path_match": "ipfix.cert_http_allow", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_date": { + "path_match": "ipfix.cert_http_date", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_expect": { + "path_match": "ipfix.cert_http_expect", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_from": { + "path_match": "ipfix.cert_http_from", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_proxy_auth": { + "path_match": "ipfix.cert_http_proxy_auth", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_upgrade": { + "path_match": "ipfix.cert_http_upgrade", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_warning": { + "path_match": "ipfix.cert_http_warning", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_dnt": { + "path_match": "ipfix.cert_http_dnt", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_x_forwarded_proto": { + "path_match": "ipfix.cert_http_x_forwarded_proto", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_x_forwarded_host": { + "path_match": "ipfix.cert_http_x_forwarded_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_x_forwarded_server": { + "path_match": "ipfix.cert_http_x_forwarded_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_x_device_id": { + "path_match": "ipfix.cert_http_x_device_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_x_profile": { + "path_match": "ipfix.cert_http_x_profile", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_last_modified": { + "path_match": "ipfix.cert_http_last_modified", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_content_encoding": { + "path_match": "ipfix.cert_http_content_encoding", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_content_language": { + "path_match": "ipfix.cert_http_content_language", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_content_location": { + "path_match": "ipfix.cert_http_content_location", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_http_xua_compatible": { + "path_match": "ipfix.cert_http_xua_compatible", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dnp3_src_addr": { + "path_match": "ipfix.cert_dnp3_src_addr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dnp3_dst_addr": { + "path_match": "ipfix.cert_dnp3_dst_addr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dnp3_func": { + "path_match": "ipfix.cert_dnp3_func", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dnp3_object_data": { + "path_match": "ipfix.cert_dnp3_object_data", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_modbus_data": { + "path_match": "ipfix.cert_modbus_data", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ethernet_ip_data": { + "path_match": "ipfix.cert_ethernet_ip_data", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rtp_payload_type": { + "path_match": "ipfix.cert_rtp_payload_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_record_ver": { + "path_match": "ipfix.cert_ssl_record_ver", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mptcp_init_data_seq_num": { + "path_match": "ipfix.cert_mptcp_init_data_seq_num", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mptcp_rcvr_token": { + "path_match": "ipfix.cert_mptcp_rcvr_token", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mptcp_max_seg_size": { + "path_match": "ipfix.cert_mptcp_max_seg_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mptcp_addr_id": { + "path_match": "ipfix.cert_mptcp_addr_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_mptcp_flags": { + "path_match": "ipfix.cert_mptcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_server": { + "path_match": "ipfix.cert_ssl_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_hash": { + "path_match": "ipfix.cert_ssl_cert_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert": { + "path_match": "ipfix.cert_ssl_cert", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dhcp_option": { + "path_match": "ipfix.cert_dhcp_option", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ssl_cert_sha1": { + "path_match": "ipfix.cert_ssl_cert_sha1", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ssl_cert_md5": { + "path_match": "ipfix.cert_ssl_cert_md5", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_ndpi_l7_proto": { + "path_match": "ipfix.cert_ndpi_l7_proto", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_ndpi_l7_sub_proto": { + "path_match": "ipfix.cert_ndpi_l7_sub_proto", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rr_ipv4": { + "path_match": "ipfix.cert_rr_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cert_rr_ipv6": { + "path_match": "ipfix.cert_rr_ipv6", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cert_dns_key_proto_id": { + "path_match": "ipfix.cert_dns_key_proto_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_a_record": { + "path_match": "ipfix.cert_dns_a_record", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_aaaa_record": { + "path_match": "ipfix.cert_dns_aaaa_record", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_small_packets": { + "path_match": "ipfix.cert_small_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_nonempty_packets": { + "path_match": "ipfix.cert_nonempty_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_data_bytes": { + "path_match": "ipfix.cert_data_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_avg_interarrival_time": { + "path_match": "ipfix.cert_avg_interarrival_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_std_dev_interarrival_time": { + "path_match": "ipfix.cert_std_dev_interarrival_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_first_nonempty_packet_size": { + "path_match": "ipfix.cert_first_nonempty_packet_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_max_packet_size": { + "path_match": "ipfix.cert_max_packet_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_first_eight_nonempty_packet_dir": { + "path_match": "ipfix.cert_first_eight_nonempty_packet_dir", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_std_dev_payload_len": { + "path_match": "ipfix.cert_std_dev_payload_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_tcp_urgent_count": { + "path_match": "ipfix.cert_tcp_urgent_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_large_packets": { + "path_match": "ipfix.cert_large_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_tombstone_id": { + "path_match": "ipfix.cert_tombstone_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_exporter_config_id": { + "path_match": "ipfix.cert_exporter_config_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_exporter_unique_id": { + "path_match": "ipfix.cert_exporter_unique_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_dns_rname": { + "path_match": "ipfix.cert_dns_rname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_dns_hits": { + "path_match": "ipfix.cert_dns_hits", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_observed_data_total": { + "path_match": "ipfix.cert_observed_data_total", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_observed_data": { + "path_match": "ipfix.cert_observed_data", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_template": { + "path_match": "ipfix.cert_template", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_template_descr": { + "path_match": "ipfix.cert_template_descr", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_init_tcp_flags": { + "path_match": "ipfix.cert_rev_init_tcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_union_tcp_flags": { + "path_match": "ipfix.cert_rev_union_tcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_payload": { + "path_match": "ipfix.cert_rev_payload", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_payload_entropy": { + "path_match": "ipfix.cert_rev_payload_entropy", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_os": { + "path_match": "ipfix.cert_rev_os", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_os_ver": { + "path_match": "ipfix.cert_rev_os_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_first_packet_banner": { + "path_match": "ipfix.cert_rev_first_packet_banner", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_second_packet_banner": { + "path_match": "ipfix.cert_rev_second_packet_banner", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_flow_attr": { + "path_match": "ipfix.cert_rev_flow_attr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_os_fingerprint": { + "path_match": "ipfix.cert_rev_os_fingerprint", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_dhcp_fingerprint": { + "path_match": "ipfix.cert_rev_dhcp_fingerprint", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_dhcp_vendor_code": { + "path_match": "ipfix.cert_rev_dhcp_vendor_code", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cert_rev_rtp_payload_type": { + "path_match": "ipfix.cert_rev_rtp_payload_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_small_packets": { + "path_match": "ipfix.cert_rev_small_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_nonempty_packets": { + "path_match": "ipfix.cert_rev_nonempty_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_data_bytes": { + "path_match": "ipfix.cert_rev_data_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_avg_interarrival_time": { + "path_match": "ipfix.cert_rev_avg_interarrival_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_std_dev_interarrival_time": { + "path_match": "ipfix.cert_rev_std_dev_interarrival_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_first_nonempty_packet_size": { + "path_match": "ipfix.cert_rev_first_nonempty_packet_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_max_packet_size": { + "path_match": "ipfix.cert_rev_max_packet_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_first_eight_nonempty_packet_dir": { + "path_match": "ipfix.cert_rev_first_eight_nonempty_packet_dir", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_std_dev_payload_len": { + "path_match": "ipfix.cert_rev_std_dev_payload_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_tcp_urgent_count": { + "path_match": "ipfix.cert_rev_tcp_urgent_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cert_rev_large_packets": { + "path_match": "ipfix.cert_rev_large_packets", + "mapping": { + "type": "long" + } + } + }, - { - "ipfix.cisco_avc_p2p_tech": { - "path_match": "ipfix.cisco_avc_p2p_tech", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_tunnel_tech": { - "path_match": "ipfix.cisco_avc_tunnel_tech", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_encrypt_tech": { - "path_match": "ipfix.cisco_avc_encrypt_tech", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_ipt_dialing_phone": { - "path_match": "ipfix.cisco_ipt_dialing_phone", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_ipt_dialing_user": { - "path_match": "ipfix.cisco_ipt_dialing_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_ipt_dialed_phone": { - "path_match": "ipfix.cisco_ipt_dialed_phone", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_ipt_dialed_user": { - "path_match": "ipfix.cisco_ipt_dialed_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_ipt_call_duration": { - "path_match": "ipfix.cisco_ipt_call_duration", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_ipt_call_end_reason": { - "path_match": "ipfix.cisco_ipt_call_end_reason", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_ipt_calls_dialed": { - "path_match": "ipfix.cisco_ipt_calls_dialed", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_ipt_calls_connected": { - "path_match": "ipfix.cisco_ipt_calls_connected", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_ipt_calls_failed": { - "path_match": "ipfix.cisco_ipt_calls_failed", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_nexus_fastpath_src_addr": { - "path_match": "ipfix.cisco_nexus_fastpath_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_nexus_fastpath_src_port": { - "path_match": "ipfix.cisco_nexus_fastpath_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_nexus_fastpath_dst_addr": { - "path_match": "ipfix.cisco_nexus_fastpath_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_nexus_fastpath_dst_port": { - "path_match": "ipfix.cisco_nexus_fastpath_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_endpoint_process_user": { - "path_match": "ipfix.cisco_endpoint_process_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_endpoint_process_name": { - "path_match": "ipfix.cisco_endpoint_process_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_endpoint_process_hash": { - "path_match": "ipfix.cisco_endpoint_process_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_endpoint_process_parent_user": { - "path_match": "ipfix.cisco_endpoint_process_parent_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_endpoint_process_parent_name": { - "path_match": "ipfix.cisco_endpoint_process_parent_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_endpoint_process_parent_hash": { - "path_match": "ipfix.cisco_endpoint_process_parent_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_pfr_policy_id": { - "path_match": "ipfix.cisco_pfr_policy_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_map_name": { - "path_match": "ipfix.cisco_pfr_map_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_pfr_reason": { - "path_match": "ipfix.cisco_pfr_reason", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_ingress_acl_id": { - "path_match": "ipfix.cisco_fw_ingress_acl_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_egress_acl_id": { - "path_match": "ipfix.cisco_fw_egress_acl_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_ext_event": { - "path_match": "ipfix.cisco_fw_ext_event", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_event_level": { - "path_match": "ipfix.cisco_fw_event_level", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_event_level_id": { - "path_match": "ipfix.cisco_fw_event_level_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_config_value": { - "path_match": "ipfix.cisco_fw_config_value", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_erm_code": { - "path_match": "ipfix.cisco_fw_erm_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_erm_descr": { - "path_match": "ipfix.cisco_fw_erm_descr", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_trustsec_src_id": { - "path_match": "ipfix.cisco_trustsec_src_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_trustsec_dst_id": { - "path_match": "ipfix.cisco_trustsec_dst_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_trustsec_src_name": { - "path_match": "ipfix.cisco_trustsec_src_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_trustsec_dst_name": { - "path_match": "ipfix.cisco_trustsec_dst_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_trustsec_switch_derived_sgt": { - "path_match": "ipfix.cisco_trustsec_switch_derived_sgt", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_ext_event": { - "path_match": "ipfix.cisco_fw_ext_event", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_blackout_secs": { - "path_match": "ipfix.cisco_fw_blackout_secs", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_half_open_sessions_rate_1min_max": { - "path_match": "ipfix.cisco_fw_half_open_sessions_rate_1min_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_half_open_sessions_rate_1min": { - "path_match": "ipfix.cisco_fw_half_open_sessions_rate_1min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_zonepair_id": { - "path_match": "ipfix.cisco_fw_zonepair_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_sessions_max": { - "path_match": "ipfix.cisco_fw_sessions_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_zonepair": { - "path_match": "ipfix.cisco_fw_zonepair", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_ext_event_descr": { - "path_match": "ipfix.cisco_fw_ext_event_descr", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_drop_pass_summary_packets": { - "path_match": "ipfix.cisco_fw_drop_pass_summary_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_half_open_sessions": { - "path_match": "ipfix.cisco_fw_half_open_sessions", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_dre_input": { - "path_match": "ipfix.cisco_waas_dre_input", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_dre_output": { - "path_match": "ipfix.cisco_waas_dre_output", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_lz_input": { - "path_match": "ipfix.cisco_waas_lz_input", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_lz_output": { - "path_match": "ipfix.cisco_waas_lz_output", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_conn_mode": { - "path_match": "ipfix.cisco_waas_conn_mode", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_input_bytes": { - "path_match": "ipfix.cisco_waas_input_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_output_bytes": { - "path_match": "ipfix.cisco_waas_output_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_short_term_packets_drop": { - "path_match": "ipfix.cisco_avc_transport_short_term_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_long_term_packets_drop": { - "path_match": "ipfix.cisco_avc_transport_long_term_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_media_bytes": { - "path_match": "ipfix.cisco_avc_app_media_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_media_byte_rate": { - "path_match": "ipfix.cisco_avc_app_media_byte_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_media_packets": { - "path_match": "ipfix.cisco_avc_app_media_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_media_packet_rate": { - "path_match": "ipfix.cisco_avc_app_media_packet_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_media_packet_rate_variation": { - "path_match": "ipfix.cisco_avc_app_media_packet_rate_variation", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_media_event": { - "path_match": "ipfix.cisco_avc_app_media_event", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_monitor_event": { - "path_match": "ipfix.cisco_avc_app_monitor_event", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_packets_expected": { - "path_match": "ipfix.cisco_avc_transport_packets_expected", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtt": { - "path_match": "ipfix.cisco_avc_transport_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_packet_sets_lost": { - "path_match": "ipfix.cisco_avc_transport_packet_sets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_short_term_packets_lost": { - "path_match": "ipfix.cisco_avc_transport_short_term_packets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_long_term_packets_lost": { - "path_match": "ipfix.cisco_avc_transport_long_term_packets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_packet_loss_rate": { - "path_match": "ipfix.cisco_avc_transport_packet_loss_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtp_ssrc": { - "path_match": "ipfix.cisco_avc_transport_rtp_ssrc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtp_jitter_mean": { - "path_match": "ipfix.cisco_avc_transport_rtp_jitter_mean", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtp_jitter_min": { - "path_match": "ipfix.cisco_avc_transport_rtp_jitter_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtp_jitter_max": { - "path_match": "ipfix.cisco_avc_transport_rtp_jitter_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_controlled_tc": { - "path_match": "ipfix.cisco_avc_controlled_tc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_in_policy_tc": { - "path_match": "ipfix.cisco_avc_in_policy_tc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_media_packet_rate_variation_min": { - "path_match": "ipfix.cisco_avc_app_media_packet_rate_variation_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_media_packet_rate_variation_max": { - "path_match": "ipfix.cisco_avc_app_media_packet_rate_variation_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtp_flows": { - "path_match": "ipfix.cisco_avc_transport_rtp_flows", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtp_payload_type": { - "path_match": "ipfix.cisco_avc_transport_rtp_payload_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_packet_loss_rate_min": { - "path_match": "ipfix.cisco_avc_transport_packet_loss_rate_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_packet_loss_rate_max": { - "path_match": "ipfix.cisco_avc_transport_packet_loss_rate_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtt_sum": { - "path_match": "ipfix.cisco_avc_transport_rtt_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtt_min": { - "path_match": "ipfix.cisco_avc_transport_rtt_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transport_rtt_max": { - "path_match": "ipfix.cisco_avc_transport_rtt_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_metadata_global_session_id": { - "path_match": "ipfix.cisco_avc_metadata_global_session_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_metadata_multi_party_session_id": { - "path_match": "ipfix.cisco_avc_metadata_multi_party_session_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_metadata_clock_rate": { - "path_match": "ipfix.cisco_avc_metadata_clock_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_network_delay_avg": { - "path_match": "ipfix.cisco_avc_network_delay_avg", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_one_way_delay": { - "path_match": "ipfix.cisco_avc_one_way_delay", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_tcp_window_size_min": { - "path_match": "ipfix.cisco_avc_tcp_window_size_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_tcp_window_size_max": { - "path_match": "ipfix.cisco_avc_tcp_window_size_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_tcp_max_segment_size": { - "path_match": "ipfix.cisco_avc_tcp_max_segment_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_tcp_window_size_sum": { - "path_match": "ipfix.cisco_avc_tcp_window_size_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_rtp_jitter_interarrival_avg": { - "path_match": "ipfix.cisco_avc_rtp_jitter_interarrival_avg", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_src_site_id": { - "path_match": "ipfix.cisco_pfr_src_site_id", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_pfr_dst_site_id": { - "path_match": "ipfix.cisco_pfr_dst_site_id", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_avc_transport_byte_loss_rate": { - "path_match": "ipfix.cisco_avc_transport_byte_loss_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_event_tc_nomitigation_err_bw_count": { - "path_match": "ipfix.cisco_pfr_event_tc_nomitigation_err_bw_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_event_tc_nomitigation_err_perf_count": { - "path_match": "ipfix.cisco_pfr_event_tc_nomitigation_err_perf_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_dst_site_prefix": { - "path_match": "ipfix.cisco_pfr_dst_site_prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_pfr_dst_site_prefix_mask": { - "path_match": "ipfix.cisco_pfr_dst_site_prefix_mask", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_label_id": { - "path_match": "ipfix.cisco_pfr_label_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_br_addr": { - "path_match": "ipfix.cisco_pfr_br_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_pfr_state": { - "path_match": "ipfix.cisco_pfr_state", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_reason_id": { - "path_match": "ipfix.cisco_pfr_reason_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_threshold": { - "path_match": "ipfix.cisco_pfr_threshold", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_pfr_priority": { - "path_match": "ipfix.cisco_pfr_priority", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_long_term_rtt": { - "path_match": "ipfix.cisco_avc_long_term_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_mos_below_counts": { - "path_match": "ipfix.cisco_avc_mos_below_counts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_rsvp_bandwidth_pool": { - "path_match": "ipfix.cisco_avc_rsvp_bandwidth_pool", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_rollup_counter": { - "path_match": "ipfix.cisco_avc_rollup_counter", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_kth_tier_percent": { - "path_match": "ipfix.cisco_avc_kth_tier_percent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_kth_bw_fee": { - "path_match": "ipfix.cisco_avc_kth_bw_fee", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_src_port_min": { - "path_match": "ipfix.cisco_avc_src_port_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_src_port_max": { - "path_match": "ipfix.cisco_avc_src_port_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_dst_port_min": { - "path_match": "ipfix.cisco_avc_dst_port_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_dst_port_max": { - "path_match": "ipfix.cisco_avc_dst_port_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_link_capacity": { - "path_match": "ipfix.cisco_avc_link_capacity", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_ingress_bw": { - "path_match": "ipfix.cisco_avc_ingress_bw", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_ingress_bw_max": { - "path_match": "ipfix.cisco_avc_ingress_bw_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_egress_bw": { - "path_match": "ipfix.cisco_avc_egress_bw", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_egress_bw_max": { - "path_match": "ipfix.cisco_avc_egress_bw_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_ingress_rollup_bw": { - "path_match": "ipfix.cisco_avc_ingress_rollup_bw", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_egress_rollup_bw": { - "path_match": "ipfix.cisco_avc_egress_rollup_bw", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_kth_rollup_bw": { - "path_match": "ipfix.cisco_avc_kth_rollup_bw", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_link_group_name": { - "path_match": "ipfix.cisco_avc_link_group_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_bgp_community": { - "path_match": "ipfix.cisco_avc_bgp_community", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_avc_bgp_prepend": { - "path_match": "ipfix.cisco_avc_bgp_prepend", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_cost_discard_rollup_count": { - "path_match": "ipfix.cisco_avc_cost_discard_rollup_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_user": { - "path_match": "ipfix.cisco_fw_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_fw_xlate_src_addr_ipv4": { - "path_match": "ipfix.cisco_fw_xlate_src_addr_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_fw_xlate_dst_addr_ipv4": { - "path_match": "ipfix.cisco_fw_xlate_dst_addr_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_fw_xlate_src_port": { - "path_match": "ipfix.cisco_fw_xlate_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_xlate_dst_port": { - "path_match": "ipfix.cisco_fw_xlate_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_fw_event": { - "path_match": "ipfix.cisco_fw_event", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_client_long_lived_network_delay_max": { - "path_match": "ipfix.cisco_avc_client_long_lived_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_long_lived_network_delay_min": { - "path_match": "ipfix.cisco_avc_client_long_lived_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_long_lived_network_delay_max": { - "path_match": "ipfix.cisco_avc_server_long_lived_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_long_lived_network_delay_min": { - "path_match": "ipfix.cisco_avc_server_long_lived_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_policy_qos_class_hierarchy": { - "path_match": "ipfix.cisco_policy_qos_class_hierarchy", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_server_bytes": { - "path_match": "ipfix.cisco_avc_server_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_bytes": { - "path_match": "ipfix.cisco_avc_client_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_concurrent_sessions": { - "path_match": "ipfix.cisco_avc_concurrent_sessions", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_segment": { - "path_match": "ipfix.cisco_waas_segment", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_waas_passthru_reason": { - "path_match": "ipfix.cisco_waas_passthru_reason", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_long_lived_network_delay_sum": { - "path_match": "ipfix.cisco_avc_server_long_lived_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_long_lived_network_delay_sum": { - "path_match": "ipfix.cisco_avc_client_long_lived_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_total_long_lived_network_delay_sum": { - "path_match": "ipfix.cisco_avc_total_long_lived_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_total_long_lived_network_delay_samples": { - "path_match": "ipfix.cisco_avc_total_long_lived_network_delay_samples", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_long_lived_network_delay_samples": { - "path_match": "ipfix.cisco_avc_server_long_lived_network_delay_samples", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_long_lived_network_delay_samples": { - "path_match": "ipfix.cisco_avc_client_long_lived_network_delay_samples", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_packets": { - "path_match": "ipfix.cisco_avc_client_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_packets": { - "path_match": "ipfix.cisco_avc_server_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_retrans_bytes": { - "path_match": "ipfix.cisco_avc_client_retrans_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_retrans_packets": { - "path_match": "ipfix.cisco_avc_client_retrans_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_retrans_bytes": { - "path_match": "ipfix.cisco_avc_server_retrans_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_retrans_packets": { - "path_match": "ipfix.cisco_avc_server_retrans_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transact_time_delta": { - "path_match": "ipfix.cisco_avc_transact_time_delta", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transact_time_total": { - "path_match": "ipfix.cisco_avc_transact_time_total", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transact_time_max": { - "path_match": "ipfix.cisco_avc_transact_time_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_transact_time_min": { - "path_match": "ipfix.cisco_avc_transact_time_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_resps": { - "path_match": "ipfix.cisco_avc_server_resps", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_resp_histogram1": { - "path_match": "ipfix.cisco_avc_resp_histogram1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_resp_histogram2": { - "path_match": "ipfix.cisco_avc_resp_histogram2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_resp_histogram3": { - "path_match": "ipfix.cisco_avc_resp_histogram3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_resp_histogram4": { - "path_match": "ipfix.cisco_avc_resp_histogram4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_resp_histogram5": { - "path_match": "ipfix.cisco_avc_resp_histogram5", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_resp_histogram6": { - "path_match": "ipfix.cisco_avc_resp_histogram6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_resp_histogram7": { - "path_match": "ipfix.cisco_avc_resp_histogram7", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_late_resps": { - "path_match": "ipfix.cisco_avc_server_late_resps", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_resp_time_sum": { - "path_match": "ipfix.cisco_avc_server_resp_time_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_resp_time_max": { - "path_match": "ipfix.cisco_avc_server_resp_time_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_resp_time_min": { - "path_match": "ipfix.cisco_avc_server_resp_time_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_delay_sum": { - "path_match": "ipfix.cisco_avc_app_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_delay_max": { - "path_match": "ipfix.cisco_avc_app_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_delay_min": { - "path_match": "ipfix.cisco_avc_app_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_total_delay_sum": { - "path_match": "ipfix.cisco_avc_total_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_total_delay_max": { - "path_match": "ipfix.cisco_avc_total_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_total_delay_min": { - "path_match": "ipfix.cisco_avc_total_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_total_network_delay_sum": { - "path_match": "ipfix.cisco_avc_total_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_total_network_delay_max": { - "path_match": "ipfix.cisco_avc_total_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_total_network_delay_min": { - "path_match": "ipfix.cisco_avc_total_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_network_delay_sum": { - "path_match": "ipfix.cisco_avc_client_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_network_delay_max": { - "path_match": "ipfix.cisco_avc_client_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_client_network_delay_min": { - "path_match": "ipfix.cisco_avc_client_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_network_delay_sum": { - "path_match": "ipfix.cisco_avc_server_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_network_delay_max": { - "path_match": "ipfix.cisco_avc_server_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_network_delay_min": { - "path_match": "ipfix.cisco_avc_server_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_rtp_short_term_mos": { - "path_match": "ipfix.cisco_avc_rtp_short_term_mos", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_rtp_mos": { - "path_match": "ipfix.cisco_avc_rtp_mos", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_rtp_mos_total": { - "path_match": "ipfix.cisco_avc_rtp_mos_total", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_http_uri_stats": { - "path_match": "ipfix.cisco_avc_app_http_uri_stats", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_policy_qos_queue_id": { - "path_match": "ipfix.cisco_avc_policy_qos_queue_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_policy_qos_queue_drops": { - "path_match": "ipfix.cisco_avc_policy_qos_queue_drops", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_eta_idp_old": { - "path_match": "ipfix.cisco_eta_idp_old", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_eta_slpt_old": { - "path_match": "ipfix.cisco_eta_slpt_old", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_wlan_id": { - "path_match": "ipfix.cisco_wlan_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_category": { - "path_match": "ipfix.cisco_avc_app_category", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_app_sub_category": { - "path_match": "ipfix.cisco_avc_app_sub_category", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_app_group": { - "path_match": "ipfix.cisco_avc_app_group", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_app_http_host": { - "path_match": "ipfix.cisco_avc_app_http_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_client_ipv4_addr": { - "path_match": "ipfix.cisco_avc_client_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_avc_server_ipv4_addr": { - "path_match": "ipfix.cisco_avc_server_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_avc_client_ipv6_addr": { - "path_match": "ipfix.cisco_avc_client_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_avc_server_ipv6_addr": { - "path_match": "ipfix.cisco_avc_server_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.cisco_avc_client_l4_port": { - "path_match": "ipfix.cisco_avc_client_l4_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_server_l4_port": { - "path_match": "ipfix.cisco_avc_server_l4_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_conn_id": { - "path_match": "ipfix.cisco_avc_conn_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_avc_app_traffic_class": { - "path_match": "ipfix.cisco_avc_app_traffic_class", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_avc_app_business_relevance": { - "path_match": "ipfix.cisco_avc_app_business_relevance", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_udid": { - "path_match": "ipfix.cisco_nvzflow_udid", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_user": { - "path_match": "ipfix.cisco_nvzflow_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_os_name": { - "path_match": "ipfix.cisco_nvzflow_os_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_os_ver": { - "path_match": "ipfix.cisco_nvzflow_os_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_sys_vendor": { - "path_match": "ipfix.cisco_nvzflow_sys_vendor", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_sys_type": { - "path_match": "ipfix.cisco_nvzflow_sys_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_proc_acct": { - "path_match": "ipfix.cisco_nvzflow_proc_acct", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_parent_proc_acct": { - "path_match": "ipfix.cisco_nvzflow_parent_proc_acct", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_proc": { - "path_match": "ipfix.cisco_nvzflow_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_proc_hash": { - "path_match": "ipfix.cisco_nvzflow_proc_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_parent_proc": { - "path_match": "ipfix.cisco_nvzflow_parent_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_parent_proc_hash": { - "path_match": "ipfix.cisco_nvzflow_parent_proc_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_dns_suffix": { - "path_match": "ipfix.cisco_nvzflow_dns_suffix", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_dst_hostname": { - "path_match": "ipfix.cisco_nvzflow_dst_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_l4_bytes_in": { - "path_match": "ipfix.cisco_nvzflow_l4_bytes_in", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_nvzflow_l4_bytes_out": { - "path_match": "ipfix.cisco_nvzflow_l4_bytes_out", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_nvzflow_os_edition": { - "path_match": "ipfix.cisco_nvzflow_os_edition", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_module_list": { - "path_match": "ipfix.cisco_nvzflow_module_list", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_hash_list": { - "path_match": "ipfix.cisco_nvzflow_hash_list", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_coord_list": { - "path_match": "ipfix.cisco_nvzflow_coord_list", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_iface_info_uid": { - "path_match": "ipfix.cisco_nvzflow_iface_info_uid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_nvzflow_iface_index": { - "path_match": "ipfix.cisco_nvzflow_iface_index", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_nvzflow_iface_type": { - "path_match": "ipfix.cisco_nvzflow_iface_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_nvzflow_iface_name": { - "path_match": "ipfix.cisco_nvzflow_iface_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_nvzflow_iface_details_list": { - "path_match": "ipfix.cisco_nvzflow_iface_details_list", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.cisco_timestamp_abs_monitor_interval_start": { - "path_match": "ipfix.cisco_timestamp_abs_monitor_interval_start", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.cisco_timestamp_abs_monitor_interval_end": { - "path_match": "ipfix.cisco_timestamp_abs_monitor_interval_end", - "mapping": { - "type": "long" - } - } - }, + { + "ipfix.cisco_avc_p2p_tech": { + "path_match": "ipfix.cisco_avc_p2p_tech", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_tunnel_tech": { + "path_match": "ipfix.cisco_avc_tunnel_tech", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_encrypt_tech": { + "path_match": "ipfix.cisco_avc_encrypt_tech", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_ipt_dialing_phone": { + "path_match": "ipfix.cisco_ipt_dialing_phone", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_ipt_dialing_user": { + "path_match": "ipfix.cisco_ipt_dialing_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_ipt_dialed_phone": { + "path_match": "ipfix.cisco_ipt_dialed_phone", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_ipt_dialed_user": { + "path_match": "ipfix.cisco_ipt_dialed_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_ipt_call_duration": { + "path_match": "ipfix.cisco_ipt_call_duration", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_ipt_call_end_reason": { + "path_match": "ipfix.cisco_ipt_call_end_reason", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_ipt_calls_dialed": { + "path_match": "ipfix.cisco_ipt_calls_dialed", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_ipt_calls_connected": { + "path_match": "ipfix.cisco_ipt_calls_connected", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_ipt_calls_failed": { + "path_match": "ipfix.cisco_ipt_calls_failed", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_nexus_fastpath_src_addr": { + "path_match": "ipfix.cisco_nexus_fastpath_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_nexus_fastpath_src_port": { + "path_match": "ipfix.cisco_nexus_fastpath_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_nexus_fastpath_dst_addr": { + "path_match": "ipfix.cisco_nexus_fastpath_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_nexus_fastpath_dst_port": { + "path_match": "ipfix.cisco_nexus_fastpath_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_endpoint_process_user": { + "path_match": "ipfix.cisco_endpoint_process_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_endpoint_process_name": { + "path_match": "ipfix.cisco_endpoint_process_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_endpoint_process_hash": { + "path_match": "ipfix.cisco_endpoint_process_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_endpoint_process_parent_user": { + "path_match": "ipfix.cisco_endpoint_process_parent_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_endpoint_process_parent_name": { + "path_match": "ipfix.cisco_endpoint_process_parent_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_endpoint_process_parent_hash": { + "path_match": "ipfix.cisco_endpoint_process_parent_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_pfr_policy_id": { + "path_match": "ipfix.cisco_pfr_policy_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_map_name": { + "path_match": "ipfix.cisco_pfr_map_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_pfr_reason": { + "path_match": "ipfix.cisco_pfr_reason", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_ingress_acl_id": { + "path_match": "ipfix.cisco_fw_ingress_acl_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_egress_acl_id": { + "path_match": "ipfix.cisco_fw_egress_acl_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_ext_event": { + "path_match": "ipfix.cisco_fw_ext_event", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_event_level": { + "path_match": "ipfix.cisco_fw_event_level", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_event_level_id": { + "path_match": "ipfix.cisco_fw_event_level_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_config_value": { + "path_match": "ipfix.cisco_fw_config_value", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_erm_code": { + "path_match": "ipfix.cisco_fw_erm_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_erm_descr": { + "path_match": "ipfix.cisco_fw_erm_descr", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_trustsec_src_id": { + "path_match": "ipfix.cisco_trustsec_src_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_trustsec_dst_id": { + "path_match": "ipfix.cisco_trustsec_dst_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_trustsec_src_name": { + "path_match": "ipfix.cisco_trustsec_src_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_trustsec_dst_name": { + "path_match": "ipfix.cisco_trustsec_dst_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_trustsec_switch_derived_sgt": { + "path_match": "ipfix.cisco_trustsec_switch_derived_sgt", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_ext_event": { + "path_match": "ipfix.cisco_fw_ext_event", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_blackout_secs": { + "path_match": "ipfix.cisco_fw_blackout_secs", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_half_open_sessions_rate_1min_max": { + "path_match": "ipfix.cisco_fw_half_open_sessions_rate_1min_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_half_open_sessions_rate_1min": { + "path_match": "ipfix.cisco_fw_half_open_sessions_rate_1min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_zonepair_id": { + "path_match": "ipfix.cisco_fw_zonepair_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_sessions_max": { + "path_match": "ipfix.cisco_fw_sessions_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_zonepair": { + "path_match": "ipfix.cisco_fw_zonepair", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_ext_event_descr": { + "path_match": "ipfix.cisco_fw_ext_event_descr", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_drop_pass_summary_packets": { + "path_match": "ipfix.cisco_fw_drop_pass_summary_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_half_open_sessions": { + "path_match": "ipfix.cisco_fw_half_open_sessions", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_dre_input": { + "path_match": "ipfix.cisco_waas_dre_input", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_dre_output": { + "path_match": "ipfix.cisco_waas_dre_output", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_lz_input": { + "path_match": "ipfix.cisco_waas_lz_input", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_lz_output": { + "path_match": "ipfix.cisco_waas_lz_output", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_conn_mode": { + "path_match": "ipfix.cisco_waas_conn_mode", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_input_bytes": { + "path_match": "ipfix.cisco_waas_input_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_output_bytes": { + "path_match": "ipfix.cisco_waas_output_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_short_term_packets_drop": { + "path_match": "ipfix.cisco_avc_transport_short_term_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_long_term_packets_drop": { + "path_match": "ipfix.cisco_avc_transport_long_term_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_media_bytes": { + "path_match": "ipfix.cisco_avc_app_media_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_media_byte_rate": { + "path_match": "ipfix.cisco_avc_app_media_byte_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_media_packets": { + "path_match": "ipfix.cisco_avc_app_media_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_media_packet_rate": { + "path_match": "ipfix.cisco_avc_app_media_packet_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_media_packet_rate_variation": { + "path_match": "ipfix.cisco_avc_app_media_packet_rate_variation", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_media_event": { + "path_match": "ipfix.cisco_avc_app_media_event", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_monitor_event": { + "path_match": "ipfix.cisco_avc_app_monitor_event", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_packets_expected": { + "path_match": "ipfix.cisco_avc_transport_packets_expected", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtt": { + "path_match": "ipfix.cisco_avc_transport_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_packet_sets_lost": { + "path_match": "ipfix.cisco_avc_transport_packet_sets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_short_term_packets_lost": { + "path_match": "ipfix.cisco_avc_transport_short_term_packets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_long_term_packets_lost": { + "path_match": "ipfix.cisco_avc_transport_long_term_packets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_packet_loss_rate": { + "path_match": "ipfix.cisco_avc_transport_packet_loss_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtp_ssrc": { + "path_match": "ipfix.cisco_avc_transport_rtp_ssrc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtp_jitter_mean": { + "path_match": "ipfix.cisco_avc_transport_rtp_jitter_mean", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtp_jitter_min": { + "path_match": "ipfix.cisco_avc_transport_rtp_jitter_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtp_jitter_max": { + "path_match": "ipfix.cisco_avc_transport_rtp_jitter_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_controlled_tc": { + "path_match": "ipfix.cisco_avc_controlled_tc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_in_policy_tc": { + "path_match": "ipfix.cisco_avc_in_policy_tc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_media_packet_rate_variation_min": { + "path_match": "ipfix.cisco_avc_app_media_packet_rate_variation_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_media_packet_rate_variation_max": { + "path_match": "ipfix.cisco_avc_app_media_packet_rate_variation_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtp_flows": { + "path_match": "ipfix.cisco_avc_transport_rtp_flows", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtp_payload_type": { + "path_match": "ipfix.cisco_avc_transport_rtp_payload_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_packet_loss_rate_min": { + "path_match": "ipfix.cisco_avc_transport_packet_loss_rate_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_packet_loss_rate_max": { + "path_match": "ipfix.cisco_avc_transport_packet_loss_rate_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtt_sum": { + "path_match": "ipfix.cisco_avc_transport_rtt_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtt_min": { + "path_match": "ipfix.cisco_avc_transport_rtt_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transport_rtt_max": { + "path_match": "ipfix.cisco_avc_transport_rtt_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_metadata_global_session_id": { + "path_match": "ipfix.cisco_avc_metadata_global_session_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_metadata_multi_party_session_id": { + "path_match": "ipfix.cisco_avc_metadata_multi_party_session_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_metadata_clock_rate": { + "path_match": "ipfix.cisco_avc_metadata_clock_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_network_delay_avg": { + "path_match": "ipfix.cisco_avc_network_delay_avg", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_one_way_delay": { + "path_match": "ipfix.cisco_avc_one_way_delay", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_tcp_window_size_min": { + "path_match": "ipfix.cisco_avc_tcp_window_size_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_tcp_window_size_max": { + "path_match": "ipfix.cisco_avc_tcp_window_size_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_tcp_max_segment_size": { + "path_match": "ipfix.cisco_avc_tcp_max_segment_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_tcp_window_size_sum": { + "path_match": "ipfix.cisco_avc_tcp_window_size_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_rtp_jitter_interarrival_avg": { + "path_match": "ipfix.cisco_avc_rtp_jitter_interarrival_avg", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_src_site_id": { + "path_match": "ipfix.cisco_pfr_src_site_id", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_pfr_dst_site_id": { + "path_match": "ipfix.cisco_pfr_dst_site_id", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_avc_transport_byte_loss_rate": { + "path_match": "ipfix.cisco_avc_transport_byte_loss_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_event_tc_nomitigation_err_bw_count": { + "path_match": "ipfix.cisco_pfr_event_tc_nomitigation_err_bw_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_event_tc_nomitigation_err_perf_count": { + "path_match": "ipfix.cisco_pfr_event_tc_nomitigation_err_perf_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_dst_site_prefix": { + "path_match": "ipfix.cisco_pfr_dst_site_prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_pfr_dst_site_prefix_mask": { + "path_match": "ipfix.cisco_pfr_dst_site_prefix_mask", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_label_id": { + "path_match": "ipfix.cisco_pfr_label_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_br_addr": { + "path_match": "ipfix.cisco_pfr_br_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_pfr_state": { + "path_match": "ipfix.cisco_pfr_state", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_reason_id": { + "path_match": "ipfix.cisco_pfr_reason_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_threshold": { + "path_match": "ipfix.cisco_pfr_threshold", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_pfr_priority": { + "path_match": "ipfix.cisco_pfr_priority", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_long_term_rtt": { + "path_match": "ipfix.cisco_avc_long_term_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_mos_below_counts": { + "path_match": "ipfix.cisco_avc_mos_below_counts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_rsvp_bandwidth_pool": { + "path_match": "ipfix.cisco_avc_rsvp_bandwidth_pool", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_rollup_counter": { + "path_match": "ipfix.cisco_avc_rollup_counter", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_kth_tier_percent": { + "path_match": "ipfix.cisco_avc_kth_tier_percent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_kth_bw_fee": { + "path_match": "ipfix.cisco_avc_kth_bw_fee", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_src_port_min": { + "path_match": "ipfix.cisco_avc_src_port_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_src_port_max": { + "path_match": "ipfix.cisco_avc_src_port_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_dst_port_min": { + "path_match": "ipfix.cisco_avc_dst_port_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_dst_port_max": { + "path_match": "ipfix.cisco_avc_dst_port_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_link_capacity": { + "path_match": "ipfix.cisco_avc_link_capacity", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_ingress_bw": { + "path_match": "ipfix.cisco_avc_ingress_bw", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_ingress_bw_max": { + "path_match": "ipfix.cisco_avc_ingress_bw_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_egress_bw": { + "path_match": "ipfix.cisco_avc_egress_bw", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_egress_bw_max": { + "path_match": "ipfix.cisco_avc_egress_bw_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_ingress_rollup_bw": { + "path_match": "ipfix.cisco_avc_ingress_rollup_bw", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_egress_rollup_bw": { + "path_match": "ipfix.cisco_avc_egress_rollup_bw", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_kth_rollup_bw": { + "path_match": "ipfix.cisco_avc_kth_rollup_bw", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_link_group_name": { + "path_match": "ipfix.cisco_avc_link_group_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_bgp_community": { + "path_match": "ipfix.cisco_avc_bgp_community", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_avc_bgp_prepend": { + "path_match": "ipfix.cisco_avc_bgp_prepend", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_cost_discard_rollup_count": { + "path_match": "ipfix.cisco_avc_cost_discard_rollup_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_user": { + "path_match": "ipfix.cisco_fw_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_fw_xlate_src_addr_ipv4": { + "path_match": "ipfix.cisco_fw_xlate_src_addr_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_fw_xlate_dst_addr_ipv4": { + "path_match": "ipfix.cisco_fw_xlate_dst_addr_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_fw_xlate_src_port": { + "path_match": "ipfix.cisco_fw_xlate_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_xlate_dst_port": { + "path_match": "ipfix.cisco_fw_xlate_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_fw_event": { + "path_match": "ipfix.cisco_fw_event", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_client_long_lived_network_delay_max": { + "path_match": "ipfix.cisco_avc_client_long_lived_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_long_lived_network_delay_min": { + "path_match": "ipfix.cisco_avc_client_long_lived_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_long_lived_network_delay_max": { + "path_match": "ipfix.cisco_avc_server_long_lived_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_long_lived_network_delay_min": { + "path_match": "ipfix.cisco_avc_server_long_lived_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_policy_qos_class_hierarchy": { + "path_match": "ipfix.cisco_policy_qos_class_hierarchy", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_server_bytes": { + "path_match": "ipfix.cisco_avc_server_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_bytes": { + "path_match": "ipfix.cisco_avc_client_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_concurrent_sessions": { + "path_match": "ipfix.cisco_avc_concurrent_sessions", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_segment": { + "path_match": "ipfix.cisco_waas_segment", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_waas_passthru_reason": { + "path_match": "ipfix.cisco_waas_passthru_reason", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_long_lived_network_delay_sum": { + "path_match": "ipfix.cisco_avc_server_long_lived_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_long_lived_network_delay_sum": { + "path_match": "ipfix.cisco_avc_client_long_lived_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_total_long_lived_network_delay_sum": { + "path_match": "ipfix.cisco_avc_total_long_lived_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_total_long_lived_network_delay_samples": { + "path_match": "ipfix.cisco_avc_total_long_lived_network_delay_samples", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_long_lived_network_delay_samples": { + "path_match": "ipfix.cisco_avc_server_long_lived_network_delay_samples", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_long_lived_network_delay_samples": { + "path_match": "ipfix.cisco_avc_client_long_lived_network_delay_samples", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_packets": { + "path_match": "ipfix.cisco_avc_client_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_packets": { + "path_match": "ipfix.cisco_avc_server_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_retrans_bytes": { + "path_match": "ipfix.cisco_avc_client_retrans_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_retrans_packets": { + "path_match": "ipfix.cisco_avc_client_retrans_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_retrans_bytes": { + "path_match": "ipfix.cisco_avc_server_retrans_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_retrans_packets": { + "path_match": "ipfix.cisco_avc_server_retrans_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transact_time_delta": { + "path_match": "ipfix.cisco_avc_transact_time_delta", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transact_time_total": { + "path_match": "ipfix.cisco_avc_transact_time_total", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transact_time_max": { + "path_match": "ipfix.cisco_avc_transact_time_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_transact_time_min": { + "path_match": "ipfix.cisco_avc_transact_time_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_resps": { + "path_match": "ipfix.cisco_avc_server_resps", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_resp_histogram1": { + "path_match": "ipfix.cisco_avc_resp_histogram1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_resp_histogram2": { + "path_match": "ipfix.cisco_avc_resp_histogram2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_resp_histogram3": { + "path_match": "ipfix.cisco_avc_resp_histogram3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_resp_histogram4": { + "path_match": "ipfix.cisco_avc_resp_histogram4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_resp_histogram5": { + "path_match": "ipfix.cisco_avc_resp_histogram5", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_resp_histogram6": { + "path_match": "ipfix.cisco_avc_resp_histogram6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_resp_histogram7": { + "path_match": "ipfix.cisco_avc_resp_histogram7", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_late_resps": { + "path_match": "ipfix.cisco_avc_server_late_resps", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_resp_time_sum": { + "path_match": "ipfix.cisco_avc_server_resp_time_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_resp_time_max": { + "path_match": "ipfix.cisco_avc_server_resp_time_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_resp_time_min": { + "path_match": "ipfix.cisco_avc_server_resp_time_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_delay_sum": { + "path_match": "ipfix.cisco_avc_app_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_delay_max": { + "path_match": "ipfix.cisco_avc_app_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_delay_min": { + "path_match": "ipfix.cisco_avc_app_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_total_delay_sum": { + "path_match": "ipfix.cisco_avc_total_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_total_delay_max": { + "path_match": "ipfix.cisco_avc_total_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_total_delay_min": { + "path_match": "ipfix.cisco_avc_total_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_total_network_delay_sum": { + "path_match": "ipfix.cisco_avc_total_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_total_network_delay_max": { + "path_match": "ipfix.cisco_avc_total_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_total_network_delay_min": { + "path_match": "ipfix.cisco_avc_total_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_network_delay_sum": { + "path_match": "ipfix.cisco_avc_client_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_network_delay_max": { + "path_match": "ipfix.cisco_avc_client_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_client_network_delay_min": { + "path_match": "ipfix.cisco_avc_client_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_network_delay_sum": { + "path_match": "ipfix.cisco_avc_server_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_network_delay_max": { + "path_match": "ipfix.cisco_avc_server_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_network_delay_min": { + "path_match": "ipfix.cisco_avc_server_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_rtp_short_term_mos": { + "path_match": "ipfix.cisco_avc_rtp_short_term_mos", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_rtp_mos": { + "path_match": "ipfix.cisco_avc_rtp_mos", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_rtp_mos_total": { + "path_match": "ipfix.cisco_avc_rtp_mos_total", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_http_uri_stats": { + "path_match": "ipfix.cisco_avc_app_http_uri_stats", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_policy_qos_queue_id": { + "path_match": "ipfix.cisco_avc_policy_qos_queue_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_policy_qos_queue_drops": { + "path_match": "ipfix.cisco_avc_policy_qos_queue_drops", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_eta_idp_old": { + "path_match": "ipfix.cisco_eta_idp_old", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_eta_slpt_old": { + "path_match": "ipfix.cisco_eta_slpt_old", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_wlan_id": { + "path_match": "ipfix.cisco_wlan_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_category": { + "path_match": "ipfix.cisco_avc_app_category", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_app_sub_category": { + "path_match": "ipfix.cisco_avc_app_sub_category", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_app_group": { + "path_match": "ipfix.cisco_avc_app_group", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_app_http_host": { + "path_match": "ipfix.cisco_avc_app_http_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_client_ipv4_addr": { + "path_match": "ipfix.cisco_avc_client_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_avc_server_ipv4_addr": { + "path_match": "ipfix.cisco_avc_server_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_avc_client_ipv6_addr": { + "path_match": "ipfix.cisco_avc_client_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_avc_server_ipv6_addr": { + "path_match": "ipfix.cisco_avc_server_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.cisco_avc_client_l4_port": { + "path_match": "ipfix.cisco_avc_client_l4_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_server_l4_port": { + "path_match": "ipfix.cisco_avc_server_l4_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_conn_id": { + "path_match": "ipfix.cisco_avc_conn_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_avc_app_traffic_class": { + "path_match": "ipfix.cisco_avc_app_traffic_class", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_avc_app_business_relevance": { + "path_match": "ipfix.cisco_avc_app_business_relevance", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_udid": { + "path_match": "ipfix.cisco_nvzflow_udid", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_user": { + "path_match": "ipfix.cisco_nvzflow_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_os_name": { + "path_match": "ipfix.cisco_nvzflow_os_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_os_ver": { + "path_match": "ipfix.cisco_nvzflow_os_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_sys_vendor": { + "path_match": "ipfix.cisco_nvzflow_sys_vendor", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_sys_type": { + "path_match": "ipfix.cisco_nvzflow_sys_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_proc_acct": { + "path_match": "ipfix.cisco_nvzflow_proc_acct", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_parent_proc_acct": { + "path_match": "ipfix.cisco_nvzflow_parent_proc_acct", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_proc": { + "path_match": "ipfix.cisco_nvzflow_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_proc_hash": { + "path_match": "ipfix.cisco_nvzflow_proc_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_parent_proc": { + "path_match": "ipfix.cisco_nvzflow_parent_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_parent_proc_hash": { + "path_match": "ipfix.cisco_nvzflow_parent_proc_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_dns_suffix": { + "path_match": "ipfix.cisco_nvzflow_dns_suffix", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_dst_hostname": { + "path_match": "ipfix.cisco_nvzflow_dst_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_l4_bytes_in": { + "path_match": "ipfix.cisco_nvzflow_l4_bytes_in", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_nvzflow_l4_bytes_out": { + "path_match": "ipfix.cisco_nvzflow_l4_bytes_out", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_nvzflow_os_edition": { + "path_match": "ipfix.cisco_nvzflow_os_edition", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_module_list": { + "path_match": "ipfix.cisco_nvzflow_module_list", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_hash_list": { + "path_match": "ipfix.cisco_nvzflow_hash_list", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_coord_list": { + "path_match": "ipfix.cisco_nvzflow_coord_list", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_iface_info_uid": { + "path_match": "ipfix.cisco_nvzflow_iface_info_uid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_nvzflow_iface_index": { + "path_match": "ipfix.cisco_nvzflow_iface_index", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_nvzflow_iface_type": { + "path_match": "ipfix.cisco_nvzflow_iface_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_nvzflow_iface_name": { + "path_match": "ipfix.cisco_nvzflow_iface_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_nvzflow_iface_details_list": { + "path_match": "ipfix.cisco_nvzflow_iface_details_list", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.cisco_timestamp_abs_monitor_interval_start": { + "path_match": "ipfix.cisco_timestamp_abs_monitor_interval_start", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.cisco_timestamp_abs_monitor_interval_end": { + "path_match": "ipfix.cisco_timestamp_abs_monitor_interval_end", + "mapping": { + "type": "long" + } + } + }, - { - "ipfix.f5_msg_sev": { - "path_match": "ipfix.f5_msg_sev", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_partition": { - "path_match": "ipfix.f5_partition", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_err_defs_msg_num": { - "path_match": "ipfix.f5_err_defs_msg_num", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_bigip_mgmt_ipv4_addr": { - "path_match": "ipfix.f5_bigip_mgmt_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.f5_bigip_mgmt_ipv6_addr": { - "path_match": "ipfix.f5_bigip_mgmt_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.f5_query_name": { - "path_match": "ipfix.f5_query_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_dns_query_type": { - "path_match": "ipfix.f5_dns_query_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_context_name": { - "path_match": "ipfix.f5_context_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_bigip_hostname": { - "path_match": "ipfix.f5_bigip_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_device_vendor": { - "path_match": "ipfix.f5_device_vendor", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_device_product": { - "path_match": "ipfix.f5_device_product", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_device_ver": { - "path_match": "ipfix.f5_device_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_msg": { - "path_match": "ipfix.f5_msg", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_vlan": { - "path_match": "ipfix.f5_vlan", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_ipfix_msg_no": { - "path_match": "ipfix.f5_ipfix_msg_no", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_attack_id": { - "path_match": "ipfix.f5_attack_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_attack": { - "path_match": "ipfix.f5_attack", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_packets_rcvd": { - "path_match": "ipfix.f5_packets_rcvd", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_packets_drop": { - "path_match": "ipfix.f5_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_context_type": { - "path_match": "ipfix.f5_context_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_acl_policy_type": { - "path_match": "ipfix.f5_acl_policy_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_acl_policy": { - "path_match": "ipfix.f5_acl_policy", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_trans_ip_proto": { - "path_match": "ipfix.f5_trans_ip_proto", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_trans_src_ipv4_addr": { - "path_match": "ipfix.f5_trans_src_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.f5_trans_src_ipv6_addr": { - "path_match": "ipfix.f5_trans_src_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.f5_trans_src_port": { - "path_match": "ipfix.f5_trans_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_trans_dst_ipv4_addr": { - "path_match": "ipfix.f5_trans_dst_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.f5_trans_dst_ipv6_addr": { - "path_match": "ipfix.f5_trans_dst_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.f5_trans_dst_port": { - "path_match": "ipfix.f5_trans_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_trans_vlan": { - "path_match": "ipfix.f5_trans_vlan", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_trans_route_domain": { - "path_match": "ipfix.f5_trans_route_domain", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_sa_trans_type": { - "path_match": "ipfix.f5_sa_trans_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_sa_trans_pool": { - "path_match": "ipfix.f5_sa_trans_pool", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_acl_rule": { - "path_match": "ipfix.f5_acl_rule", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_action": { - "path_match": "ipfix.f5_action", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_drop_reason": { - "path_match": "ipfix.f5_drop_reason", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_attack_event": { - "path_match": "ipfix.f5_attack_event", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_ip_intel_threat_name": { - "path_match": "ipfix.f5_ip_intel_threat_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_destination_geo": { - "path_match": "ipfix.f5_destination_geo", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_source_geo": { - "path_match": "ipfix.f5_source_geo", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_ip_intel_policy_name": { - "path_match": "ipfix.f5_ip_intel_policy_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_attack_type": { - "path_match": "ipfix.f5_attack_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_app_category": { - "path_match": "ipfix.f5_app_category", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_classification": { - "path_match": "ipfix.f5_classification", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_flow_start_millis": { - "path_match": "ipfix.f5_flow_start_millis", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_flow_start_secs": { - "path_match": "ipfix.f5_flow_start_secs", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_flow_stop_millis": { - "path_match": "ipfix.f5_flow_stop_millis", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_flow_stop_secs": { - "path_match": "ipfix.f5_flow_stop_secs", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_record_type": { - "path_match": "ipfix.f5_record_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_report_id": { - "path_match": "ipfix.f5_report_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_report_ver": { - "path_match": "ipfix.f5_report_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_3gpp_params": { - "path_match": "ipfix.f5_3gpp_params", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_concurrent_flows": { - "path_match": "ipfix.f5_concurrent_flows", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_duration_secs": { - "path_match": "ipfix.f5_duration_secs", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_last_record_sent": { - "path_match": "ipfix.f5_last_record_sent", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_new_flows": { - "path_match": "ipfix.f5_new_flows", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_record_reason": { - "path_match": "ipfix.f5_record_reason", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_success_transacts": { - "path_match": "ipfix.f5_success_transacts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_terminated_flows": { - "path_match": "ipfix.f5_terminated_flows", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_subscriber_id": { - "path_match": "ipfix.f5_subscriber_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_subscriber_id_type": { - "path_match": "ipfix.f5_subscriber_id_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_total_transacts": { - "path_match": "ipfix.f5_total_transacts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_http_hostname": { - "path_match": "ipfix.f5_http_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_http_hostname_trunc": { - "path_match": "ipfix.f5_http_hostname_trunc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_http_resp_code": { - "path_match": "ipfix.f5_http_resp_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_http_url": { - "path_match": "ipfix.f5_http_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_http_url_trunc": { - "path_match": "ipfix.f5_http_url_trunc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_http_user_agent": { - "path_match": "ipfix.f5_http_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_http_user_agent_trunc": { - "path_match": "ipfix.f5_http_user_agent_trunc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_transacts": { - "path_match": "ipfix.f5_transacts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_skipped_transacts": { - "path_match": "ipfix.f5_skipped_transacts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_transact_start_millis": { - "path_match": "ipfix.f5_transact_start_millis", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_transact_start_secs": { - "path_match": "ipfix.f5_transact_start_secs", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_transact_stop_millis": { - "path_match": "ipfix.f5_transact_stop_millis", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_transact_stop_secs": { - "path_match": "ipfix.f5_transact_stop_secs", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_url_category": { - "path_match": "ipfix.f5_url_category", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_downlink_volume": { - "path_match": "ipfix.f5_downlink_volume", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_uplink_volume": { - "path_match": "ipfix.f5_uplink_volume", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_observation_time_secs": { - "path_match": "ipfix.f5_observation_time_secs", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_timestamp_millis": { - "path_match": "ipfix.f5_timestamp_millis", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_vlan_id": { - "path_match": "ipfix.f5_vlan_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_source_user": { - "path_match": "ipfix.f5_source_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_log_profile": { - "path_match": "ipfix.f5_log_profile", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_log_msg_drops": { - "path_match": "ipfix.f5_log_msg_drops", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.f5_log_msg_name": { - "path_match": "ipfix.f5_log_msg_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_src_fqdn": { - "path_match": "ipfix.f5_src_fqdn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.f5_dst_fqdn": { - "path_match": "ipfix.f5_dst_fqdn", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.f5_msg_sev": { + "path_match": "ipfix.f5_msg_sev", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_partition": { + "path_match": "ipfix.f5_partition", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_err_defs_msg_num": { + "path_match": "ipfix.f5_err_defs_msg_num", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_bigip_mgmt_ipv4_addr": { + "path_match": "ipfix.f5_bigip_mgmt_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.f5_bigip_mgmt_ipv6_addr": { + "path_match": "ipfix.f5_bigip_mgmt_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.f5_query_name": { + "path_match": "ipfix.f5_query_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_dns_query_type": { + "path_match": "ipfix.f5_dns_query_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_context_name": { + "path_match": "ipfix.f5_context_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_bigip_hostname": { + "path_match": "ipfix.f5_bigip_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_device_vendor": { + "path_match": "ipfix.f5_device_vendor", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_device_product": { + "path_match": "ipfix.f5_device_product", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_device_ver": { + "path_match": "ipfix.f5_device_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_msg": { + "path_match": "ipfix.f5_msg", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_vlan": { + "path_match": "ipfix.f5_vlan", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_ipfix_msg_no": { + "path_match": "ipfix.f5_ipfix_msg_no", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_attack_id": { + "path_match": "ipfix.f5_attack_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_attack": { + "path_match": "ipfix.f5_attack", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_packets_rcvd": { + "path_match": "ipfix.f5_packets_rcvd", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_packets_drop": { + "path_match": "ipfix.f5_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_context_type": { + "path_match": "ipfix.f5_context_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_acl_policy_type": { + "path_match": "ipfix.f5_acl_policy_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_acl_policy": { + "path_match": "ipfix.f5_acl_policy", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_trans_ip_proto": { + "path_match": "ipfix.f5_trans_ip_proto", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_trans_src_ipv4_addr": { + "path_match": "ipfix.f5_trans_src_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.f5_trans_src_ipv6_addr": { + "path_match": "ipfix.f5_trans_src_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.f5_trans_src_port": { + "path_match": "ipfix.f5_trans_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_trans_dst_ipv4_addr": { + "path_match": "ipfix.f5_trans_dst_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.f5_trans_dst_ipv6_addr": { + "path_match": "ipfix.f5_trans_dst_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.f5_trans_dst_port": { + "path_match": "ipfix.f5_trans_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_trans_vlan": { + "path_match": "ipfix.f5_trans_vlan", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_trans_route_domain": { + "path_match": "ipfix.f5_trans_route_domain", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_sa_trans_type": { + "path_match": "ipfix.f5_sa_trans_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_sa_trans_pool": { + "path_match": "ipfix.f5_sa_trans_pool", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_acl_rule": { + "path_match": "ipfix.f5_acl_rule", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_action": { + "path_match": "ipfix.f5_action", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_drop_reason": { + "path_match": "ipfix.f5_drop_reason", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_attack_event": { + "path_match": "ipfix.f5_attack_event", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_ip_intel_threat_name": { + "path_match": "ipfix.f5_ip_intel_threat_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_destination_geo": { + "path_match": "ipfix.f5_destination_geo", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_source_geo": { + "path_match": "ipfix.f5_source_geo", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_ip_intel_policy_name": { + "path_match": "ipfix.f5_ip_intel_policy_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_attack_type": { + "path_match": "ipfix.f5_attack_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_app_category": { + "path_match": "ipfix.f5_app_category", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_classification": { + "path_match": "ipfix.f5_classification", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_flow_start_millis": { + "path_match": "ipfix.f5_flow_start_millis", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_flow_start_secs": { + "path_match": "ipfix.f5_flow_start_secs", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_flow_stop_millis": { + "path_match": "ipfix.f5_flow_stop_millis", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_flow_stop_secs": { + "path_match": "ipfix.f5_flow_stop_secs", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_record_type": { + "path_match": "ipfix.f5_record_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_report_id": { + "path_match": "ipfix.f5_report_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_report_ver": { + "path_match": "ipfix.f5_report_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_3gpp_params": { + "path_match": "ipfix.f5_3gpp_params", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_concurrent_flows": { + "path_match": "ipfix.f5_concurrent_flows", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_duration_secs": { + "path_match": "ipfix.f5_duration_secs", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_last_record_sent": { + "path_match": "ipfix.f5_last_record_sent", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_new_flows": { + "path_match": "ipfix.f5_new_flows", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_record_reason": { + "path_match": "ipfix.f5_record_reason", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_success_transacts": { + "path_match": "ipfix.f5_success_transacts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_terminated_flows": { + "path_match": "ipfix.f5_terminated_flows", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_subscriber_id": { + "path_match": "ipfix.f5_subscriber_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_subscriber_id_type": { + "path_match": "ipfix.f5_subscriber_id_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_total_transacts": { + "path_match": "ipfix.f5_total_transacts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_http_hostname": { + "path_match": "ipfix.f5_http_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_http_hostname_trunc": { + "path_match": "ipfix.f5_http_hostname_trunc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_http_resp_code": { + "path_match": "ipfix.f5_http_resp_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_http_url": { + "path_match": "ipfix.f5_http_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_http_url_trunc": { + "path_match": "ipfix.f5_http_url_trunc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_http_user_agent": { + "path_match": "ipfix.f5_http_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_http_user_agent_trunc": { + "path_match": "ipfix.f5_http_user_agent_trunc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_transacts": { + "path_match": "ipfix.f5_transacts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_skipped_transacts": { + "path_match": "ipfix.f5_skipped_transacts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_transact_start_millis": { + "path_match": "ipfix.f5_transact_start_millis", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_transact_start_secs": { + "path_match": "ipfix.f5_transact_start_secs", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_transact_stop_millis": { + "path_match": "ipfix.f5_transact_stop_millis", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_transact_stop_secs": { + "path_match": "ipfix.f5_transact_stop_secs", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_url_category": { + "path_match": "ipfix.f5_url_category", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_downlink_volume": { + "path_match": "ipfix.f5_downlink_volume", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_uplink_volume": { + "path_match": "ipfix.f5_uplink_volume", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_observation_time_secs": { + "path_match": "ipfix.f5_observation_time_secs", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_timestamp_millis": { + "path_match": "ipfix.f5_timestamp_millis", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_vlan_id": { + "path_match": "ipfix.f5_vlan_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_source_user": { + "path_match": "ipfix.f5_source_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_log_profile": { + "path_match": "ipfix.f5_log_profile", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_log_msg_drops": { + "path_match": "ipfix.f5_log_msg_drops", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.f5_log_msg_name": { + "path_match": "ipfix.f5_log_msg_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_src_fqdn": { + "path_match": "ipfix.f5_src_fqdn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.f5_dst_fqdn": { + "path_match": "ipfix.f5_dst_fqdn", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.flowmon_http_hostname": { - "path_match": "ipfix.flowmon_http_hostname", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.flowmon_http_hostname": { + "path_match": "ipfix.flowmon_http_hostname", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.gigamon_http_req_url": { - "path_match": "ipfix.gigamon_http_req_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_http_resp_status": { - "path_match": "ipfix.gigamon_http_resp_status", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_ssl_cert_issuer_common": { - "path_match": "ipfix.gigamon_ssl_cert_issuer_common", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_subj_common": { - "path_match": "ipfix.gigamon_ssl_cert_subj_common", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_issuer": { - "path_match": "ipfix.gigamon_ssl_cert_issuer", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_subj": { - "path_match": "ipfix.gigamon_ssl_cert_subj", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_valid_not_before": { - "path_match": "ipfix.gigamon_ssl_cert_valid_not_before", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_valid_not_after": { - "path_match": "ipfix.gigamon_ssl_cert_valid_not_after", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_serial_num": { - "path_match": "ipfix.gigamon_ssl_cert_serial_num", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_sig_algo": { - "path_match": "ipfix.gigamon_ssl_cert_sig_algo", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_subj_pub_algo": { - "path_match": "ipfix.gigamon_ssl_cert_subj_pub_algo", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_cert_subj_pubkey_size": { - "path_match": "ipfix.gigamon_ssl_cert_subj_pubkey_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_ssl_cert_subj_alt_name": { - "path_match": "ipfix.gigamon_ssl_cert_subj_alt_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_server_name_ind": { - "path_match": "ipfix.gigamon_ssl_server_name_ind", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_ssl_server_ver": { - "path_match": "ipfix.gigamon_ssl_server_ver", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_ssl_server_cipher": { - "path_match": "ipfix.gigamon_ssl_server_cipher", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_ssl_server_compress_method": { - "path_match": "ipfix.gigamon_ssl_server_compress_method", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_ssl_server_sess_id": { - "path_match": "ipfix.gigamon_ssl_server_sess_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_dns_id": { - "path_match": "ipfix.gigamon_dns_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_op_code": { - "path_match": "ipfix.gigamon_dns_op_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_resp_code": { - "path_match": "ipfix.gigamon_dns_resp_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_query": { - "path_match": "ipfix.gigamon_dns_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_dns_resp": { - "path_match": "ipfix.gigamon_dns_resp", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_dns_resp_ttl": { - "path_match": "ipfix.gigamon_dns_resp_ttl", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_resp_ipv4_addr": { - "path_match": "ipfix.gigamon_dns_resp_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.gigamon_dns_resp_ipv6_addr": { - "path_match": "ipfix.gigamon_dns_resp_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.gigamon_dns_bits": { - "path_match": "ipfix.gigamon_dns_bits", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_dns_qd_count": { - "path_match": "ipfix.gigamon_dns_qd_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_an_count": { - "path_match": "ipfix.gigamon_dns_an_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_ns_count": { - "path_match": "ipfix.gigamon_dns_ns_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_ar_count": { - "path_match": "ipfix.gigamon_dns_ar_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_query_type": { - "path_match": "ipfix.gigamon_dns_query_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_query_class": { - "path_match": "ipfix.gigamon_dns_query_class", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_resp_type": { - "path_match": "ipfix.gigamon_dns_resp_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_resp_class": { - "path_match": "ipfix.gigamon_dns_resp_class", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_resp_rd_len": { - "path_match": "ipfix.gigamon_dns_resp_rd_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_resp_rdata": { - "path_match": "ipfix.gigamon_dns_resp_rdata", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_dns_auth_name": { - "path_match": "ipfix.gigamon_dns_auth_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_dns_auth_type": { - "path_match": "ipfix.gigamon_dns_auth_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_auth_class": { - "path_match": "ipfix.gigamon_dns_auth_class", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_auth_ttl": { - "path_match": "ipfix.gigamon_dns_auth_ttl", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_auth_rd_len": { - "path_match": "ipfix.gigamon_dns_auth_rd_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_authority_rdata": { - "path_match": "ipfix.gigamon_dns_authority_rdata", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_dns_addl_name": { - "path_match": "ipfix.gigamon_dns_addl_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.gigamon_dns_addl_type": { - "path_match": "ipfix.gigamon_dns_addl_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_addl_class": { - "path_match": "ipfix.gigamon_dns_addl_class", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_addl_ttl": { - "path_match": "ipfix.gigamon_dns_addl_ttl", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_addl_rd_len": { - "path_match": "ipfix.gigamon_dns_addl_rd_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.gigamon_dns_addl_rdata": { - "path_match": "ipfix.gigamon_dns_addl_rdata", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.gigamon_http_req_url": { + "path_match": "ipfix.gigamon_http_req_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_http_resp_status": { + "path_match": "ipfix.gigamon_http_resp_status", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_ssl_cert_issuer_common": { + "path_match": "ipfix.gigamon_ssl_cert_issuer_common", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_subj_common": { + "path_match": "ipfix.gigamon_ssl_cert_subj_common", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_issuer": { + "path_match": "ipfix.gigamon_ssl_cert_issuer", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_subj": { + "path_match": "ipfix.gigamon_ssl_cert_subj", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_valid_not_before": { + "path_match": "ipfix.gigamon_ssl_cert_valid_not_before", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_valid_not_after": { + "path_match": "ipfix.gigamon_ssl_cert_valid_not_after", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_serial_num": { + "path_match": "ipfix.gigamon_ssl_cert_serial_num", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_sig_algo": { + "path_match": "ipfix.gigamon_ssl_cert_sig_algo", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_subj_pub_algo": { + "path_match": "ipfix.gigamon_ssl_cert_subj_pub_algo", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_cert_subj_pubkey_size": { + "path_match": "ipfix.gigamon_ssl_cert_subj_pubkey_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_ssl_cert_subj_alt_name": { + "path_match": "ipfix.gigamon_ssl_cert_subj_alt_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_server_name_ind": { + "path_match": "ipfix.gigamon_ssl_server_name_ind", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_ssl_server_ver": { + "path_match": "ipfix.gigamon_ssl_server_ver", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_ssl_server_cipher": { + "path_match": "ipfix.gigamon_ssl_server_cipher", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_ssl_server_compress_method": { + "path_match": "ipfix.gigamon_ssl_server_compress_method", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_ssl_server_sess_id": { + "path_match": "ipfix.gigamon_ssl_server_sess_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_dns_id": { + "path_match": "ipfix.gigamon_dns_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_op_code": { + "path_match": "ipfix.gigamon_dns_op_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_resp_code": { + "path_match": "ipfix.gigamon_dns_resp_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_query": { + "path_match": "ipfix.gigamon_dns_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_dns_resp": { + "path_match": "ipfix.gigamon_dns_resp", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_dns_resp_ttl": { + "path_match": "ipfix.gigamon_dns_resp_ttl", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_resp_ipv4_addr": { + "path_match": "ipfix.gigamon_dns_resp_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.gigamon_dns_resp_ipv6_addr": { + "path_match": "ipfix.gigamon_dns_resp_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.gigamon_dns_bits": { + "path_match": "ipfix.gigamon_dns_bits", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_dns_qd_count": { + "path_match": "ipfix.gigamon_dns_qd_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_an_count": { + "path_match": "ipfix.gigamon_dns_an_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_ns_count": { + "path_match": "ipfix.gigamon_dns_ns_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_ar_count": { + "path_match": "ipfix.gigamon_dns_ar_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_query_type": { + "path_match": "ipfix.gigamon_dns_query_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_query_class": { + "path_match": "ipfix.gigamon_dns_query_class", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_resp_type": { + "path_match": "ipfix.gigamon_dns_resp_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_resp_class": { + "path_match": "ipfix.gigamon_dns_resp_class", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_resp_rd_len": { + "path_match": "ipfix.gigamon_dns_resp_rd_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_resp_rdata": { + "path_match": "ipfix.gigamon_dns_resp_rdata", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_dns_auth_name": { + "path_match": "ipfix.gigamon_dns_auth_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_dns_auth_type": { + "path_match": "ipfix.gigamon_dns_auth_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_auth_class": { + "path_match": "ipfix.gigamon_dns_auth_class", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_auth_ttl": { + "path_match": "ipfix.gigamon_dns_auth_ttl", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_auth_rd_len": { + "path_match": "ipfix.gigamon_dns_auth_rd_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_authority_rdata": { + "path_match": "ipfix.gigamon_dns_authority_rdata", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_dns_addl_name": { + "path_match": "ipfix.gigamon_dns_addl_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.gigamon_dns_addl_type": { + "path_match": "ipfix.gigamon_dns_addl_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_addl_class": { + "path_match": "ipfix.gigamon_dns_addl_class", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_addl_ttl": { + "path_match": "ipfix.gigamon_dns_addl_ttl", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_addl_rd_len": { + "path_match": "ipfix.gigamon_dns_addl_rd_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.gigamon_dns_addl_rdata": { + "path_match": "ipfix.gigamon_dns_addl_rdata", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.ipt_mark": { - "path_match": "ipfix.ipt_mark", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ipt_conntrack_id": { - "path_match": "ipfix.ipt_conntrack_id", - "mapping": { - "type": "long" - } - } - }, + { + "ipfix.ipt_mark": { + "path_match": "ipfix.ipt_mark", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ipt_conntrack_id": { + "path_match": "ipfix.ipt_conntrack_id", + "mapping": { + "type": "long" + } + } + }, - - { - "ipfix.ixia_l7_app_id": { - "path_match": "ipfix.ixia_l7_app_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ixia_l7_app": { - "path_match": "ipfix.ixia_l7_app", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_src_country_code": { - "path_match": "ipfix.ixia_src_country_code", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_src_country": { - "path_match": "ipfix.ixia_src_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_src_region_code": { - "path_match": "ipfix.ixia_src_region_code", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_src_region": { - "path_match": "ipfix.ixia_src_region", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_src_city": { - "path_match": "ipfix.ixia_src_city", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_src_latitude": { - "path_match": "ipfix.ixia_src_latitude", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.ixia_src_longitude": { - "path_match": "ipfix.ixia_src_longitude", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.ixia_dst_country_code": { - "path_match": "ipfix.ixia_dst_country_code", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dst_country": { - "path_match": "ipfix.ixia_dst_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dst_region_code": { - "path_match": "ipfix.ixia_dst_region_code", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dst_region": { - "path_match": "ipfix.ixia_dst_region", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dst_city": { - "path_match": "ipfix.ixia_dst_city", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dst_latitude": { - "path_match": "ipfix.ixia_dst_latitude", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.ixia_dst_longitude": { - "path_match": "ipfix.ixia_dst_longitude", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.ixia_device_id": { - "path_match": "ipfix.ixia_device_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ixia_device": { - "path_match": "ipfix.ixia_device", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_browser_id": { - "path_match": "ipfix.ixia_browser_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ixia_browser": { - "path_match": "ipfix.ixia_browser", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_rev_bytes_delta": { - "path_match": "ipfix.ixia_rev_bytes_delta", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ixia_rev_packets_delta": { - "path_match": "ipfix.ixia_rev_packets_delta", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ixia_encrypt_type": { - "path_match": "ipfix.ixia_encrypt_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_encrypt_cipher": { - "path_match": "ipfix.ixia_encrypt_cipher", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_encrypt_key_len": { - "path_match": "ipfix.ixia_encrypt_key_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ixia_imsi_subscriber": { - "path_match": "ipfix.ixia_imsi_subscriber", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_http_user_agent": { - "path_match": "ipfix.ixia_http_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_http_hostname": { - "path_match": "ipfix.ixia_http_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_http_uri": { - "path_match": "ipfix.ixia_http_uri", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dns_record_txt": { - "path_match": "ipfix.ixia_dns_record_txt", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_src_as": { - "path_match": "ipfix.ixia_src_as", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dst_as": { - "path_match": "ipfix.ixia_dst_as", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_latency": { - "path_match": "ipfix.ixia_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ixia_dns_query": { - "path_match": "ipfix.ixia_dns_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dns_answer": { - "path_match": "ipfix.ixia_dns_answer", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_dns_classes": { - "path_match": "ipfix.ixia_dns_classes", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_threat_type": { - "path_match": "ipfix.ixia_threat_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ixia_threat_ipv4": { - "path_match": "ipfix.ixia_threat_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ixia_threat_ipv6": { - "path_match": "ipfix.ixia_threat_ipv6", - "mapping": { - "type": "ip" - } - } - }, + + { + "ipfix.ixia_l7_app_id": { + "path_match": "ipfix.ixia_l7_app_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ixia_l7_app": { + "path_match": "ipfix.ixia_l7_app", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_src_country_code": { + "path_match": "ipfix.ixia_src_country_code", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_src_country": { + "path_match": "ipfix.ixia_src_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_src_region_code": { + "path_match": "ipfix.ixia_src_region_code", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_src_region": { + "path_match": "ipfix.ixia_src_region", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_src_city": { + "path_match": "ipfix.ixia_src_city", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_src_latitude": { + "path_match": "ipfix.ixia_src_latitude", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.ixia_src_longitude": { + "path_match": "ipfix.ixia_src_longitude", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.ixia_dst_country_code": { + "path_match": "ipfix.ixia_dst_country_code", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dst_country": { + "path_match": "ipfix.ixia_dst_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dst_region_code": { + "path_match": "ipfix.ixia_dst_region_code", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dst_region": { + "path_match": "ipfix.ixia_dst_region", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dst_city": { + "path_match": "ipfix.ixia_dst_city", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dst_latitude": { + "path_match": "ipfix.ixia_dst_latitude", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.ixia_dst_longitude": { + "path_match": "ipfix.ixia_dst_longitude", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.ixia_device_id": { + "path_match": "ipfix.ixia_device_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ixia_device": { + "path_match": "ipfix.ixia_device", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_browser_id": { + "path_match": "ipfix.ixia_browser_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ixia_browser": { + "path_match": "ipfix.ixia_browser", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_rev_bytes_delta": { + "path_match": "ipfix.ixia_rev_bytes_delta", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ixia_rev_packets_delta": { + "path_match": "ipfix.ixia_rev_packets_delta", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ixia_encrypt_type": { + "path_match": "ipfix.ixia_encrypt_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_encrypt_cipher": { + "path_match": "ipfix.ixia_encrypt_cipher", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_encrypt_key_len": { + "path_match": "ipfix.ixia_encrypt_key_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ixia_imsi_subscriber": { + "path_match": "ipfix.ixia_imsi_subscriber", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_http_user_agent": { + "path_match": "ipfix.ixia_http_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_http_hostname": { + "path_match": "ipfix.ixia_http_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_http_uri": { + "path_match": "ipfix.ixia_http_uri", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dns_record_txt": { + "path_match": "ipfix.ixia_dns_record_txt", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_src_as": { + "path_match": "ipfix.ixia_src_as", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dst_as": { + "path_match": "ipfix.ixia_dst_as", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_latency": { + "path_match": "ipfix.ixia_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ixia_dns_query": { + "path_match": "ipfix.ixia_dns_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dns_answer": { + "path_match": "ipfix.ixia_dns_answer", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_dns_classes": { + "path_match": "ipfix.ixia_dns_classes", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_threat_type": { + "path_match": "ipfix.ixia_threat_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ixia_threat_ipv4": { + "path_match": "ipfix.ixia_threat_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ixia_threat_ipv6": { + "path_match": "ipfix.ixia_threat_ipv6", + "mapping": { + "type": "ip" + } + } + }, - { - "ipfix.netscaler_rtt": { - "path_match": "ipfix.netscaler_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_trans_id": { - "path_match": "ipfix.netscaler_trans_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_req_url": { - "path_match": "ipfix.netscaler_http_req_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_req_cookie": { - "path_match": "ipfix.netscaler_http_req_cookie", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_flow_flags": { - "path_match": "ipfix.netscaler_flow_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_conn_id": { - "path_match": "ipfix.netscaler_conn_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_syslog_pri": { - "path_match": "ipfix.netscaler_syslog_pri", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_syslog_msg": { - "path_match": "ipfix.netscaler_syslog_msg", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_syslog_timestamp": { - "path_match": "ipfix.netscaler_syslog_timestamp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_req_referrer": { - "path_match": "ipfix.netscaler_http_req_referrer", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_req_method": { - "path_match": "ipfix.netscaler_http_req_method", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_req_host": { - "path_match": "ipfix.netscaler_http_req_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_req_user_agent": { - "path_match": "ipfix.netscaler_http_req_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_resp_status": { - "path_match": "ipfix.netscaler_http_resp_status", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_resp_len": { - "path_match": "ipfix.netscaler_http_resp_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_server_ttfb": { - "path_match": "ipfix.netscaler_server_ttfb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_server_ttlb": { - "path_match": "ipfix.netscaler_server_ttlb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_app_incarnations": { - "path_match": "ipfix.netscaler_app_incarnations", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_app_id": { - "path_match": "ipfix.netscaler_app_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_app": { - "path_match": "ipfix.netscaler_app", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_req_rcv_fb": { - "path_match": "ipfix.netscaler_http_req_rcv_fb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_req_forw_fb": { - "path_match": "ipfix.netscaler_http_req_forw_fb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_res_rcv_fb": { - "path_match": "ipfix.netscaler_http_res_rcv_fb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_res_forw_fb": { - "path_match": "ipfix.netscaler_http_res_forw_fb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_req_rcv_lb": { - "path_match": "ipfix.netscaler_http_req_rcv_lb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_req_forw_lb": { - "path_match": "ipfix.netscaler_http_req_forw_lb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_main_page_id": { - "path_match": "ipfix.netscaler_main_page_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_main_page_core_id": { - "path_match": "ipfix.netscaler_main_page_core_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_client_interact_start_time": { - "path_match": "ipfix.netscaler_http_client_interact_start_time", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_client_render_end_time": { - "path_match": "ipfix.netscaler_http_client_render_end_time", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_client_render_start_time": { - "path_match": "ipfix.netscaler_http_client_render_start_time", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_app_template": { - "path_match": "ipfix.netscaler_app_template", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_client_interact_end_time": { - "path_match": "ipfix.netscaler_http_client_interact_end_time", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_res_rcv_lb": { - "path_match": "ipfix.netscaler_http_res_rcv_lb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_res_forw_lb": { - "path_match": "ipfix.netscaler_http_res_forw_lb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_app_unit_app_id": { - "path_match": "ipfix.netscaler_app_unit_app_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_db_login_flags": { - "path_match": "ipfix.netscaler_db_login_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_db_req_type": { - "path_match": "ipfix.netscaler_db_req_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_db_proto": { - "path_match": "ipfix.netscaler_db_proto", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_db_user": { - "path_match": "ipfix.netscaler_db_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_db_database": { - "path_match": "ipfix.netscaler_db_database", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_db_client_hostname": { - "path_match": "ipfix.netscaler_db_client_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_db_req_string": { - "path_match": "ipfix.netscaler_db_req_string", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_db_resp_status_string": { - "path_match": "ipfix.netscaler_db_resp_status_string", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_db_resp_status": { - "path_match": "ipfix.netscaler_db_resp_status", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_db_resp_len": { - "path_match": "ipfix.netscaler_db_resp_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_client_rtt": { - "path_match": "ipfix.netscaler_client_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_content_type": { - "path_match": "ipfix.netscaler_http_content_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_req_auth": { - "path_match": "ipfix.netscaler_http_req_auth", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_req_via": { - "path_match": "ipfix.netscaler_http_req_via", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_res_location": { - "path_match": "ipfix.netscaler_http_res_location", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_res_set_cookie": { - "path_match": "ipfix.netscaler_http_res_set_cookie", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_res_set_cookie2": { - "path_match": "ipfix.netscaler_http_res_set_cookie2", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_http_req_x_forwarded_for": { - "path_match": "ipfix.netscaler_http_req_x_forwarded_for", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_conn_chain_id": { - "path_match": "ipfix.netscaler_conn_chain_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_conn_chain_hop_count": { - "path_match": "ipfix.netscaler_conn_chain_hop_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_sess_guid": { - "path_match": "ipfix.netscaler_ica_sess_guid", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_ica_client_ver": { - "path_match": "ipfix.netscaler_ica_client_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_ica_client_type": { - "path_match": "ipfix.netscaler_ica_client_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_client_ip": { - "path_match": "ipfix.netscaler_ica_client_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.netscaler_ica_client_hostname": { - "path_match": "ipfix.netscaler_ica_client_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_aaa_user": { - "path_match": "ipfix.netscaler_aaa_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_ica_domain": { - "path_match": "ipfix.netscaler_ica_domain", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_ica_client_launcher": { - "path_match": "ipfix.netscaler_ica_client_launcher", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_sess_setup_time": { - "path_match": "ipfix.netscaler_ica_sess_setup_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_server": { - "path_match": "ipfix.netscaler_ica_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_ica_sess_reconnects": { - "path_match": "ipfix.netscaler_ica_sess_reconnects", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_rtt": { - "path_match": "ipfix.netscaler_ica_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_rx_bytes": { - "path_match": "ipfix.netscaler_ica_clientside_rx_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_tx_bytes": { - "path_match": "ipfix.netscaler_ica_clientside_tx_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_packets_retrans": { - "path_match": "ipfix.netscaler_ica_clientside_packets_retrans", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_serverside_packets_retrans": { - "path_match": "ipfix.netscaler_ica_serverside_packets_retrans", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_rtt": { - "path_match": "ipfix.netscaler_ica_clientside_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_serverside_rtt": { - "path_match": "ipfix.netscaler_ica_serverside_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_sess_update_begin_sec": { - "path_match": "ipfix.netscaler_ica_sess_update_begin_sec", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_sess_update_end_sec": { - "path_match": "ipfix.netscaler_ica_sess_update_end_sec", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id1": { - "path_match": "ipfix.netscaler_ica_channel_id1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id1_bytes": { - "path_match": "ipfix.netscaler_ica_channel_id1_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id2": { - "path_match": "ipfix.netscaler_ica_channel_id2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id2_bytes": { - "path_match": "ipfix.netscaler_ica_channel_id2_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id3": { - "path_match": "ipfix.netscaler_ica_channel_id3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id3_bytes": { - "path_match": "ipfix.netscaler_ica_channel_id3_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id4": { - "path_match": "ipfix.netscaler_ica_channel_id4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id4_bytes": { - "path_match": "ipfix.netscaler_ica_channel_id4_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id5": { - "path_match": "ipfix.netscaler_ica_channel_id5", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_channel_id5_bytes": { - "path_match": "ipfix.netscaler_ica_channel_id5_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_conn_pri": { - "path_match": "ipfix.netscaler_ica_conn_pri", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_app_start_duration": { - "path_match": "ipfix.netscaler_app_start_duration", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_launch_mechanism": { - "path_match": "ipfix.netscaler_ica_launch_mechanism", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_app": { - "path_match": "ipfix.netscaler_ica_app", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_app_start_time": { - "path_match": "ipfix.netscaler_app_start_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_app_term_type": { - "path_match": "ipfix.netscaler_ica_app_term_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_app_term_time": { - "path_match": "ipfix.netscaler_ica_app_term_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_sess_end_time": { - "path_match": "ipfix.netscaler_ica_sess_end_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_jitter": { - "path_match": "ipfix.netscaler_ica_clientside_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_serverside_jitter": { - "path_match": "ipfix.netscaler_ica_serverside_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_app_pid": { - "path_match": "ipfix.netscaler_ica_app_pid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_app_module_path": { - "path_match": "ipfix.netscaler_ica_app_module_path", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_ica_device_serial_no": { - "path_match": "ipfix.netscaler_ica_device_serial_no", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_msi_client_cookie": { - "path_match": "ipfix.netscaler_msi_client_cookie", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_ica_flags": { - "path_match": "ipfix.netscaler_ica_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_user": { - "path_match": "ipfix.netscaler_ica_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_license_type": { - "path_match": "ipfix.netscaler_license_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_max_licenses": { - "path_match": "ipfix.netscaler_max_licenses", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_licenses_used": { - "path_match": "ipfix.netscaler_licenses_used", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_network_update_start_time": { - "path_match": "ipfix.netscaler_ica_network_update_start_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_network_update_end_time": { - "path_match": "ipfix.netscaler_ica_network_update_end_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_srtt": { - "path_match": "ipfix.netscaler_ica_clientside_srtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_serverside_srtt": { - "path_match": "ipfix.netscaler_ica_serverside_srtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_delay": { - "path_match": "ipfix.netscaler_ica_clientside_delay", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_serverside_delay": { - "path_match": "ipfix.netscaler_ica_serverside_delay", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_host_delay": { - "path_match": "ipfix.netscaler_ica_host_delay", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_window_size": { - "path_match": "ipfix.netscaler_ica_clientside_window_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_serverside_window_size": { - "path_match": "ipfix.netscaler_ica_serverside_window_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_clientside_rto_count": { - "path_match": "ipfix.netscaler_ica_clientside_rto_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_serverside_rto_count": { - "path_match": "ipfix.netscaler_ica_serverside_rto_count", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_l7_client_latency": { - "path_match": "ipfix.netscaler_ica_l7_client_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_ica_l7_server_latency": { - "path_match": "ipfix.netscaler_ica_l7_server_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_http_domain": { - "path_match": "ipfix.netscaler_http_domain", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_cache_redir_client_conn_core_id": { - "path_match": "ipfix.netscaler_cache_redir_client_conn_core_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_cache_redir_client_conn_trans_id": { - "path_match": "ipfix.netscaler_cache_redir_client_conn_trans_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_270": { - "path_match": "ipfix.netscaler_unk_270", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_271": { - "path_match": "ipfix.netscaler_unk_271", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_272": { - "path_match": "ipfix.netscaler_unk_272", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_273": { - "path_match": "ipfix.netscaler_unk_273", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_274": { - "path_match": "ipfix.netscaler_unk_274", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_275": { - "path_match": "ipfix.netscaler_unk_275", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_276": { - "path_match": "ipfix.netscaler_unk_276", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_277": { - "path_match": "ipfix.netscaler_unk_277", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_278": { - "path_match": "ipfix.netscaler_unk_278", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_279": { - "path_match": "ipfix.netscaler_unk_279", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_280": { - "path_match": "ipfix.netscaler_unk_280", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_281": { - "path_match": "ipfix.netscaler_unk_281", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_282": { - "path_match": "ipfix.netscaler_unk_282", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_283": { - "path_match": "ipfix.netscaler_unk_283", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_284": { - "path_match": "ipfix.netscaler_unk_284", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_285": { - "path_match": "ipfix.netscaler_unk_285", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_286": { - "path_match": "ipfix.netscaler_unk_286", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_287": { - "path_match": "ipfix.netscaler_unk_287", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_288": { - "path_match": "ipfix.netscaler_unk_288", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_289": { - "path_match": "ipfix.netscaler_unk_289", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_290": { - "path_match": "ipfix.netscaler_unk_290", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_291": { - "path_match": "ipfix.netscaler_unk_291", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_292": { - "path_match": "ipfix.netscaler_unk_292", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_293": { - "path_match": "ipfix.netscaler_unk_293", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_294": { - "path_match": "ipfix.netscaler_unk_294", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_295": { - "path_match": "ipfix.netscaler_unk_295", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_296": { - "path_match": "ipfix.netscaler_unk_296", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_297": { - "path_match": "ipfix.netscaler_unk_297", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_298": { - "path_match": "ipfix.netscaler_unk_298", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_299": { - "path_match": "ipfix.netscaler_unk_299", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_300": { - "path_match": "ipfix.netscaler_unk_300", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_301": { - "path_match": "ipfix.netscaler_unk_301", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_302": { - "path_match": "ipfix.netscaler_unk_302", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_303": { - "path_match": "ipfix.netscaler_unk_303", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_304": { - "path_match": "ipfix.netscaler_unk_304", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_305": { - "path_match": "ipfix.netscaler_unk_305", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_306": { - "path_match": "ipfix.netscaler_unk_306", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_307": { - "path_match": "ipfix.netscaler_unk_307", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_308": { - "path_match": "ipfix.netscaler_unk_308", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_309": { - "path_match": "ipfix.netscaler_unk_309", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_310": { - "path_match": "ipfix.netscaler_unk_310", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_311": { - "path_match": "ipfix.netscaler_unk_311", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_312": { - "path_match": "ipfix.netscaler_unk_312", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_313": { - "path_match": "ipfix.netscaler_unk_313", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_314": { - "path_match": "ipfix.netscaler_unk_314", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_315": { - "path_match": "ipfix.netscaler_unk_315", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_316": { - "path_match": "ipfix.netscaler_unk_316", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_317": { - "path_match": "ipfix.netscaler_unk_317", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_318": { - "path_match": "ipfix.netscaler_unk_318", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_319": { - "path_match": "ipfix.netscaler_unk_319", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_320": { - "path_match": "ipfix.netscaler_unk_320", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_321": { - "path_match": "ipfix.netscaler_unk_321", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_322": { - "path_match": "ipfix.netscaler_unk_322", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_323": { - "path_match": "ipfix.netscaler_unk_323", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_324": { - "path_match": "ipfix.netscaler_unk_324", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_325": { - "path_match": "ipfix.netscaler_unk_325", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_326": { - "path_match": "ipfix.netscaler_unk_326", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_327": { - "path_match": "ipfix.netscaler_unk_327", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_328": { - "path_match": "ipfix.netscaler_unk_328", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_329": { - "path_match": "ipfix.netscaler_unk_329", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_330": { - "path_match": "ipfix.netscaler_unk_330", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_331": { - "path_match": "ipfix.netscaler_unk_331", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_332": { - "path_match": "ipfix.netscaler_unk_332", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_333": { - "path_match": "ipfix.netscaler_unk_333", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_334": { - "path_match": "ipfix.netscaler_unk_334", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_335": { - "path_match": "ipfix.netscaler_unk_335", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_336": { - "path_match": "ipfix.netscaler_unk_336", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_337": { - "path_match": "ipfix.netscaler_unk_337", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_338": { - "path_match": "ipfix.netscaler_unk_338", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_339": { - "path_match": "ipfix.netscaler_unk_339", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_340": { - "path_match": "ipfix.netscaler_unk_340", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_341": { - "path_match": "ipfix.netscaler_unk_341", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_342": { - "path_match": "ipfix.netscaler_unk_342", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_343": { - "path_match": "ipfix.netscaler_unk_343", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_344": { - "path_match": "ipfix.netscaler_unk_344", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_345": { - "path_match": "ipfix.netscaler_unk_345", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_346": { - "path_match": "ipfix.netscaler_unk_346", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_347": { - "path_match": "ipfix.netscaler_unk_347", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_348": { - "path_match": "ipfix.netscaler_unk_348", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_349": { - "path_match": "ipfix.netscaler_unk_349", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_350": { - "path_match": "ipfix.netscaler_unk_350", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_351": { - "path_match": "ipfix.netscaler_unk_351", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_352": { - "path_match": "ipfix.netscaler_unk_352", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_353": { - "path_match": "ipfix.netscaler_unk_353", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_354": { - "path_match": "ipfix.netscaler_unk_354", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_355": { - "path_match": "ipfix.netscaler_unk_355", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_356": { - "path_match": "ipfix.netscaler_unk_356", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_357": { - "path_match": "ipfix.netscaler_unk_357", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_358": { - "path_match": "ipfix.netscaler_unk_358", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_359": { - "path_match": "ipfix.netscaler_unk_359", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_360": { - "path_match": "ipfix.netscaler_unk_360", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_361": { - "path_match": "ipfix.netscaler_unk_361", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_362": { - "path_match": "ipfix.netscaler_unk_362", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_363": { - "path_match": "ipfix.netscaler_unk_363", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_364": { - "path_match": "ipfix.netscaler_unk_364", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_365": { - "path_match": "ipfix.netscaler_unk_365", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_366": { - "path_match": "ipfix.netscaler_unk_366", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_367": { - "path_match": "ipfix.netscaler_unk_367", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_377": { - "path_match": "ipfix.netscaler_unk_377", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_380": { - "path_match": "ipfix.netscaler_unk_380", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_383": { - "path_match": "ipfix.netscaler_unk_383", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_384": { - "path_match": "ipfix.netscaler_unk_384", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_385": { - "path_match": "ipfix.netscaler_unk_385", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_386": { - "path_match": "ipfix.netscaler_unk_386", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_387": { - "path_match": "ipfix.netscaler_unk_387", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_388": { - "path_match": "ipfix.netscaler_unk_388", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_389": { - "path_match": "ipfix.netscaler_unk_389", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.netscaler_unk_391": { - "path_match": "ipfix.netscaler_unk_391", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_392": { - "path_match": "ipfix.netscaler_unk_392", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_393": { - "path_match": "ipfix.netscaler_unk_393", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_394": { - "path_match": "ipfix.netscaler_unk_394", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_398": { - "path_match": "ipfix.netscaler_unk_398", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_399": { - "path_match": "ipfix.netscaler_unk_399", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_400": { - "path_match": "ipfix.netscaler_unk_400", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_401": { - "path_match": "ipfix.netscaler_unk_401", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_402": { - "path_match": "ipfix.netscaler_unk_402", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_403": { - "path_match": "ipfix.netscaler_unk_403", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_404": { - "path_match": "ipfix.netscaler_unk_404", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_405": { - "path_match": "ipfix.netscaler_unk_405", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_408": { - "path_match": "ipfix.netscaler_unk_408", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_427": { - "path_match": "ipfix.netscaler_unk_427", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_429": { - "path_match": "ipfix.netscaler_unk_429", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_432": { - "path_match": "ipfix.netscaler_unk_432", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_433": { - "path_match": "ipfix.netscaler_unk_433", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_434": { - "path_match": "ipfix.netscaler_unk_434", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_435": { - "path_match": "ipfix.netscaler_unk_435", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_447": { - "path_match": "ipfix.netscaler_unk_447", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_448": { - "path_match": "ipfix.netscaler_unk_448", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_451": { - "path_match": "ipfix.netscaler_unk_451", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_452": { - "path_match": "ipfix.netscaler_unk_452", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_453": { - "path_match": "ipfix.netscaler_unk_453", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_455": { - "path_match": "ipfix.netscaler_unk_455", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_458": { - "path_match": "ipfix.netscaler_unk_458", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_459": { - "path_match": "ipfix.netscaler_unk_459", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_460": { - "path_match": "ipfix.netscaler_unk_460", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_461": { - "path_match": "ipfix.netscaler_unk_461", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_463": { - "path_match": "ipfix.netscaler_unk_463", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_464": { - "path_match": "ipfix.netscaler_unk_464", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_465": { - "path_match": "ipfix.netscaler_unk_465", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_466": { - "path_match": "ipfix.netscaler_unk_466", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_467": { - "path_match": "ipfix.netscaler_unk_467", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_468": { - "path_match": "ipfix.netscaler_unk_468", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_475": { - "path_match": "ipfix.netscaler_unk_475", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_476": { - "path_match": "ipfix.netscaler_unk_476", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_477": { - "path_match": "ipfix.netscaler_unk_477", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_478": { - "path_match": "ipfix.netscaler_unk_478", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_479": { - "path_match": "ipfix.netscaler_unk_479", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_480": { - "path_match": "ipfix.netscaler_unk_480", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_481": { - "path_match": "ipfix.netscaler_unk_481", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_487": { - "path_match": "ipfix.netscaler_unk_487", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_488": { - "path_match": "ipfix.netscaler_unk_488", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_489": { - "path_match": "ipfix.netscaler_unk_489", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_491": { - "path_match": "ipfix.netscaler_unk_491", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_492": { - "path_match": "ipfix.netscaler_unk_492", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_493": { - "path_match": "ipfix.netscaler_unk_493", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_494": { - "path_match": "ipfix.netscaler_unk_494", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_507": { - "path_match": "ipfix.netscaler_unk_507", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_508": { - "path_match": "ipfix.netscaler_unk_508", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_509": { - "path_match": "ipfix.netscaler_unk_509", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_510": { - "path_match": "ipfix.netscaler_unk_510", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_511": { - "path_match": "ipfix.netscaler_unk_511", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_512": { - "path_match": "ipfix.netscaler_unk_512", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_513": { - "path_match": "ipfix.netscaler_unk_513", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_514": { - "path_match": "ipfix.netscaler_unk_514", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_518": { - "path_match": "ipfix.netscaler_unk_518", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_519": { - "path_match": "ipfix.netscaler_unk_519", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_520": { - "path_match": "ipfix.netscaler_unk_520", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_521": { - "path_match": "ipfix.netscaler_unk_521", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_522": { - "path_match": "ipfix.netscaler_unk_522", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_523": { - "path_match": "ipfix.netscaler_unk_523", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_532": { - "path_match": "ipfix.netscaler_unk_532", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_533": { - "path_match": "ipfix.netscaler_unk_533", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_534": { - "path_match": "ipfix.netscaler_unk_534", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_535": { - "path_match": "ipfix.netscaler_unk_535", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_536": { - "path_match": "ipfix.netscaler_unk_536", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_537": { - "path_match": "ipfix.netscaler_unk_537", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_538": { - "path_match": "ipfix.netscaler_unk_538", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.netscaler_unk_541": { - "path_match": "ipfix.netscaler_unk_541", - "mapping": { - "type": "long" - } - } - }, + { + "ipfix.netscaler_rtt": { + "path_match": "ipfix.netscaler_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_trans_id": { + "path_match": "ipfix.netscaler_trans_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_req_url": { + "path_match": "ipfix.netscaler_http_req_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_req_cookie": { + "path_match": "ipfix.netscaler_http_req_cookie", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_flow_flags": { + "path_match": "ipfix.netscaler_flow_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_conn_id": { + "path_match": "ipfix.netscaler_conn_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_syslog_pri": { + "path_match": "ipfix.netscaler_syslog_pri", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_syslog_msg": { + "path_match": "ipfix.netscaler_syslog_msg", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_syslog_timestamp": { + "path_match": "ipfix.netscaler_syslog_timestamp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_req_referrer": { + "path_match": "ipfix.netscaler_http_req_referrer", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_req_method": { + "path_match": "ipfix.netscaler_http_req_method", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_req_host": { + "path_match": "ipfix.netscaler_http_req_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_req_user_agent": { + "path_match": "ipfix.netscaler_http_req_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_resp_status": { + "path_match": "ipfix.netscaler_http_resp_status", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_resp_len": { + "path_match": "ipfix.netscaler_http_resp_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_server_ttfb": { + "path_match": "ipfix.netscaler_server_ttfb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_server_ttlb": { + "path_match": "ipfix.netscaler_server_ttlb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_app_incarnations": { + "path_match": "ipfix.netscaler_app_incarnations", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_app_id": { + "path_match": "ipfix.netscaler_app_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_app": { + "path_match": "ipfix.netscaler_app", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_req_rcv_fb": { + "path_match": "ipfix.netscaler_http_req_rcv_fb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_req_forw_fb": { + "path_match": "ipfix.netscaler_http_req_forw_fb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_res_rcv_fb": { + "path_match": "ipfix.netscaler_http_res_rcv_fb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_res_forw_fb": { + "path_match": "ipfix.netscaler_http_res_forw_fb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_req_rcv_lb": { + "path_match": "ipfix.netscaler_http_req_rcv_lb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_req_forw_lb": { + "path_match": "ipfix.netscaler_http_req_forw_lb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_main_page_id": { + "path_match": "ipfix.netscaler_main_page_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_main_page_core_id": { + "path_match": "ipfix.netscaler_main_page_core_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_client_interact_start_time": { + "path_match": "ipfix.netscaler_http_client_interact_start_time", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_client_render_end_time": { + "path_match": "ipfix.netscaler_http_client_render_end_time", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_client_render_start_time": { + "path_match": "ipfix.netscaler_http_client_render_start_time", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_app_template": { + "path_match": "ipfix.netscaler_app_template", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_client_interact_end_time": { + "path_match": "ipfix.netscaler_http_client_interact_end_time", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_res_rcv_lb": { + "path_match": "ipfix.netscaler_http_res_rcv_lb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_res_forw_lb": { + "path_match": "ipfix.netscaler_http_res_forw_lb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_app_unit_app_id": { + "path_match": "ipfix.netscaler_app_unit_app_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_db_login_flags": { + "path_match": "ipfix.netscaler_db_login_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_db_req_type": { + "path_match": "ipfix.netscaler_db_req_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_db_proto": { + "path_match": "ipfix.netscaler_db_proto", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_db_user": { + "path_match": "ipfix.netscaler_db_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_db_database": { + "path_match": "ipfix.netscaler_db_database", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_db_client_hostname": { + "path_match": "ipfix.netscaler_db_client_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_db_req_string": { + "path_match": "ipfix.netscaler_db_req_string", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_db_resp_status_string": { + "path_match": "ipfix.netscaler_db_resp_status_string", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_db_resp_status": { + "path_match": "ipfix.netscaler_db_resp_status", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_db_resp_len": { + "path_match": "ipfix.netscaler_db_resp_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_client_rtt": { + "path_match": "ipfix.netscaler_client_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_content_type": { + "path_match": "ipfix.netscaler_http_content_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_req_auth": { + "path_match": "ipfix.netscaler_http_req_auth", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_req_via": { + "path_match": "ipfix.netscaler_http_req_via", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_res_location": { + "path_match": "ipfix.netscaler_http_res_location", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_res_set_cookie": { + "path_match": "ipfix.netscaler_http_res_set_cookie", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_res_set_cookie2": { + "path_match": "ipfix.netscaler_http_res_set_cookie2", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_http_req_x_forwarded_for": { + "path_match": "ipfix.netscaler_http_req_x_forwarded_for", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_conn_chain_id": { + "path_match": "ipfix.netscaler_conn_chain_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_conn_chain_hop_count": { + "path_match": "ipfix.netscaler_conn_chain_hop_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_sess_guid": { + "path_match": "ipfix.netscaler_ica_sess_guid", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_ica_client_ver": { + "path_match": "ipfix.netscaler_ica_client_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_ica_client_type": { + "path_match": "ipfix.netscaler_ica_client_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_client_ip": { + "path_match": "ipfix.netscaler_ica_client_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.netscaler_ica_client_hostname": { + "path_match": "ipfix.netscaler_ica_client_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_aaa_user": { + "path_match": "ipfix.netscaler_aaa_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_ica_domain": { + "path_match": "ipfix.netscaler_ica_domain", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_ica_client_launcher": { + "path_match": "ipfix.netscaler_ica_client_launcher", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_sess_setup_time": { + "path_match": "ipfix.netscaler_ica_sess_setup_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_server": { + "path_match": "ipfix.netscaler_ica_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_ica_sess_reconnects": { + "path_match": "ipfix.netscaler_ica_sess_reconnects", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_rtt": { + "path_match": "ipfix.netscaler_ica_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_rx_bytes": { + "path_match": "ipfix.netscaler_ica_clientside_rx_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_tx_bytes": { + "path_match": "ipfix.netscaler_ica_clientside_tx_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_packets_retrans": { + "path_match": "ipfix.netscaler_ica_clientside_packets_retrans", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_serverside_packets_retrans": { + "path_match": "ipfix.netscaler_ica_serverside_packets_retrans", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_rtt": { + "path_match": "ipfix.netscaler_ica_clientside_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_serverside_rtt": { + "path_match": "ipfix.netscaler_ica_serverside_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_sess_update_begin_sec": { + "path_match": "ipfix.netscaler_ica_sess_update_begin_sec", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_sess_update_end_sec": { + "path_match": "ipfix.netscaler_ica_sess_update_end_sec", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id1": { + "path_match": "ipfix.netscaler_ica_channel_id1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id1_bytes": { + "path_match": "ipfix.netscaler_ica_channel_id1_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id2": { + "path_match": "ipfix.netscaler_ica_channel_id2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id2_bytes": { + "path_match": "ipfix.netscaler_ica_channel_id2_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id3": { + "path_match": "ipfix.netscaler_ica_channel_id3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id3_bytes": { + "path_match": "ipfix.netscaler_ica_channel_id3_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id4": { + "path_match": "ipfix.netscaler_ica_channel_id4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id4_bytes": { + "path_match": "ipfix.netscaler_ica_channel_id4_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id5": { + "path_match": "ipfix.netscaler_ica_channel_id5", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_channel_id5_bytes": { + "path_match": "ipfix.netscaler_ica_channel_id5_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_conn_pri": { + "path_match": "ipfix.netscaler_ica_conn_pri", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_app_start_duration": { + "path_match": "ipfix.netscaler_app_start_duration", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_launch_mechanism": { + "path_match": "ipfix.netscaler_ica_launch_mechanism", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_app": { + "path_match": "ipfix.netscaler_ica_app", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_app_start_time": { + "path_match": "ipfix.netscaler_app_start_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_app_term_type": { + "path_match": "ipfix.netscaler_ica_app_term_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_app_term_time": { + "path_match": "ipfix.netscaler_ica_app_term_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_sess_end_time": { + "path_match": "ipfix.netscaler_ica_sess_end_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_jitter": { + "path_match": "ipfix.netscaler_ica_clientside_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_serverside_jitter": { + "path_match": "ipfix.netscaler_ica_serverside_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_app_pid": { + "path_match": "ipfix.netscaler_ica_app_pid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_app_module_path": { + "path_match": "ipfix.netscaler_ica_app_module_path", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_ica_device_serial_no": { + "path_match": "ipfix.netscaler_ica_device_serial_no", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_msi_client_cookie": { + "path_match": "ipfix.netscaler_msi_client_cookie", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_ica_flags": { + "path_match": "ipfix.netscaler_ica_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_user": { + "path_match": "ipfix.netscaler_ica_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_license_type": { + "path_match": "ipfix.netscaler_license_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_max_licenses": { + "path_match": "ipfix.netscaler_max_licenses", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_licenses_used": { + "path_match": "ipfix.netscaler_licenses_used", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_network_update_start_time": { + "path_match": "ipfix.netscaler_ica_network_update_start_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_network_update_end_time": { + "path_match": "ipfix.netscaler_ica_network_update_end_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_srtt": { + "path_match": "ipfix.netscaler_ica_clientside_srtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_serverside_srtt": { + "path_match": "ipfix.netscaler_ica_serverside_srtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_delay": { + "path_match": "ipfix.netscaler_ica_clientside_delay", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_serverside_delay": { + "path_match": "ipfix.netscaler_ica_serverside_delay", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_host_delay": { + "path_match": "ipfix.netscaler_ica_host_delay", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_window_size": { + "path_match": "ipfix.netscaler_ica_clientside_window_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_serverside_window_size": { + "path_match": "ipfix.netscaler_ica_serverside_window_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_clientside_rto_count": { + "path_match": "ipfix.netscaler_ica_clientside_rto_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_serverside_rto_count": { + "path_match": "ipfix.netscaler_ica_serverside_rto_count", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_l7_client_latency": { + "path_match": "ipfix.netscaler_ica_l7_client_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_ica_l7_server_latency": { + "path_match": "ipfix.netscaler_ica_l7_server_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_http_domain": { + "path_match": "ipfix.netscaler_http_domain", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_cache_redir_client_conn_core_id": { + "path_match": "ipfix.netscaler_cache_redir_client_conn_core_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_cache_redir_client_conn_trans_id": { + "path_match": "ipfix.netscaler_cache_redir_client_conn_trans_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_270": { + "path_match": "ipfix.netscaler_unk_270", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_271": { + "path_match": "ipfix.netscaler_unk_271", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_272": { + "path_match": "ipfix.netscaler_unk_272", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_273": { + "path_match": "ipfix.netscaler_unk_273", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_274": { + "path_match": "ipfix.netscaler_unk_274", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_275": { + "path_match": "ipfix.netscaler_unk_275", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_276": { + "path_match": "ipfix.netscaler_unk_276", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_277": { + "path_match": "ipfix.netscaler_unk_277", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_278": { + "path_match": "ipfix.netscaler_unk_278", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_279": { + "path_match": "ipfix.netscaler_unk_279", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_280": { + "path_match": "ipfix.netscaler_unk_280", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_281": { + "path_match": "ipfix.netscaler_unk_281", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_282": { + "path_match": "ipfix.netscaler_unk_282", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_283": { + "path_match": "ipfix.netscaler_unk_283", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_284": { + "path_match": "ipfix.netscaler_unk_284", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_285": { + "path_match": "ipfix.netscaler_unk_285", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_286": { + "path_match": "ipfix.netscaler_unk_286", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_287": { + "path_match": "ipfix.netscaler_unk_287", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_288": { + "path_match": "ipfix.netscaler_unk_288", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_289": { + "path_match": "ipfix.netscaler_unk_289", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_290": { + "path_match": "ipfix.netscaler_unk_290", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_291": { + "path_match": "ipfix.netscaler_unk_291", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_292": { + "path_match": "ipfix.netscaler_unk_292", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_293": { + "path_match": "ipfix.netscaler_unk_293", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_294": { + "path_match": "ipfix.netscaler_unk_294", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_295": { + "path_match": "ipfix.netscaler_unk_295", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_296": { + "path_match": "ipfix.netscaler_unk_296", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_297": { + "path_match": "ipfix.netscaler_unk_297", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_298": { + "path_match": "ipfix.netscaler_unk_298", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_299": { + "path_match": "ipfix.netscaler_unk_299", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_300": { + "path_match": "ipfix.netscaler_unk_300", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_301": { + "path_match": "ipfix.netscaler_unk_301", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_302": { + "path_match": "ipfix.netscaler_unk_302", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_303": { + "path_match": "ipfix.netscaler_unk_303", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_304": { + "path_match": "ipfix.netscaler_unk_304", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_305": { + "path_match": "ipfix.netscaler_unk_305", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_306": { + "path_match": "ipfix.netscaler_unk_306", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_307": { + "path_match": "ipfix.netscaler_unk_307", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_308": { + "path_match": "ipfix.netscaler_unk_308", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_309": { + "path_match": "ipfix.netscaler_unk_309", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_310": { + "path_match": "ipfix.netscaler_unk_310", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_311": { + "path_match": "ipfix.netscaler_unk_311", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_312": { + "path_match": "ipfix.netscaler_unk_312", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_313": { + "path_match": "ipfix.netscaler_unk_313", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_314": { + "path_match": "ipfix.netscaler_unk_314", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_315": { + "path_match": "ipfix.netscaler_unk_315", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_316": { + "path_match": "ipfix.netscaler_unk_316", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_317": { + "path_match": "ipfix.netscaler_unk_317", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_318": { + "path_match": "ipfix.netscaler_unk_318", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_319": { + "path_match": "ipfix.netscaler_unk_319", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_320": { + "path_match": "ipfix.netscaler_unk_320", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_321": { + "path_match": "ipfix.netscaler_unk_321", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_322": { + "path_match": "ipfix.netscaler_unk_322", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_323": { + "path_match": "ipfix.netscaler_unk_323", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_324": { + "path_match": "ipfix.netscaler_unk_324", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_325": { + "path_match": "ipfix.netscaler_unk_325", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_326": { + "path_match": "ipfix.netscaler_unk_326", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_327": { + "path_match": "ipfix.netscaler_unk_327", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_328": { + "path_match": "ipfix.netscaler_unk_328", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_329": { + "path_match": "ipfix.netscaler_unk_329", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_330": { + "path_match": "ipfix.netscaler_unk_330", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_331": { + "path_match": "ipfix.netscaler_unk_331", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_332": { + "path_match": "ipfix.netscaler_unk_332", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_333": { + "path_match": "ipfix.netscaler_unk_333", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_334": { + "path_match": "ipfix.netscaler_unk_334", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_335": { + "path_match": "ipfix.netscaler_unk_335", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_336": { + "path_match": "ipfix.netscaler_unk_336", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_337": { + "path_match": "ipfix.netscaler_unk_337", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_338": { + "path_match": "ipfix.netscaler_unk_338", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_339": { + "path_match": "ipfix.netscaler_unk_339", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_340": { + "path_match": "ipfix.netscaler_unk_340", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_341": { + "path_match": "ipfix.netscaler_unk_341", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_342": { + "path_match": "ipfix.netscaler_unk_342", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_343": { + "path_match": "ipfix.netscaler_unk_343", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_344": { + "path_match": "ipfix.netscaler_unk_344", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_345": { + "path_match": "ipfix.netscaler_unk_345", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_346": { + "path_match": "ipfix.netscaler_unk_346", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_347": { + "path_match": "ipfix.netscaler_unk_347", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_348": { + "path_match": "ipfix.netscaler_unk_348", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_349": { + "path_match": "ipfix.netscaler_unk_349", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_350": { + "path_match": "ipfix.netscaler_unk_350", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_351": { + "path_match": "ipfix.netscaler_unk_351", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_352": { + "path_match": "ipfix.netscaler_unk_352", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_353": { + "path_match": "ipfix.netscaler_unk_353", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_354": { + "path_match": "ipfix.netscaler_unk_354", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_355": { + "path_match": "ipfix.netscaler_unk_355", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_356": { + "path_match": "ipfix.netscaler_unk_356", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_357": { + "path_match": "ipfix.netscaler_unk_357", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_358": { + "path_match": "ipfix.netscaler_unk_358", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_359": { + "path_match": "ipfix.netscaler_unk_359", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_360": { + "path_match": "ipfix.netscaler_unk_360", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_361": { + "path_match": "ipfix.netscaler_unk_361", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_362": { + "path_match": "ipfix.netscaler_unk_362", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_363": { + "path_match": "ipfix.netscaler_unk_363", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_364": { + "path_match": "ipfix.netscaler_unk_364", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_365": { + "path_match": "ipfix.netscaler_unk_365", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_366": { + "path_match": "ipfix.netscaler_unk_366", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_367": { + "path_match": "ipfix.netscaler_unk_367", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_377": { + "path_match": "ipfix.netscaler_unk_377", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_380": { + "path_match": "ipfix.netscaler_unk_380", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_383": { + "path_match": "ipfix.netscaler_unk_383", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_384": { + "path_match": "ipfix.netscaler_unk_384", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_385": { + "path_match": "ipfix.netscaler_unk_385", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_386": { + "path_match": "ipfix.netscaler_unk_386", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_387": { + "path_match": "ipfix.netscaler_unk_387", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_388": { + "path_match": "ipfix.netscaler_unk_388", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_389": { + "path_match": "ipfix.netscaler_unk_389", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.netscaler_unk_391": { + "path_match": "ipfix.netscaler_unk_391", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_392": { + "path_match": "ipfix.netscaler_unk_392", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_393": { + "path_match": "ipfix.netscaler_unk_393", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_394": { + "path_match": "ipfix.netscaler_unk_394", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_398": { + "path_match": "ipfix.netscaler_unk_398", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_399": { + "path_match": "ipfix.netscaler_unk_399", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_400": { + "path_match": "ipfix.netscaler_unk_400", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_401": { + "path_match": "ipfix.netscaler_unk_401", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_402": { + "path_match": "ipfix.netscaler_unk_402", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_403": { + "path_match": "ipfix.netscaler_unk_403", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_404": { + "path_match": "ipfix.netscaler_unk_404", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_405": { + "path_match": "ipfix.netscaler_unk_405", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_408": { + "path_match": "ipfix.netscaler_unk_408", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_427": { + "path_match": "ipfix.netscaler_unk_427", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_429": { + "path_match": "ipfix.netscaler_unk_429", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_432": { + "path_match": "ipfix.netscaler_unk_432", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_433": { + "path_match": "ipfix.netscaler_unk_433", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_434": { + "path_match": "ipfix.netscaler_unk_434", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_435": { + "path_match": "ipfix.netscaler_unk_435", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_447": { + "path_match": "ipfix.netscaler_unk_447", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_448": { + "path_match": "ipfix.netscaler_unk_448", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_451": { + "path_match": "ipfix.netscaler_unk_451", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_452": { + "path_match": "ipfix.netscaler_unk_452", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_453": { + "path_match": "ipfix.netscaler_unk_453", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_455": { + "path_match": "ipfix.netscaler_unk_455", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_458": { + "path_match": "ipfix.netscaler_unk_458", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_459": { + "path_match": "ipfix.netscaler_unk_459", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_460": { + "path_match": "ipfix.netscaler_unk_460", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_461": { + "path_match": "ipfix.netscaler_unk_461", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_463": { + "path_match": "ipfix.netscaler_unk_463", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_464": { + "path_match": "ipfix.netscaler_unk_464", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_465": { + "path_match": "ipfix.netscaler_unk_465", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_466": { + "path_match": "ipfix.netscaler_unk_466", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_467": { + "path_match": "ipfix.netscaler_unk_467", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_468": { + "path_match": "ipfix.netscaler_unk_468", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_475": { + "path_match": "ipfix.netscaler_unk_475", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_476": { + "path_match": "ipfix.netscaler_unk_476", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_477": { + "path_match": "ipfix.netscaler_unk_477", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_478": { + "path_match": "ipfix.netscaler_unk_478", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_479": { + "path_match": "ipfix.netscaler_unk_479", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_480": { + "path_match": "ipfix.netscaler_unk_480", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_481": { + "path_match": "ipfix.netscaler_unk_481", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_487": { + "path_match": "ipfix.netscaler_unk_487", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_488": { + "path_match": "ipfix.netscaler_unk_488", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_489": { + "path_match": "ipfix.netscaler_unk_489", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_491": { + "path_match": "ipfix.netscaler_unk_491", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_492": { + "path_match": "ipfix.netscaler_unk_492", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_493": { + "path_match": "ipfix.netscaler_unk_493", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_494": { + "path_match": "ipfix.netscaler_unk_494", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_507": { + "path_match": "ipfix.netscaler_unk_507", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_508": { + "path_match": "ipfix.netscaler_unk_508", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_509": { + "path_match": "ipfix.netscaler_unk_509", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_510": { + "path_match": "ipfix.netscaler_unk_510", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_511": { + "path_match": "ipfix.netscaler_unk_511", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_512": { + "path_match": "ipfix.netscaler_unk_512", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_513": { + "path_match": "ipfix.netscaler_unk_513", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_514": { + "path_match": "ipfix.netscaler_unk_514", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_518": { + "path_match": "ipfix.netscaler_unk_518", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_519": { + "path_match": "ipfix.netscaler_unk_519", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_520": { + "path_match": "ipfix.netscaler_unk_520", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_521": { + "path_match": "ipfix.netscaler_unk_521", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_522": { + "path_match": "ipfix.netscaler_unk_522", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_523": { + "path_match": "ipfix.netscaler_unk_523", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_532": { + "path_match": "ipfix.netscaler_unk_532", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_533": { + "path_match": "ipfix.netscaler_unk_533", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_534": { + "path_match": "ipfix.netscaler_unk_534", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_535": { + "path_match": "ipfix.netscaler_unk_535", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_536": { + "path_match": "ipfix.netscaler_unk_536", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_537": { + "path_match": "ipfix.netscaler_unk_537", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_538": { + "path_match": "ipfix.netscaler_unk_538", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.netscaler_unk_541": { + "path_match": "ipfix.netscaler_unk_541", + "mapping": { + "type": "long" + } + } + }, - - { - "ipfix.ntop_src_frags": { - "path_match": "ipfix.ntop_src_frags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_frags": { - "path_match": "ipfix.ntop_dst_frags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_to_dst_max_throughput": { - "path_match": "ipfix.ntop_src_to_dst_max_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_to_dst_min_throughput": { - "path_match": "ipfix.ntop_src_to_dst_min_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_to_dst_avg_throughput": { - "path_match": "ipfix.ntop_src_to_dst_avg_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_to_src_max_throughput": { - "path_match": "ipfix.ntop_dst_to_src_max_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_to_src_min_throughput": { - "path_match": "ipfix.ntop_dst_to_src_min_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_to_src_avg_throughput": { - "path_match": "ipfix.ntop_dst_to_src_avg_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_upto_128_bytes": { - "path_match": "ipfix.ntop_packets_upto_128_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_128_to_256_bytes": { - "path_match": "ipfix.ntop_packets_128_to_256_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_256_to_512_bytes": { - "path_match": "ipfix.ntop_packets_256_to_512_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_512_to_1024_bytes": { - "path_match": "ipfix.ntop_packets_512_to_1024_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_1024_to_1514_bytes": { - "path_match": "ipfix.ntop_packets_1024_to_1514_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_over_1514_bytes": { - "path_match": "ipfix.ntop_packets_over_1514_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_cumulative_icmp_type": { - "path_match": "ipfix.ntop_cumulative_icmp_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_country": { - "path_match": "ipfix.ntop_src_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_src_city": { - "path_match": "ipfix.ntop_src_city", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dst_country": { - "path_match": "ipfix.ntop_dst_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dst_city": { - "path_match": "ipfix.ntop_dst_city", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_flow_proto_port": { - "path_match": "ipfix.ntop_flow_proto_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tunnel_id": { - "path_match": "ipfix.ntop_tunnel_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_longest_flow_packet": { - "path_match": "ipfix.ntop_longest_flow_packet", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_shortest_flow_packet": { - "path_match": "ipfix.ntop_shortest_flow_packet", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_retrans_in_packets": { - "path_match": "ipfix.ntop_retrans_in_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_retrans_out_packets": { - "path_match": "ipfix.ntop_retrans_out_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_ooorder_in_packets": { - "path_match": "ipfix.ntop_ooorder_in_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_ooorder_out_packets": { - "path_match": "ipfix.ntop_ooorder_out_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_untunneled_protocol": { - "path_match": "ipfix.ntop_untunneled_protocol", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_untunneled_ipv4_src_addr": { - "path_match": "ipfix.ntop_untunneled_ipv4_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_untunneled_l4_src_port": { - "path_match": "ipfix.ntop_untunneled_l4_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_untunneled_ipv4_dst_addr": { - "path_match": "ipfix.ntop_untunneled_ipv4_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_untunneled_l4_dst_port": { - "path_match": "ipfix.ntop_untunneled_l4_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_l7_proto": { - "path_match": "ipfix.ntop_l7_proto", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_l7_proto_name": { - "path_match": "ipfix.ntop_l7_proto_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_downstram_tunnel_id": { - "path_match": "ipfix.ntop_downstram_tunnel_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_flow_user": { - "path_match": "ipfix.ntop_flow_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_flow_server": { - "path_match": "ipfix.ntop_flow_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_client_nw_latency_ms": { - "path_match": "ipfix.ntop_client_nw_latency_ms", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_server_nw_latency_ms": { - "path_match": "ipfix.ntop_server_nw_latency_ms", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_appl_latency_ms": { - "path_match": "ipfix.ntop_appl_latency_ms", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_plugin": { - "path_match": "ipfix.ntop_plugin", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_retrans_in_bytes": { - "path_match": "ipfix.ntop_retrans_in_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_retrans_out_bytes": { - "path_match": "ipfix.ntop_retrans_out_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_call_id": { - "path_match": "ipfix.ntop_sip_call_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_sip_calling_party": { - "path_match": "ipfix.ntop_sip_calling_party", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_sip_called_party": { - "path_match": "ipfix.ntop_sip_called_party", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_sip_rtp_codecs": { - "path_match": "ipfix.ntop_sip_rtp_codecs", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_sip_invite_time": { - "path_match": "ipfix.ntop_sip_invite_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_trying_time": { - "path_match": "ipfix.ntop_sip_trying_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_ringing_time": { - "path_match": "ipfix.ntop_sip_ringing_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_ok_time": { - "path_match": "ipfix.ntop_sip_ok_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_invite_failure_time": { - "path_match": "ipfix.ntop_sip_invite_failure_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_bye_time": { - "path_match": "ipfix.ntop_sip_bye_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_bye_ok_time": { - "path_match": "ipfix.ntop_sip_bye_ok_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_cancel_time": { - "path_match": "ipfix.ntop_sip_cancel_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_cancel_ok_time": { - "path_match": "ipfix.ntop_sip_cancel_ok_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_rtp_ipv4_src_addr": { - "path_match": "ipfix.ntop_sip_rtp_ipv4_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_sip_rtp_l4_src_port": { - "path_match": "ipfix.ntop_sip_rtp_l4_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_rtp_ipv4_dst_addr": { - "path_match": "ipfix.ntop_sip_rtp_ipv4_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_sip_rtp_l4_dst_port": { - "path_match": "ipfix.ntop_sip_rtp_l4_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_resp_code": { - "path_match": "ipfix.ntop_sip_resp_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_sip_reason_cause": { - "path_match": "ipfix.ntop_sip_reason_cause", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_first_seq": { - "path_match": "ipfix.ntop_rtp_first_seq", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_first_ts": { - "path_match": "ipfix.ntop_rtp_first_ts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_last_seq": { - "path_match": "ipfix.ntop_rtp_last_seq", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_last_ts": { - "path_match": "ipfix.ntop_rtp_last_ts", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_in_jitter": { - "path_match": "ipfix.ntop_rtp_in_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_out_jitter": { - "path_match": "ipfix.ntop_rtp_out_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_in_packets_lost": { - "path_match": "ipfix.ntop_rtp_in_packets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_out_packets_lost": { - "path_match": "ipfix.ntop_rtp_out_packets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_out_payload_type": { - "path_match": "ipfix.ntop_rtp_out_payload_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_in_max_delta": { - "path_match": "ipfix.ntop_rtp_in_max_delta", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_out_max_delta": { - "path_match": "ipfix.ntop_rtp_out_max_delta", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_in_payload_type": { - "path_match": "ipfix.ntop_rtp_in_payload_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_proc_id": { - "path_match": "ipfix.ntop_src_proc_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_proc": { - "path_match": "ipfix.ntop_src_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_http_url": { - "path_match": "ipfix.ntop_http_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_http_ret_code": { - "path_match": "ipfix.ntop_http_ret_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_http_referrer": { - "path_match": "ipfix.ntop_http_referrer", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_http_user_agent": { - "path_match": "ipfix.ntop_http_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_http_mime": { - "path_match": "ipfix.ntop_http_mime", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_smtp_mail_from": { - "path_match": "ipfix.ntop_smtp_mail_from", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_smtp_rcpt_to": { - "path_match": "ipfix.ntop_smtp_rcpt_to", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_http_host": { - "path_match": "ipfix.ntop_http_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ssl_server": { - "path_match": "ipfix.ntop_ssl_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_bittorrent_hash": { - "path_match": "ipfix.ntop_bittorrent_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_mysql_server_ver": { - "path_match": "ipfix.ntop_mysql_server_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_mysql_user": { - "path_match": "ipfix.ntop_mysql_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_mysql_db": { - "path_match": "ipfix.ntop_mysql_db", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_mysql_query": { - "path_match": "ipfix.ntop_mysql_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_mysql_resp": { - "path_match": "ipfix.ntop_mysql_resp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_oracle_user": { - "path_match": "ipfix.ntop_oracle_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_oracle_query": { - "path_match": "ipfix.ntop_oracle_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_oracle_resp_code": { - "path_match": "ipfix.ntop_oracle_resp_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_oracle_resp_string": { - "path_match": "ipfix.ntop_oracle_resp_string", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_oracle_query_duration": { - "path_match": "ipfix.ntop_oracle_query_duration", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dns_query": { - "path_match": "ipfix.ntop_dns_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dns_query_id": { - "path_match": "ipfix.ntop_dns_query_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dns_query_type": { - "path_match": "ipfix.ntop_dns_query_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dns_ret_code": { - "path_match": "ipfix.ntop_dns_ret_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dns_answers": { - "path_match": "ipfix.ntop_dns_answers", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_pop_user": { - "path_match": "ipfix.ntop_pop_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv1_req_msg_type": { - "path_match": "ipfix.ntop_gtpv1_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_resp_msg_type": { - "path_match": "ipfix.ntop_gtpv1_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_c2s_teid_data": { - "path_match": "ipfix.ntop_gtpv1_c2s_teid_data", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_c2s_teid_ctrl": { - "path_match": "ipfix.ntop_gtpv1_c2s_teid_ctrl", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_s2c_teid_data": { - "path_match": "ipfix.ntop_gtpv1_s2c_teid_data", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_s2c_teid_ctrl": { - "path_match": "ipfix.ntop_gtpv1_s2c_teid_ctrl", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_end_user_ip": { - "path_match": "ipfix.ntop_gtpv1_end_user_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv1_end_user_imsi": { - "path_match": "ipfix.ntop_gtpv1_end_user_imsi", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv1_end_user_msisdn": { - "path_match": "ipfix.ntop_gtpv1_end_user_msisdn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv1_end_user_imei": { - "path_match": "ipfix.ntop_gtpv1_end_user_imei", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv1_apn": { - "path_match": "ipfix.ntop_gtpv1_apn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv1_rai_mcc": { - "path_match": "ipfix.ntop_gtpv1_rai_mcc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_rai_mnc": { - "path_match": "ipfix.ntop_gtpv1_rai_mnc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_uli_cell_lac": { - "path_match": "ipfix.ntop_gtpv1_uli_cell_lac", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_uli_cell_ci": { - "path_match": "ipfix.ntop_gtpv1_uli_cell_ci", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_uli_sac": { - "path_match": "ipfix.ntop_gtpv1_uli_sac", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_rai_type": { - "path_match": "ipfix.ntop_gtpv1_rai_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_radius_req_msg_type": { - "path_match": "ipfix.ntop_radius_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_radius_resp_msg_type": { - "path_match": "ipfix.ntop_radius_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_radius_user": { - "path_match": "ipfix.ntop_radius_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_radius_calling_station_id": { - "path_match": "ipfix.ntop_radius_calling_station_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_radius_called_station_id": { - "path_match": "ipfix.ntop_radius_called_station_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_radius_nas_ip": { - "path_match": "ipfix.ntop_radius_nas_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_radius_nas_id": { - "path_match": "ipfix.ntop_radius_nas_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_radius_user_imsi": { - "path_match": "ipfix.ntop_radius_user_imsi", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_radius_user_imei": { - "path_match": "ipfix.ntop_radius_user_imei", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_radius_framed_ip": { - "path_match": "ipfix.ntop_radius_framed_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_radius_acct_sess_id": { - "path_match": "ipfix.ntop_radius_acct_sess_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_radius_acct_status_type": { - "path_match": "ipfix.ntop_radius_acct_status_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_radius_acct_in_octets": { - "path_match": "ipfix.ntop_radius_acct_in_octets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_radius_acct_out_octets": { - "path_match": "ipfix.ntop_radius_acct_out_octets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_radius_acct_in_packets": { - "path_match": "ipfix.ntop_radius_acct_in_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_radius_acct_out_packets": { - "path_match": "ipfix.ntop_radius_acct_out_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_imap_login": { - "path_match": "ipfix.ntop_imap_login", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv2_req_msg_type": { - "path_match": "ipfix.ntop_gtpv2_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_resp_msg_type": { - "path_match": "ipfix.ntop_gtpv2_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_c2s_s1u_gtpu_teid": { - "path_match": "ipfix.ntop_gtpv2_c2s_s1u_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_c2s_s1u_gtpu_ip": { - "path_match": "ipfix.ntop_gtpv2_c2s_s1u_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv2_s2c_s1u_gtpu_teid": { - "path_match": "ipfix.ntop_gtpv2_s2c_s1u_gtpu_teid", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv2_s2c_s1u_gtpu_ip": { - "path_match": "ipfix.ntop_gtpv2_s2c_s1u_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv2_end_user_imsi": { - "path_match": "ipfix.ntop_gtpv2_end_user_imsi", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv2_and_user_msisdn": { - "path_match": "ipfix.ntop_gtpv2_and_user_msisdn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv2_apn": { - "path_match": "ipfix.ntop_gtpv2_apn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv2_uli_mcc": { - "path_match": "ipfix.ntop_gtpv2_uli_mcc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_uli_mnc": { - "path_match": "ipfix.ntop_gtpv2_uli_mnc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_uli_cell_tac": { - "path_match": "ipfix.ntop_gtpv2_uli_cell_tac", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_uli_cell_id": { - "path_match": "ipfix.ntop_gtpv2_uli_cell_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_rat_type": { - "path_match": "ipfix.ntop_gtpv2_rat_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_pdn_ip": { - "path_match": "ipfix.ntop_gtpv2_pdn_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv2_end_user_imei": { - "path_match": "ipfix.ntop_gtpv2_end_user_imei", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_src_as_path_1": { - "path_match": "ipfix.ntop_src_as_path_1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_2": { - "path_match": "ipfix.ntop_src_as_path_2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_3": { - "path_match": "ipfix.ntop_src_as_path_3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_4": { - "path_match": "ipfix.ntop_src_as_path_4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_5": { - "path_match": "ipfix.ntop_src_as_path_5", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_6": { - "path_match": "ipfix.ntop_src_as_path_6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_7": { - "path_match": "ipfix.ntop_src_as_path_7", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_8": { - "path_match": "ipfix.ntop_src_as_path_8", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_9": { - "path_match": "ipfix.ntop_src_as_path_9", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_as_path_10": { - "path_match": "ipfix.ntop_src_as_path_10", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_1": { - "path_match": "ipfix.ntop_dst_as_path_1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_2": { - "path_match": "ipfix.ntop_dst_as_path_2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_3": { - "path_match": "ipfix.ntop_dst_as_path_3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_4": { - "path_match": "ipfix.ntop_dst_as_path_4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_5": { - "path_match": "ipfix.ntop_dst_as_path_5", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_6": { - "path_match": "ipfix.ntop_dst_as_path_6", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_7": { - "path_match": "ipfix.ntop_dst_as_path_7", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_8": { - "path_match": "ipfix.ntop_dst_as_path_8", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_9": { - "path_match": "ipfix.ntop_dst_as_path_9", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_as_path_10": { - "path_match": "ipfix.ntop_dst_as_path_10", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_mysql_appl_latency_usec": { - "path_match": "ipfix.ntop_mysql_appl_latency_usec", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv0_req_msg_type": { - "path_match": "ipfix.ntop_gtpv0_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv0_resp_msg_type": { - "path_match": "ipfix.ntop_gtpv0_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv0_tid": { - "path_match": "ipfix.ntop_gtpv0_tid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv0_end_user_ip": { - "path_match": "ipfix.ntop_gtpv0_end_user_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv0_end_user_msisdn": { - "path_match": "ipfix.ntop_gtpv0_end_user_msisdn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv0_apn": { - "path_match": "ipfix.ntop_gtpv0_apn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_gtpv0_rai_mcc": { - "path_match": "ipfix.ntop_gtpv0_rai_mcc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv0_rai_mnc": { - "path_match": "ipfix.ntop_gtpv0_rai_mnc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv0_rai_cell_lac": { - "path_match": "ipfix.ntop_gtpv0_rai_cell_lac", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv0_rai_cell_rac": { - "path_match": "ipfix.ntop_gtpv0_rai_cell_rac", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv0_resp_cause": { - "path_match": "ipfix.ntop_gtpv0_resp_cause", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_resp_cause": { - "path_match": "ipfix.ntop_gtpv1_resp_cause", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_resp_cause": { - "path_match": "ipfix.ntop_gtpv2_resp_cause", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_5_32": { - "path_match": "ipfix.ntop_packets_ttl_5_32", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_32_64": { - "path_match": "ipfix.ntop_packets_ttl_32_64", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_64_96": { - "path_match": "ipfix.ntop_packets_ttl_64_96", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_96_128": { - "path_match": "ipfix.ntop_packets_ttl_96_128", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_128_160": { - "path_match": "ipfix.ntop_packets_ttl_128_160", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_160_192": { - "path_match": "ipfix.ntop_packets_ttl_160_192", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_192_224": { - "path_match": "ipfix.ntop_packets_ttl_192_224", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_224_225": { - "path_match": "ipfix.ntop_packets_ttl_224_225", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_rai_lac": { - "path_match": "ipfix.ntop_gtpv1_rai_lac", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_rai_rac": { - "path_match": "ipfix.ntop_gtpv1_rai_rac", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_uli_mcc": { - "path_match": "ipfix.ntop_gtpv1_uli_mcc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv1_uli_mnc": { - "path_match": "ipfix.ntop_gtpv1_uli_mnc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_2_5": { - "path_match": "ipfix.ntop_packets_ttl_2_5", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_packets_ttl_eq_1": { - "path_match": "ipfix.ntop_packets_ttl_eq_1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_sip_call_id": { - "path_match": "ipfix.ntop_rtp_sip_call_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_in_src_osi_sap": { - "path_match": "ipfix.ntop_in_src_osi_sap", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_out_dst_osi_sap": { - "path_match": "ipfix.ntop_out_dst_osi_sap", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_whois_das_domain": { - "path_match": "ipfix.ntop_whois_das_domain", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dns_ttl_answer": { - "path_match": "ipfix.ntop_dns_ttl_answer", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dhcp_client_mac": { - "path_match": "ipfix.ntop_dhcp_client_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dhcp_client_ip": { - "path_match": "ipfix.ntop_dhcp_client_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_dhcp_client": { - "path_match": "ipfix.ntop_dhcp_client", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ftp_login": { - "path_match": "ipfix.ntop_ftp_login", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ftp_password": { - "path_match": "ipfix.ntop_ftp_password", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ftp_command": { - "path_match": "ipfix.ntop_ftp_command", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ftp_command_ret_code": { - "path_match": "ipfix.ntop_ftp_command_ret_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_http_method": { - "path_match": "ipfix.ntop_http_method", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_http_site": { - "path_match": "ipfix.ntop_http_site", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_sip_c_ip": { - "path_match": "ipfix.ntop_sip_c_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_sip_call_state": { - "path_match": "ipfix.ntop_sip_call_state", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_rtp_in_mos": { - "path_match": "ipfix.ntop_rtp_in_mos", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_in_r_factor": { - "path_match": "ipfix.ntop_rtp_in_r_factor", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_proc_user": { - "path_match": "ipfix.ntop_src_proc_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_src_father_proc_pid": { - "path_match": "ipfix.ntop_src_father_proc_pid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_father_proc": { - "path_match": "ipfix.ntop_src_father_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dst_proc_pid": { - "path_match": "ipfix.ntop_dst_proc_pid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_proc": { - "path_match": "ipfix.ntop_dst_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dst_proc_user": { - "path_match": "ipfix.ntop_dst_proc_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dst_father_proc_pid": { - "path_match": "ipfix.ntop_dst_father_proc_pid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_father_proc": { - "path_match": "ipfix.ntop_dst_father_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_rtp_rtt": { - "path_match": "ipfix.ntop_rtp_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_in_transit": { - "path_match": "ipfix.ntop_rtp_in_transit", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_out_transit": { - "path_match": "ipfix.ntop_rtp_out_transit", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_proc_actual_memory": { - "path_match": "ipfix.ntop_src_proc_actual_memory", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_proc_peak_memory": { - "path_match": "ipfix.ntop_src_proc_peak_memory", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_proc_avg_cpu_load": { - "path_match": "ipfix.ntop_src_proc_avg_cpu_load", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_proc_page_faults": { - "path_match": "ipfix.ntop_src_proc_page_faults", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_proc_actual_memory": { - "path_match": "ipfix.ntop_dst_proc_actual_memory", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_proc_peak_memory": { - "path_match": "ipfix.ntop_dst_proc_peak_memory", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_proc_avg_cpu_load": { - "path_match": "ipfix.ntop_dst_proc_avg_cpu_load", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_proc_page_faults": { - "path_match": "ipfix.ntop_dst_proc_page_faults", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_duration_in": { - "path_match": "ipfix.ntop_duration_in", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_duration_out": { - "path_match": "ipfix.ntop_duration_out", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_proc_pctg_iowait": { - "path_match": "ipfix.ntop_src_proc_pctg_iowait", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_proc_pctg_iowait": { - "path_match": "ipfix.ntop_dst_proc_pctg_iowait", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_dtmf_tones": { - "path_match": "ipfix.ntop_rtp_dtmf_tones", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_untunneled_ipv6_src_addr": { - "path_match": "ipfix.ntop_untunneled_ipv6_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_untunneled_ipv6_dst_addr": { - "path_match": "ipfix.ntop_untunneled_ipv6_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_dns_resp": { - "path_match": "ipfix.ntop_dns_resp", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_diameter_req_msg_type": { - "path_match": "ipfix.ntop_diameter_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_diameter_resp_msg_type": { - "path_match": "ipfix.ntop_diameter_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_diameter_req_origin_host": { - "path_match": "ipfix.ntop_diameter_req_origin_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_diameter_resp_origin_host": { - "path_match": "ipfix.ntop_diameter_resp_origin_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_diameter_req_user": { - "path_match": "ipfix.ntop_diameter_req_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_diameter_resp_result_code": { - "path_match": "ipfix.ntop_diameter_resp_result_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_diameter_exp_res_vendor_id": { - "path_match": "ipfix.ntop_diameter_exp_res_vendor_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_diameter_exp_res_result_code": { - "path_match": "ipfix.ntop_diameter_exp_res_result_code", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_s1ap_enb_ue_s1ap_id": { - "path_match": "ipfix.ntop_s1ap_enb_ue_s1ap_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_s1ap_mme_ue_s1ap_id": { - "path_match": "ipfix.ntop_s1ap_mme_ue_s1ap_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_s1ap_msg_emm_type_mme_to_enb": { - "path_match": "ipfix.ntop_s1ap_msg_emm_type_mme_to_enb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_s1ap_msg_esm_type_mme_to_enb": { - "path_match": "ipfix.ntop_s1ap_msg_esm_type_mme_to_enb", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_s1ap_msg_emm_type_enb_to_mme": { - "path_match": "ipfix.ntop_s1ap_msg_emm_type_enb_to_mme", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_s1ap_msg_esm_type_enb_to_mme": { - "path_match": "ipfix.ntop_s1ap_msg_esm_type_enb_to_mme", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_s1ap_cause_enb_to_mme": { - "path_match": "ipfix.ntop_s1ap_cause_enb_to_mme", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_s1ap_detailed_cause_enb_to_mme": { - "path_match": "ipfix.ntop_s1ap_detailed_cause_enb_to_mme", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tcp_win_min_in": { - "path_match": "ipfix.ntop_tcp_win_min_in", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tcp_win_max_in": { - "path_match": "ipfix.ntop_tcp_win_max_in", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tcp_win_mss_in": { - "path_match": "ipfix.ntop_tcp_win_mss_in", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tcp_win_scale_in": { - "path_match": "ipfix.ntop_tcp_win_scale_in", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tcp_win_min_out": { - "path_match": "ipfix.ntop_tcp_win_min_out", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tcp_win_max_out": { - "path_match": "ipfix.ntop_tcp_win_max_out", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tcp_win_mss_out": { - "path_match": "ipfix.ntop_tcp_win_mss_out", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_tcp_win_scale_out": { - "path_match": "ipfix.ntop_tcp_win_scale_out", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dhcp_remote_id": { - "path_match": "ipfix.ntop_dhcp_remote_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dhcp_subscriber_id": { - "path_match": "ipfix.ntop_dhcp_subscriber_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_src_proc_uid": { - "path_match": "ipfix.ntop_src_proc_uid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_dst_proc_uid": { - "path_match": "ipfix.ntop_dst_proc_uid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_application": { - "path_match": "ipfix.ntop_application", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_user": { - "path_match": "ipfix.ntop_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dhcp_message_type": { - "path_match": "ipfix.ntop_dhcp_message_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_rtp_in_packets_drop": { - "path_match": "ipfix.ntop_rtp_in_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_out_packets_drop": { - "path_match": "ipfix.ntop_rtp_out_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_out_mos": { - "path_match": "ipfix.ntop_rtp_out_mos", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_out_r_factor": { - "path_match": "ipfix.ntop_rtp_out_r_factor", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_mos": { - "path_match": "ipfix.ntop_rtp_mos", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gptv2_s5_s8_gtpc_teid": { - "path_match": "ipfix.ntop_gptv2_s5_s8_gtpc_teid", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_rtp_r_factor": { - "path_match": "ipfix.ntop_rtp_r_factor", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_rtp_ssrc": { - "path_match": "ipfix.ntop_rtp_ssrc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_payload_hash": { - "path_match": "ipfix.ntop_payload_hash", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_teid": { - "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_teid": { - "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_ip": { - "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_ip": { - "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_src_as_map": { - "path_match": "ipfix.ntop_src_as_map", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_dst_as_map": { - "path_match": "ipfix.ntop_dst_as_map", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_diameter_hop_by_hop_id": { - "path_match": "ipfix.ntop_diameter_hop_by_hop_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_upstream_sess_id": { - "path_match": "ipfix.ntop_upstream_sess_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_downstream_sess_id": { - "path_match": "ipfix.ntop_downstream_sess_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_src_long": { - "path_match": "ipfix.ntop_src_long", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.ntop_src_lat": { - "path_match": "ipfix.ntop_src_lat", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.ntop_dst_long": { - "path_match": "ipfix.ntop_dst_long", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.ntop_dst_lat": { - "path_match": "ipfix.ntop_dst_lat", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.ntop_diameter_clr_cancel_type": { - "path_match": "ipfix.ntop_diameter_clr_cancel_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_diameter_clr_flags": { - "path_match": "ipfix.ntop_diameter_clr_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_c2s_s5_s8_gtpc_ip": { - "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_gtpc_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv2_s2c_s5_s8_gtpc_ip": { - "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_gtpc_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid": { - "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid": { - "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip": { - "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip": { - "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.ntop_http_x_forwarded_for": { - "path_match": "ipfix.ntop_http_x_forwarded_for", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_http_via": { - "path_match": "ipfix.ntop_http_via", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ssdp_host": { - "path_match": "ipfix.ntop_ssdp_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ssdp_usn": { - "path_match": "ipfix.ntop_ssdp_usn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_netbios_query": { - "path_match": "ipfix.ntop_netbios_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_netbios_query_type": { - "path_match": "ipfix.ntop_netbios_query_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_netbios_resp": { - "path_match": "ipfix.ntop_netbios_resp", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_netbios_query_os": { - "path_match": "ipfix.ntop_netbios_query_os", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ssdp_server": { - "path_match": "ipfix.ntop_ssdp_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ssdp_type": { - "path_match": "ipfix.ntop_ssdp_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_ssdp_method": { - "path_match": "ipfix.ntop_ssdp_method", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ntop_nprobe_ipv4_addr": { - "path_match": "ipfix.ntop_nprobe_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, + + { + "ipfix.ntop_src_frags": { + "path_match": "ipfix.ntop_src_frags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_frags": { + "path_match": "ipfix.ntop_dst_frags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_to_dst_max_throughput": { + "path_match": "ipfix.ntop_src_to_dst_max_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_to_dst_min_throughput": { + "path_match": "ipfix.ntop_src_to_dst_min_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_to_dst_avg_throughput": { + "path_match": "ipfix.ntop_src_to_dst_avg_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_to_src_max_throughput": { + "path_match": "ipfix.ntop_dst_to_src_max_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_to_src_min_throughput": { + "path_match": "ipfix.ntop_dst_to_src_min_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_to_src_avg_throughput": { + "path_match": "ipfix.ntop_dst_to_src_avg_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_upto_128_bytes": { + "path_match": "ipfix.ntop_packets_upto_128_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_128_to_256_bytes": { + "path_match": "ipfix.ntop_packets_128_to_256_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_256_to_512_bytes": { + "path_match": "ipfix.ntop_packets_256_to_512_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_512_to_1024_bytes": { + "path_match": "ipfix.ntop_packets_512_to_1024_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_1024_to_1514_bytes": { + "path_match": "ipfix.ntop_packets_1024_to_1514_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_over_1514_bytes": { + "path_match": "ipfix.ntop_packets_over_1514_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_cumulative_icmp_type": { + "path_match": "ipfix.ntop_cumulative_icmp_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_country": { + "path_match": "ipfix.ntop_src_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_src_city": { + "path_match": "ipfix.ntop_src_city", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dst_country": { + "path_match": "ipfix.ntop_dst_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dst_city": { + "path_match": "ipfix.ntop_dst_city", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_flow_proto_port": { + "path_match": "ipfix.ntop_flow_proto_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tunnel_id": { + "path_match": "ipfix.ntop_tunnel_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_longest_flow_packet": { + "path_match": "ipfix.ntop_longest_flow_packet", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_shortest_flow_packet": { + "path_match": "ipfix.ntop_shortest_flow_packet", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_retrans_in_packets": { + "path_match": "ipfix.ntop_retrans_in_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_retrans_out_packets": { + "path_match": "ipfix.ntop_retrans_out_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_ooorder_in_packets": { + "path_match": "ipfix.ntop_ooorder_in_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_ooorder_out_packets": { + "path_match": "ipfix.ntop_ooorder_out_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_untunneled_protocol": { + "path_match": "ipfix.ntop_untunneled_protocol", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_untunneled_ipv4_src_addr": { + "path_match": "ipfix.ntop_untunneled_ipv4_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_untunneled_l4_src_port": { + "path_match": "ipfix.ntop_untunneled_l4_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_untunneled_ipv4_dst_addr": { + "path_match": "ipfix.ntop_untunneled_ipv4_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_untunneled_l4_dst_port": { + "path_match": "ipfix.ntop_untunneled_l4_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_l7_proto": { + "path_match": "ipfix.ntop_l7_proto", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_l7_proto_name": { + "path_match": "ipfix.ntop_l7_proto_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_downstram_tunnel_id": { + "path_match": "ipfix.ntop_downstram_tunnel_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_flow_user": { + "path_match": "ipfix.ntop_flow_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_flow_server": { + "path_match": "ipfix.ntop_flow_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_client_nw_latency_ms": { + "path_match": "ipfix.ntop_client_nw_latency_ms", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_server_nw_latency_ms": { + "path_match": "ipfix.ntop_server_nw_latency_ms", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_appl_latency_ms": { + "path_match": "ipfix.ntop_appl_latency_ms", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_plugin": { + "path_match": "ipfix.ntop_plugin", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_retrans_in_bytes": { + "path_match": "ipfix.ntop_retrans_in_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_retrans_out_bytes": { + "path_match": "ipfix.ntop_retrans_out_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_call_id": { + "path_match": "ipfix.ntop_sip_call_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_sip_calling_party": { + "path_match": "ipfix.ntop_sip_calling_party", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_sip_called_party": { + "path_match": "ipfix.ntop_sip_called_party", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_sip_rtp_codecs": { + "path_match": "ipfix.ntop_sip_rtp_codecs", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_sip_invite_time": { + "path_match": "ipfix.ntop_sip_invite_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_trying_time": { + "path_match": "ipfix.ntop_sip_trying_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_ringing_time": { + "path_match": "ipfix.ntop_sip_ringing_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_ok_time": { + "path_match": "ipfix.ntop_sip_ok_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_invite_failure_time": { + "path_match": "ipfix.ntop_sip_invite_failure_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_bye_time": { + "path_match": "ipfix.ntop_sip_bye_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_bye_ok_time": { + "path_match": "ipfix.ntop_sip_bye_ok_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_cancel_time": { + "path_match": "ipfix.ntop_sip_cancel_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_cancel_ok_time": { + "path_match": "ipfix.ntop_sip_cancel_ok_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_rtp_ipv4_src_addr": { + "path_match": "ipfix.ntop_sip_rtp_ipv4_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_sip_rtp_l4_src_port": { + "path_match": "ipfix.ntop_sip_rtp_l4_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_rtp_ipv4_dst_addr": { + "path_match": "ipfix.ntop_sip_rtp_ipv4_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_sip_rtp_l4_dst_port": { + "path_match": "ipfix.ntop_sip_rtp_l4_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_resp_code": { + "path_match": "ipfix.ntop_sip_resp_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_sip_reason_cause": { + "path_match": "ipfix.ntop_sip_reason_cause", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_first_seq": { + "path_match": "ipfix.ntop_rtp_first_seq", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_first_ts": { + "path_match": "ipfix.ntop_rtp_first_ts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_last_seq": { + "path_match": "ipfix.ntop_rtp_last_seq", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_last_ts": { + "path_match": "ipfix.ntop_rtp_last_ts", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_in_jitter": { + "path_match": "ipfix.ntop_rtp_in_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_out_jitter": { + "path_match": "ipfix.ntop_rtp_out_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_in_packets_lost": { + "path_match": "ipfix.ntop_rtp_in_packets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_out_packets_lost": { + "path_match": "ipfix.ntop_rtp_out_packets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_out_payload_type": { + "path_match": "ipfix.ntop_rtp_out_payload_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_in_max_delta": { + "path_match": "ipfix.ntop_rtp_in_max_delta", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_out_max_delta": { + "path_match": "ipfix.ntop_rtp_out_max_delta", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_in_payload_type": { + "path_match": "ipfix.ntop_rtp_in_payload_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_proc_id": { + "path_match": "ipfix.ntop_src_proc_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_proc": { + "path_match": "ipfix.ntop_src_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_http_url": { + "path_match": "ipfix.ntop_http_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_http_ret_code": { + "path_match": "ipfix.ntop_http_ret_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_http_referrer": { + "path_match": "ipfix.ntop_http_referrer", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_http_user_agent": { + "path_match": "ipfix.ntop_http_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_http_mime": { + "path_match": "ipfix.ntop_http_mime", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_smtp_mail_from": { + "path_match": "ipfix.ntop_smtp_mail_from", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_smtp_rcpt_to": { + "path_match": "ipfix.ntop_smtp_rcpt_to", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_http_host": { + "path_match": "ipfix.ntop_http_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ssl_server": { + "path_match": "ipfix.ntop_ssl_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_bittorrent_hash": { + "path_match": "ipfix.ntop_bittorrent_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_mysql_server_ver": { + "path_match": "ipfix.ntop_mysql_server_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_mysql_user": { + "path_match": "ipfix.ntop_mysql_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_mysql_db": { + "path_match": "ipfix.ntop_mysql_db", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_mysql_query": { + "path_match": "ipfix.ntop_mysql_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_mysql_resp": { + "path_match": "ipfix.ntop_mysql_resp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_oracle_user": { + "path_match": "ipfix.ntop_oracle_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_oracle_query": { + "path_match": "ipfix.ntop_oracle_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_oracle_resp_code": { + "path_match": "ipfix.ntop_oracle_resp_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_oracle_resp_string": { + "path_match": "ipfix.ntop_oracle_resp_string", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_oracle_query_duration": { + "path_match": "ipfix.ntop_oracle_query_duration", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dns_query": { + "path_match": "ipfix.ntop_dns_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dns_query_id": { + "path_match": "ipfix.ntop_dns_query_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dns_query_type": { + "path_match": "ipfix.ntop_dns_query_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dns_ret_code": { + "path_match": "ipfix.ntop_dns_ret_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dns_answers": { + "path_match": "ipfix.ntop_dns_answers", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_pop_user": { + "path_match": "ipfix.ntop_pop_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv1_req_msg_type": { + "path_match": "ipfix.ntop_gtpv1_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_resp_msg_type": { + "path_match": "ipfix.ntop_gtpv1_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_c2s_teid_data": { + "path_match": "ipfix.ntop_gtpv1_c2s_teid_data", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_c2s_teid_ctrl": { + "path_match": "ipfix.ntop_gtpv1_c2s_teid_ctrl", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_s2c_teid_data": { + "path_match": "ipfix.ntop_gtpv1_s2c_teid_data", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_s2c_teid_ctrl": { + "path_match": "ipfix.ntop_gtpv1_s2c_teid_ctrl", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_end_user_ip": { + "path_match": "ipfix.ntop_gtpv1_end_user_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv1_end_user_imsi": { + "path_match": "ipfix.ntop_gtpv1_end_user_imsi", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv1_end_user_msisdn": { + "path_match": "ipfix.ntop_gtpv1_end_user_msisdn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv1_end_user_imei": { + "path_match": "ipfix.ntop_gtpv1_end_user_imei", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv1_apn": { + "path_match": "ipfix.ntop_gtpv1_apn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv1_rai_mcc": { + "path_match": "ipfix.ntop_gtpv1_rai_mcc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_rai_mnc": { + "path_match": "ipfix.ntop_gtpv1_rai_mnc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_uli_cell_lac": { + "path_match": "ipfix.ntop_gtpv1_uli_cell_lac", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_uli_cell_ci": { + "path_match": "ipfix.ntop_gtpv1_uli_cell_ci", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_uli_sac": { + "path_match": "ipfix.ntop_gtpv1_uli_sac", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_rai_type": { + "path_match": "ipfix.ntop_gtpv1_rai_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_radius_req_msg_type": { + "path_match": "ipfix.ntop_radius_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_radius_resp_msg_type": { + "path_match": "ipfix.ntop_radius_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_radius_user": { + "path_match": "ipfix.ntop_radius_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_radius_calling_station_id": { + "path_match": "ipfix.ntop_radius_calling_station_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_radius_called_station_id": { + "path_match": "ipfix.ntop_radius_called_station_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_radius_nas_ip": { + "path_match": "ipfix.ntop_radius_nas_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_radius_nas_id": { + "path_match": "ipfix.ntop_radius_nas_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_radius_user_imsi": { + "path_match": "ipfix.ntop_radius_user_imsi", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_radius_user_imei": { + "path_match": "ipfix.ntop_radius_user_imei", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_radius_framed_ip": { + "path_match": "ipfix.ntop_radius_framed_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_radius_acct_sess_id": { + "path_match": "ipfix.ntop_radius_acct_sess_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_radius_acct_status_type": { + "path_match": "ipfix.ntop_radius_acct_status_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_radius_acct_in_octets": { + "path_match": "ipfix.ntop_radius_acct_in_octets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_radius_acct_out_octets": { + "path_match": "ipfix.ntop_radius_acct_out_octets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_radius_acct_in_packets": { + "path_match": "ipfix.ntop_radius_acct_in_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_radius_acct_out_packets": { + "path_match": "ipfix.ntop_radius_acct_out_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_imap_login": { + "path_match": "ipfix.ntop_imap_login", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv2_req_msg_type": { + "path_match": "ipfix.ntop_gtpv2_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_resp_msg_type": { + "path_match": "ipfix.ntop_gtpv2_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_c2s_s1u_gtpu_teid": { + "path_match": "ipfix.ntop_gtpv2_c2s_s1u_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_c2s_s1u_gtpu_ip": { + "path_match": "ipfix.ntop_gtpv2_c2s_s1u_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv2_s2c_s1u_gtpu_teid": { + "path_match": "ipfix.ntop_gtpv2_s2c_s1u_gtpu_teid", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv2_s2c_s1u_gtpu_ip": { + "path_match": "ipfix.ntop_gtpv2_s2c_s1u_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv2_end_user_imsi": { + "path_match": "ipfix.ntop_gtpv2_end_user_imsi", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv2_and_user_msisdn": { + "path_match": "ipfix.ntop_gtpv2_and_user_msisdn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv2_apn": { + "path_match": "ipfix.ntop_gtpv2_apn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv2_uli_mcc": { + "path_match": "ipfix.ntop_gtpv2_uli_mcc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_uli_mnc": { + "path_match": "ipfix.ntop_gtpv2_uli_mnc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_uli_cell_tac": { + "path_match": "ipfix.ntop_gtpv2_uli_cell_tac", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_uli_cell_id": { + "path_match": "ipfix.ntop_gtpv2_uli_cell_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_rat_type": { + "path_match": "ipfix.ntop_gtpv2_rat_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_pdn_ip": { + "path_match": "ipfix.ntop_gtpv2_pdn_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv2_end_user_imei": { + "path_match": "ipfix.ntop_gtpv2_end_user_imei", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_src_as_path_1": { + "path_match": "ipfix.ntop_src_as_path_1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_2": { + "path_match": "ipfix.ntop_src_as_path_2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_3": { + "path_match": "ipfix.ntop_src_as_path_3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_4": { + "path_match": "ipfix.ntop_src_as_path_4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_5": { + "path_match": "ipfix.ntop_src_as_path_5", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_6": { + "path_match": "ipfix.ntop_src_as_path_6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_7": { + "path_match": "ipfix.ntop_src_as_path_7", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_8": { + "path_match": "ipfix.ntop_src_as_path_8", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_9": { + "path_match": "ipfix.ntop_src_as_path_9", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_as_path_10": { + "path_match": "ipfix.ntop_src_as_path_10", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_1": { + "path_match": "ipfix.ntop_dst_as_path_1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_2": { + "path_match": "ipfix.ntop_dst_as_path_2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_3": { + "path_match": "ipfix.ntop_dst_as_path_3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_4": { + "path_match": "ipfix.ntop_dst_as_path_4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_5": { + "path_match": "ipfix.ntop_dst_as_path_5", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_6": { + "path_match": "ipfix.ntop_dst_as_path_6", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_7": { + "path_match": "ipfix.ntop_dst_as_path_7", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_8": { + "path_match": "ipfix.ntop_dst_as_path_8", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_9": { + "path_match": "ipfix.ntop_dst_as_path_9", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_as_path_10": { + "path_match": "ipfix.ntop_dst_as_path_10", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_mysql_appl_latency_usec": { + "path_match": "ipfix.ntop_mysql_appl_latency_usec", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv0_req_msg_type": { + "path_match": "ipfix.ntop_gtpv0_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv0_resp_msg_type": { + "path_match": "ipfix.ntop_gtpv0_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv0_tid": { + "path_match": "ipfix.ntop_gtpv0_tid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv0_end_user_ip": { + "path_match": "ipfix.ntop_gtpv0_end_user_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv0_end_user_msisdn": { + "path_match": "ipfix.ntop_gtpv0_end_user_msisdn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv0_apn": { + "path_match": "ipfix.ntop_gtpv0_apn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_gtpv0_rai_mcc": { + "path_match": "ipfix.ntop_gtpv0_rai_mcc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv0_rai_mnc": { + "path_match": "ipfix.ntop_gtpv0_rai_mnc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv0_rai_cell_lac": { + "path_match": "ipfix.ntop_gtpv0_rai_cell_lac", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv0_rai_cell_rac": { + "path_match": "ipfix.ntop_gtpv0_rai_cell_rac", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv0_resp_cause": { + "path_match": "ipfix.ntop_gtpv0_resp_cause", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_resp_cause": { + "path_match": "ipfix.ntop_gtpv1_resp_cause", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_resp_cause": { + "path_match": "ipfix.ntop_gtpv2_resp_cause", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_5_32": { + "path_match": "ipfix.ntop_packets_ttl_5_32", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_32_64": { + "path_match": "ipfix.ntop_packets_ttl_32_64", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_64_96": { + "path_match": "ipfix.ntop_packets_ttl_64_96", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_96_128": { + "path_match": "ipfix.ntop_packets_ttl_96_128", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_128_160": { + "path_match": "ipfix.ntop_packets_ttl_128_160", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_160_192": { + "path_match": "ipfix.ntop_packets_ttl_160_192", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_192_224": { + "path_match": "ipfix.ntop_packets_ttl_192_224", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_224_225": { + "path_match": "ipfix.ntop_packets_ttl_224_225", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_rai_lac": { + "path_match": "ipfix.ntop_gtpv1_rai_lac", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_rai_rac": { + "path_match": "ipfix.ntop_gtpv1_rai_rac", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_uli_mcc": { + "path_match": "ipfix.ntop_gtpv1_uli_mcc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv1_uli_mnc": { + "path_match": "ipfix.ntop_gtpv1_uli_mnc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_2_5": { + "path_match": "ipfix.ntop_packets_ttl_2_5", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_packets_ttl_eq_1": { + "path_match": "ipfix.ntop_packets_ttl_eq_1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_sip_call_id": { + "path_match": "ipfix.ntop_rtp_sip_call_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_in_src_osi_sap": { + "path_match": "ipfix.ntop_in_src_osi_sap", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_out_dst_osi_sap": { + "path_match": "ipfix.ntop_out_dst_osi_sap", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_whois_das_domain": { + "path_match": "ipfix.ntop_whois_das_domain", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dns_ttl_answer": { + "path_match": "ipfix.ntop_dns_ttl_answer", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dhcp_client_mac": { + "path_match": "ipfix.ntop_dhcp_client_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dhcp_client_ip": { + "path_match": "ipfix.ntop_dhcp_client_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_dhcp_client": { + "path_match": "ipfix.ntop_dhcp_client", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ftp_login": { + "path_match": "ipfix.ntop_ftp_login", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ftp_password": { + "path_match": "ipfix.ntop_ftp_password", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ftp_command": { + "path_match": "ipfix.ntop_ftp_command", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ftp_command_ret_code": { + "path_match": "ipfix.ntop_ftp_command_ret_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_http_method": { + "path_match": "ipfix.ntop_http_method", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_http_site": { + "path_match": "ipfix.ntop_http_site", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_sip_c_ip": { + "path_match": "ipfix.ntop_sip_c_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_sip_call_state": { + "path_match": "ipfix.ntop_sip_call_state", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_rtp_in_mos": { + "path_match": "ipfix.ntop_rtp_in_mos", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_in_r_factor": { + "path_match": "ipfix.ntop_rtp_in_r_factor", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_proc_user": { + "path_match": "ipfix.ntop_src_proc_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_src_father_proc_pid": { + "path_match": "ipfix.ntop_src_father_proc_pid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_father_proc": { + "path_match": "ipfix.ntop_src_father_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dst_proc_pid": { + "path_match": "ipfix.ntop_dst_proc_pid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_proc": { + "path_match": "ipfix.ntop_dst_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dst_proc_user": { + "path_match": "ipfix.ntop_dst_proc_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dst_father_proc_pid": { + "path_match": "ipfix.ntop_dst_father_proc_pid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_father_proc": { + "path_match": "ipfix.ntop_dst_father_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_rtp_rtt": { + "path_match": "ipfix.ntop_rtp_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_in_transit": { + "path_match": "ipfix.ntop_rtp_in_transit", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_out_transit": { + "path_match": "ipfix.ntop_rtp_out_transit", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_proc_actual_memory": { + "path_match": "ipfix.ntop_src_proc_actual_memory", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_proc_peak_memory": { + "path_match": "ipfix.ntop_src_proc_peak_memory", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_proc_avg_cpu_load": { + "path_match": "ipfix.ntop_src_proc_avg_cpu_load", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_proc_page_faults": { + "path_match": "ipfix.ntop_src_proc_page_faults", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_proc_actual_memory": { + "path_match": "ipfix.ntop_dst_proc_actual_memory", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_proc_peak_memory": { + "path_match": "ipfix.ntop_dst_proc_peak_memory", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_proc_avg_cpu_load": { + "path_match": "ipfix.ntop_dst_proc_avg_cpu_load", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_proc_page_faults": { + "path_match": "ipfix.ntop_dst_proc_page_faults", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_duration_in": { + "path_match": "ipfix.ntop_duration_in", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_duration_out": { + "path_match": "ipfix.ntop_duration_out", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_proc_pctg_iowait": { + "path_match": "ipfix.ntop_src_proc_pctg_iowait", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_proc_pctg_iowait": { + "path_match": "ipfix.ntop_dst_proc_pctg_iowait", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_dtmf_tones": { + "path_match": "ipfix.ntop_rtp_dtmf_tones", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_untunneled_ipv6_src_addr": { + "path_match": "ipfix.ntop_untunneled_ipv6_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_untunneled_ipv6_dst_addr": { + "path_match": "ipfix.ntop_untunneled_ipv6_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_dns_resp": { + "path_match": "ipfix.ntop_dns_resp", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_diameter_req_msg_type": { + "path_match": "ipfix.ntop_diameter_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_diameter_resp_msg_type": { + "path_match": "ipfix.ntop_diameter_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_diameter_req_origin_host": { + "path_match": "ipfix.ntop_diameter_req_origin_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_diameter_resp_origin_host": { + "path_match": "ipfix.ntop_diameter_resp_origin_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_diameter_req_user": { + "path_match": "ipfix.ntop_diameter_req_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_diameter_resp_result_code": { + "path_match": "ipfix.ntop_diameter_resp_result_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_diameter_exp_res_vendor_id": { + "path_match": "ipfix.ntop_diameter_exp_res_vendor_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_diameter_exp_res_result_code": { + "path_match": "ipfix.ntop_diameter_exp_res_result_code", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_s1ap_enb_ue_s1ap_id": { + "path_match": "ipfix.ntop_s1ap_enb_ue_s1ap_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_s1ap_mme_ue_s1ap_id": { + "path_match": "ipfix.ntop_s1ap_mme_ue_s1ap_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_s1ap_msg_emm_type_mme_to_enb": { + "path_match": "ipfix.ntop_s1ap_msg_emm_type_mme_to_enb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_s1ap_msg_esm_type_mme_to_enb": { + "path_match": "ipfix.ntop_s1ap_msg_esm_type_mme_to_enb", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_s1ap_msg_emm_type_enb_to_mme": { + "path_match": "ipfix.ntop_s1ap_msg_emm_type_enb_to_mme", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_s1ap_msg_esm_type_enb_to_mme": { + "path_match": "ipfix.ntop_s1ap_msg_esm_type_enb_to_mme", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_s1ap_cause_enb_to_mme": { + "path_match": "ipfix.ntop_s1ap_cause_enb_to_mme", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_s1ap_detailed_cause_enb_to_mme": { + "path_match": "ipfix.ntop_s1ap_detailed_cause_enb_to_mme", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tcp_win_min_in": { + "path_match": "ipfix.ntop_tcp_win_min_in", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tcp_win_max_in": { + "path_match": "ipfix.ntop_tcp_win_max_in", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tcp_win_mss_in": { + "path_match": "ipfix.ntop_tcp_win_mss_in", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tcp_win_scale_in": { + "path_match": "ipfix.ntop_tcp_win_scale_in", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tcp_win_min_out": { + "path_match": "ipfix.ntop_tcp_win_min_out", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tcp_win_max_out": { + "path_match": "ipfix.ntop_tcp_win_max_out", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tcp_win_mss_out": { + "path_match": "ipfix.ntop_tcp_win_mss_out", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_tcp_win_scale_out": { + "path_match": "ipfix.ntop_tcp_win_scale_out", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dhcp_remote_id": { + "path_match": "ipfix.ntop_dhcp_remote_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dhcp_subscriber_id": { + "path_match": "ipfix.ntop_dhcp_subscriber_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_src_proc_uid": { + "path_match": "ipfix.ntop_src_proc_uid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_dst_proc_uid": { + "path_match": "ipfix.ntop_dst_proc_uid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_application": { + "path_match": "ipfix.ntop_application", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_user": { + "path_match": "ipfix.ntop_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dhcp_message_type": { + "path_match": "ipfix.ntop_dhcp_message_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_rtp_in_packets_drop": { + "path_match": "ipfix.ntop_rtp_in_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_out_packets_drop": { + "path_match": "ipfix.ntop_rtp_out_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_out_mos": { + "path_match": "ipfix.ntop_rtp_out_mos", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_out_r_factor": { + "path_match": "ipfix.ntop_rtp_out_r_factor", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_mos": { + "path_match": "ipfix.ntop_rtp_mos", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gptv2_s5_s8_gtpc_teid": { + "path_match": "ipfix.ntop_gptv2_s5_s8_gtpc_teid", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_rtp_r_factor": { + "path_match": "ipfix.ntop_rtp_r_factor", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_rtp_ssrc": { + "path_match": "ipfix.ntop_rtp_ssrc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_payload_hash": { + "path_match": "ipfix.ntop_payload_hash", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_teid": { + "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_teid": { + "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_ip": { + "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_ip": { + "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_src_as_map": { + "path_match": "ipfix.ntop_src_as_map", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_dst_as_map": { + "path_match": "ipfix.ntop_dst_as_map", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_diameter_hop_by_hop_id": { + "path_match": "ipfix.ntop_diameter_hop_by_hop_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_upstream_sess_id": { + "path_match": "ipfix.ntop_upstream_sess_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_downstream_sess_id": { + "path_match": "ipfix.ntop_downstream_sess_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_src_long": { + "path_match": "ipfix.ntop_src_long", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.ntop_src_lat": { + "path_match": "ipfix.ntop_src_lat", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.ntop_dst_long": { + "path_match": "ipfix.ntop_dst_long", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.ntop_dst_lat": { + "path_match": "ipfix.ntop_dst_lat", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.ntop_diameter_clr_cancel_type": { + "path_match": "ipfix.ntop_diameter_clr_cancel_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_diameter_clr_flags": { + "path_match": "ipfix.ntop_diameter_clr_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_c2s_s5_s8_gtpc_ip": { + "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_gtpc_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv2_s2c_s5_s8_gtpc_ip": { + "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_gtpc_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid": { + "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid": { + "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip": { + "path_match": "ipfix.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip": { + "path_match": "ipfix.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.ntop_http_x_forwarded_for": { + "path_match": "ipfix.ntop_http_x_forwarded_for", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_http_via": { + "path_match": "ipfix.ntop_http_via", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ssdp_host": { + "path_match": "ipfix.ntop_ssdp_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ssdp_usn": { + "path_match": "ipfix.ntop_ssdp_usn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_netbios_query": { + "path_match": "ipfix.ntop_netbios_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_netbios_query_type": { + "path_match": "ipfix.ntop_netbios_query_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_netbios_resp": { + "path_match": "ipfix.ntop_netbios_resp", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_netbios_query_os": { + "path_match": "ipfix.ntop_netbios_query_os", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ssdp_server": { + "path_match": "ipfix.ntop_ssdp_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ssdp_type": { + "path_match": "ipfix.ntop_ssdp_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_ssdp_method": { + "path_match": "ipfix.ntop_ssdp_method", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ntop_nprobe_ipv4_addr": { + "path_match": "ipfix.ntop_nprobe_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, - { - "ipfix.pan_app": { - "path_match": "ipfix.pan_app", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.pan_user": { - "path_match": "ipfix.pan_user", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.pan_app": { + "path_match": "ipfix.pan_app", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.pan_user": { + "path_match": "ipfix.pan_user", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.plixer_client_ipv4_addr": { - "path_match": "ipfix.plixer_client_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.plixer_client_hostname": { - "path_match": "ipfix.plixer_client_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_partner": { - "path_match": "ipfix.plixer_partner", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_server_hostname": { - "path_match": "ipfix.plixer_server_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_server_ipv4_addr": { - "path_match": "ipfix.plixer_server_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.plixer_recipient_addr": { - "path_match": "ipfix.plixer_recipient_addr", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_event_id": { - "path_match": "ipfix.plixer_event_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.plixer_msg_id": { - "path_match": "ipfix.plixer_msg_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_priority": { - "path_match": "ipfix.plixer_priority", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.plixer_recipient_report_status": { - "path_match": "ipfix.plixer_recipient_report_status", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.plixer_recipients": { - "path_match": "ipfix.plixer_recipients", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.plixer_origination_time": { - "path_match": "ipfix.plixer_origination_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.plixer_encryption": { - "path_match": "ipfix.plixer_encryption", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.plixer_service_ver": { - "path_match": "ipfix.plixer_service_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_linked_msg_id": { - "path_match": "ipfix.plixer_linked_msg_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_msg_subject": { - "path_match": "ipfix.plixer_msg_subject", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_sender_addr": { - "path_match": "ipfix.plixer_sender_addr", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.plixer_date_time": { - "path_match": "ipfix.plixer_date_time", - "mapping": { - "type": "long" - } - } - }, + { + "ipfix.plixer_client_ipv4_addr": { + "path_match": "ipfix.plixer_client_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.plixer_client_hostname": { + "path_match": "ipfix.plixer_client_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_partner": { + "path_match": "ipfix.plixer_partner", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_server_hostname": { + "path_match": "ipfix.plixer_server_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_server_ipv4_addr": { + "path_match": "ipfix.plixer_server_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.plixer_recipient_addr": { + "path_match": "ipfix.plixer_recipient_addr", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_event_id": { + "path_match": "ipfix.plixer_event_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.plixer_msg_id": { + "path_match": "ipfix.plixer_msg_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_priority": { + "path_match": "ipfix.plixer_priority", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.plixer_recipient_report_status": { + "path_match": "ipfix.plixer_recipient_report_status", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.plixer_recipients": { + "path_match": "ipfix.plixer_recipients", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.plixer_origination_time": { + "path_match": "ipfix.plixer_origination_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.plixer_encryption": { + "path_match": "ipfix.plixer_encryption", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.plixer_service_ver": { + "path_match": "ipfix.plixer_service_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_linked_msg_id": { + "path_match": "ipfix.plixer_linked_msg_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_msg_subject": { + "path_match": "ipfix.plixer_msg_subject", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_sender_addr": { + "path_match": "ipfix.plixer_sender_addr", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.plixer_date_time": { + "path_match": "ipfix.plixer_date_time", + "mapping": { + "type": "long" + } + } + }, - { - "ipfix.pluribus_latency_usec": { - "path_match": "ipfix.pluribus_latency_usec", - "mapping": { - "type": "long" - } - } - }, - - - - { - "ipfix.procera_service": { - "path_match": "ipfix.procera_service", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_base_service": { - "path_match": "ipfix.procera_base_service", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_in_bytes": { - "path_match": "ipfix.procera_in_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_bytes": { - "path_match": "ipfix.procera_out_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_packets": { - "path_match": "ipfix.procera_in_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_packets": { - "path_match": "ipfix.procera_out_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_shaping_latency": { - "path_match": "ipfix.procera_in_shaping_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_shaping_latency": { - "path_match": "ipfix.procera_out_shaping_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_shaping_drops": { - "path_match": "ipfix.procera_in_shaping_drops", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_shaping_drops": { - "path_match": "ipfix.procera_out_shaping_drops", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_int_rtt": { - "path_match": "ipfix.procera_int_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_ext_rtt": { - "path_match": "ipfix.procera_ext_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_flow_behavior": { - "path_match": "ipfix.procera_flow_behavior", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_content_cat": { - "path_match": "ipfix.procera_content_cat", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_property": { - "path_match": "ipfix.procera_property", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_server_hostname": { - "path_match": "ipfix.procera_server_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_http_req_method": { - "path_match": "ipfix.procera_http_req_method", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_http_user_agent": { - "path_match": "ipfix.procera_http_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_http_content_type": { - "path_match": "ipfix.procera_http_content_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_http_url": { - "path_match": "ipfix.procera_http_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_http_referrer": { - "path_match": "ipfix.procera_http_referrer", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_http_resp_status": { - "path_match": "ipfix.procera_http_resp_status", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_http_file_len": { - "path_match": "ipfix.procera_http_file_len", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_http_location": { - "path_match": "ipfix.procera_http_location", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_http_lang": { - "path_match": "ipfix.procera_http_lang", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_subscriber": { - "path_match": "ipfix.procera_subscriber", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_msisdn": { - "path_match": "ipfix.procera_msisdn", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_imsi": { - "path_match": "ipfix.procera_imsi", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_rat": { - "path_match": "ipfix.procera_rat", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_device": { - "path_match": "ipfix.procera_device", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_sgsn": { - "path_match": "ipfix.procera_sgsn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_rnc": { - "path_match": "ipfix.procera_rnc", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_apn": { - "path_match": "ipfix.procera_apn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_user_location_info": { - "path_match": "ipfix.procera_user_location_info", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_ggsn": { - "path_match": "ipfix.procera_ggsn", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_qoe_in_int": { - "path_match": "ipfix.procera_qoe_in_int", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.procera_qoe_in_ext": { - "path_match": "ipfix.procera_qoe_in_ext", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.procera_qoe_out_int": { - "path_match": "ipfix.procera_qoe_out_int", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.procera_qoe_out_ext": { - "path_match": "ipfix.procera_qoe_out_ext", - "mapping": { - "type": "float" - } - } - }, - { - "ipfix.procera_local_ipv4_host": { - "path_match": "ipfix.procera_local_ipv4_host", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.procera_local_ipv6_host": { - "path_match": "ipfix.procera_local_ipv6_host", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.procera_remote_ipv4_host": { - "path_match": "ipfix.procera_remote_ipv4_host", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.procera_remote_ipv6_host": { - "path_match": "ipfix.procera_remote_ipv6_host", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.procera_http_req_ver": { - "path_match": "ipfix.procera_http_req_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_template": { - "path_match": "ipfix.procera_template", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_in_dscp": { - "path_match": "ipfix.procera_in_dscp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dscp": { - "path_match": "ipfix.procera_out_dscp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_dot1q_vlanid_level_1": { - "path_match": "ipfix.procera_in_dot1q_vlanid_level_1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_dot1q_vlanid_level_2": { - "path_match": "ipfix.procera_in_dot1q_vlanid_level_2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_dot1q_vlanid_level_3": { - "path_match": "ipfix.procera_in_dot1q_vlanid_level_3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_dot1q_vlanid_level_4": { - "path_match": "ipfix.procera_in_dot1q_vlanid_level_4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dot1q_vlanid_level_1": { - "path_match": "ipfix.procera_out_dot1q_vlanid_level_1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dot1q_vlanid_level_2": { - "path_match": "ipfix.procera_out_dot1q_vlanid_level_2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dot1q_vlanid_level_3": { - "path_match": "ipfix.procera_out_dot1q_vlanid_level_3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dot1q_vlanid_level_4": { - "path_match": "ipfix.procera_out_dot1q_vlanid_level_4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_dot1q_priority_level_1": { - "path_match": "ipfix.procera_in_dot1q_priority_level_1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_dot1q_priority_level_2": { - "path_match": "ipfix.procera_in_dot1q_priority_level_2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_dot1q_priority_level_3": { - "path_match": "ipfix.procera_in_dot1q_priority_level_3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_in_dot1q_priority_level_4": { - "path_match": "ipfix.procera_in_dot1q_priority_level_4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dot1q_priority_level_1": { - "path_match": "ipfix.procera_out_dot1q_priority_level_1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dot1q_priority_level_2": { - "path_match": "ipfix.procera_out_dot1q_priority_level_2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dot1q_priority_level_3": { - "path_match": "ipfix.procera_out_dot1q_priority_level_3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_out_dot1q_priority_level_4": { - "path_match": "ipfix.procera_out_dot1q_priority_level_4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_internal_jitter": { - "path_match": "ipfix.procera_internal_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.procera_service_object": { - "path_match": "ipfix.procera_service_object", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.procera_remote_geoip": { - "path_match": "ipfix.procera_remote_geoip", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.pluribus_latency_usec": { + "path_match": "ipfix.pluribus_latency_usec", + "mapping": { + "type": "long" + } + } + }, + + + + { + "ipfix.procera_service": { + "path_match": "ipfix.procera_service", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_base_service": { + "path_match": "ipfix.procera_base_service", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_in_bytes": { + "path_match": "ipfix.procera_in_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_bytes": { + "path_match": "ipfix.procera_out_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_packets": { + "path_match": "ipfix.procera_in_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_packets": { + "path_match": "ipfix.procera_out_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_shaping_latency": { + "path_match": "ipfix.procera_in_shaping_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_shaping_latency": { + "path_match": "ipfix.procera_out_shaping_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_shaping_drops": { + "path_match": "ipfix.procera_in_shaping_drops", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_shaping_drops": { + "path_match": "ipfix.procera_out_shaping_drops", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_int_rtt": { + "path_match": "ipfix.procera_int_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_ext_rtt": { + "path_match": "ipfix.procera_ext_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_flow_behavior": { + "path_match": "ipfix.procera_flow_behavior", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_content_cat": { + "path_match": "ipfix.procera_content_cat", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_property": { + "path_match": "ipfix.procera_property", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_server_hostname": { + "path_match": "ipfix.procera_server_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_http_req_method": { + "path_match": "ipfix.procera_http_req_method", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_http_user_agent": { + "path_match": "ipfix.procera_http_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_http_content_type": { + "path_match": "ipfix.procera_http_content_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_http_url": { + "path_match": "ipfix.procera_http_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_http_referrer": { + "path_match": "ipfix.procera_http_referrer", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_http_resp_status": { + "path_match": "ipfix.procera_http_resp_status", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_http_file_len": { + "path_match": "ipfix.procera_http_file_len", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_http_location": { + "path_match": "ipfix.procera_http_location", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_http_lang": { + "path_match": "ipfix.procera_http_lang", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_subscriber": { + "path_match": "ipfix.procera_subscriber", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_msisdn": { + "path_match": "ipfix.procera_msisdn", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_imsi": { + "path_match": "ipfix.procera_imsi", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_rat": { + "path_match": "ipfix.procera_rat", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_device": { + "path_match": "ipfix.procera_device", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_sgsn": { + "path_match": "ipfix.procera_sgsn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_rnc": { + "path_match": "ipfix.procera_rnc", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_apn": { + "path_match": "ipfix.procera_apn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_user_location_info": { + "path_match": "ipfix.procera_user_location_info", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_ggsn": { + "path_match": "ipfix.procera_ggsn", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_qoe_in_int": { + "path_match": "ipfix.procera_qoe_in_int", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.procera_qoe_in_ext": { + "path_match": "ipfix.procera_qoe_in_ext", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.procera_qoe_out_int": { + "path_match": "ipfix.procera_qoe_out_int", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.procera_qoe_out_ext": { + "path_match": "ipfix.procera_qoe_out_ext", + "mapping": { + "type": "float" + } + } + }, + { + "ipfix.procera_local_ipv4_host": { + "path_match": "ipfix.procera_local_ipv4_host", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.procera_local_ipv6_host": { + "path_match": "ipfix.procera_local_ipv6_host", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.procera_remote_ipv4_host": { + "path_match": "ipfix.procera_remote_ipv4_host", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.procera_remote_ipv6_host": { + "path_match": "ipfix.procera_remote_ipv6_host", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.procera_http_req_ver": { + "path_match": "ipfix.procera_http_req_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_template": { + "path_match": "ipfix.procera_template", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_in_dscp": { + "path_match": "ipfix.procera_in_dscp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dscp": { + "path_match": "ipfix.procera_out_dscp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_dot1q_vlanid_level_1": { + "path_match": "ipfix.procera_in_dot1q_vlanid_level_1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_dot1q_vlanid_level_2": { + "path_match": "ipfix.procera_in_dot1q_vlanid_level_2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_dot1q_vlanid_level_3": { + "path_match": "ipfix.procera_in_dot1q_vlanid_level_3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_dot1q_vlanid_level_4": { + "path_match": "ipfix.procera_in_dot1q_vlanid_level_4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dot1q_vlanid_level_1": { + "path_match": "ipfix.procera_out_dot1q_vlanid_level_1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dot1q_vlanid_level_2": { + "path_match": "ipfix.procera_out_dot1q_vlanid_level_2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dot1q_vlanid_level_3": { + "path_match": "ipfix.procera_out_dot1q_vlanid_level_3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dot1q_vlanid_level_4": { + "path_match": "ipfix.procera_out_dot1q_vlanid_level_4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_dot1q_priority_level_1": { + "path_match": "ipfix.procera_in_dot1q_priority_level_1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_dot1q_priority_level_2": { + "path_match": "ipfix.procera_in_dot1q_priority_level_2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_dot1q_priority_level_3": { + "path_match": "ipfix.procera_in_dot1q_priority_level_3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_in_dot1q_priority_level_4": { + "path_match": "ipfix.procera_in_dot1q_priority_level_4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dot1q_priority_level_1": { + "path_match": "ipfix.procera_out_dot1q_priority_level_1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dot1q_priority_level_2": { + "path_match": "ipfix.procera_out_dot1q_priority_level_2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dot1q_priority_level_3": { + "path_match": "ipfix.procera_out_dot1q_priority_level_3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_out_dot1q_priority_level_4": { + "path_match": "ipfix.procera_out_dot1q_priority_level_4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_internal_jitter": { + "path_match": "ipfix.procera_internal_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.procera_service_object": { + "path_match": "ipfix.procera_service_object", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.procera_remote_geoip": { + "path_match": "ipfix.procera_remote_geoip", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.redsocks_http_hostname": { - "path_match": "ipfix.redsocks_http_hostname", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.redsocks_http_hostname": { + "path_match": "ipfix.redsocks_http_hostname", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.sonic_timestamp": { - "path_match": "ipfix.sonic_timestamp", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_id": { - "path_match": "ipfix.sonic_flow_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_initiator_gw_mac": { - "path_match": "ipfix.sonic_initiator_gw_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_responder_gw_mac": { - "path_match": "ipfix.sonic_responder_gw_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_initiator_ip": { - "path_match": "ipfix.sonic_initiator_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_responder_ip": { - "path_match": "ipfix.sonic_responder_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_initiator_gw_ip": { - "path_match": "ipfix.sonic_initiator_gw_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_responder_gw_ip": { - "path_match": "ipfix.sonic_responder_gw_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_initiator_iface": { - "path_match": "ipfix.sonic_initiator_iface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_responder_iface": { - "path_match": "ipfix.sonic_responder_iface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_initiator_port": { - "path_match": "ipfix.sonic_initiator_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_responder_port": { - "path_match": "ipfix.sonic_responder_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_init_to_resp_packets": { - "path_match": "ipfix.sonic_init_to_resp_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_init_to_resp_bytes": { - "path_match": "ipfix.sonic_init_to_resp_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_resp_to_init_packets": { - "path_match": "ipfix.sonic_resp_to_init_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_resp_to_init_bytes": { - "path_match": "ipfix.sonic_resp_to_init_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_start_time": { - "path_match": "ipfix.sonic_flow_start_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_end_time": { - "path_match": "ipfix.sonic_flow_end_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_internal_flags": { - "path_match": "ipfix.sonic_internal_flags", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_protocol_type": { - "path_match": "ipfix.sonic_protocol_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_application_id": { - "path_match": "ipfix.sonic_application_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_ips_id": { - "path_match": "ipfix.sonic_ips_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_virus_id": { - "path_match": "ipfix.sonic_virus_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_spyware_id": { - "path_match": "ipfix.sonic_spyware_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_template_id": { - "path_match": "ipfix.sonic_template_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_table": { - "path_match": "ipfix.sonic_table", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_column_id": { - "path_match": "ipfix.sonic_column_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_column": { - "path_match": "ipfix.sonic_column", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_column_type": { - "path_match": "ipfix.sonic_column_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_column_standard_ipfix_id": { - "path_match": "ipfix.sonic_column_standard_ipfix_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_user_index": { - "path_match": "ipfix.sonic_user_index", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_user": { - "path_match": "ipfix.sonic_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_user_id": { - "path_match": "ipfix.sonic_user_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_user_domain": { - "path_match": "ipfix.sonic_user_domain", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_user_auth_type": { - "path_match": "ipfix.sonic_user_auth_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app_index": { - "path_match": "ipfix.sonic_app_index", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app_id": { - "path_match": "ipfix.sonic_app_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app": { - "path_match": "ipfix.sonic_app", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_app_cat_id": { - "path_match": "ipfix.sonic_app_cat_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app_cat": { - "path_match": "ipfix.sonic_app_cat", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_app_sig_id": { - "path_match": "ipfix.sonic_app_sig_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_gav_index": { - "path_match": "ipfix.sonic_gav_index", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_gav": { - "path_match": "ipfix.sonic_gav", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_gav_sig_id": { - "path_match": "ipfix.sonic_gav_sig_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_ips_index": { - "path_match": "ipfix.sonic_ips_index", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_ips": { - "path_match": "ipfix.sonic_ips", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_ips_cat_id": { - "path_match": "ipfix.sonic_ips_cat_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_ips_cat": { - "path_match": "ipfix.sonic_ips_cat", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_ips_sig_id": { - "path_match": "ipfix.sonic_ips_sig_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_aspy_index": { - "path_match": "ipfix.sonic_aspy_index", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_aspy": { - "path_match": "ipfix.sonic_aspy", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_aspy_prod_id": { - "path_match": "ipfix.sonic_aspy_prod_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_aspy_prod": { - "path_match": "ipfix.sonic_aspy_prod", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_aspy_sig_id": { - "path_match": "ipfix.sonic_aspy_sig_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_url": { - "path_match": "ipfix.sonic_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_url_ip": { - "path_match": "ipfix.sonic_url_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_rating_index": { - "path_match": "ipfix.sonic_rating_index", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_rating": { - "path_match": "ipfix.sonic_rating", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_region_id": { - "path_match": "ipfix.sonic_region_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_country_id": { - "path_match": "ipfix.sonic_country_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_country": { - "path_match": "ipfix.sonic_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_region": { - "path_match": "ipfix.sonic_region", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_location_ip": { - "path_match": "ipfix.sonic_location_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_location_region_id": { - "path_match": "ipfix.sonic_location_region_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_location_domain": { - "path_match": "ipfix.sonic_location_domain", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_if_stat_iface": { - "path_match": "ipfix.sonic_if_stat_iface", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_in_packets_rate": { - "path_match": "ipfix.sonic_if_stat_in_packets_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_out_packets_rate": { - "path_match": "ipfix.sonic_if_stat_out_packets_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_in_bytes_rate": { - "path_match": "ipfix.sonic_if_stat_in_bytes_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_out_bytes_rate": { - "path_match": "ipfix.sonic_if_stat_out_bytes_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_in_packet_size": { - "path_match": "ipfix.sonic_if_stat_in_packet_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_out_packet_size": { - "path_match": "ipfix.sonic_if_stat_out_packet_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_conn_rate": { - "path_match": "ipfix.sonic_if_stat_conn_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_init_bytes_rate": { - "path_match": "ipfix.sonic_flow_init_bytes_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_resp_bytes_rate": { - "path_match": "ipfix.sonic_flow_resp_bytes_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_init_packet_rate": { - "path_match": "ipfix.sonic_flow_init_packet_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_resp_packet_rate": { - "path_match": "ipfix.sonic_flow_resp_packet_rate", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_init_packet_size": { - "path_match": "ipfix.sonic_flow_init_packet_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_resp_packet_size": { - "path_match": "ipfix.sonic_flow_resp_packet_size", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_if_name": { - "path_match": "ipfix.sonic_if_stat_if_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_if_stat_if_type": { - "path_match": "ipfix.sonic_if_stat_if_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_if_speed": { - "path_match": "ipfix.sonic_if_stat_if_speed", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_if_state": { - "path_match": "ipfix.sonic_if_stat_if_state", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_if_mtu": { - "path_match": "ipfix.sonic_if_stat_if_mtu", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_if_mode": { - "path_match": "ipfix.sonic_if_stat_if_mode", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_url_flow_id": { - "path_match": "ipfix.sonic_url_flow_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_url_time_id": { - "path_match": "ipfix.sonic_url_time_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_core_stat_core_id": { - "path_match": "ipfix.sonic_core_stat_core_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_core_stat_core_util": { - "path_match": "ipfix.sonic_core_stat_core_util", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_flow_id": { - "path_match": "ipfix.sonic_voip_flow_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_time_id": { - "path_match": "ipfix.sonic_voip_time_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_init_call_id": { - "path_match": "ipfix.sonic_voip_init_call_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_voip_resp_call_id": { - "path_match": "ipfix.sonic_voip_resp_call_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_media_type": { - "path_match": "ipfix.sonic_media_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_media_protocol": { - "path_match": "ipfix.sonic_media_protocol", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_service": { - "path_match": "ipfix.sonic_service", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_service_ip_type": { - "path_match": "ipfix.sonic_service_ip_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_service_port_begin": { - "path_match": "ipfix.sonic_service_port_begin", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_service_port_end": { - "path_match": "ipfix.sonic_service_port_end", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_spam_sess_id": { - "path_match": "ipfix.sonic_spam_sess_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_spam_flow_id": { - "path_match": "ipfix.sonic_spam_flow_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_spam_time_id": { - "path_match": "ipfix.sonic_spam_time_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_spam_spammer": { - "path_match": "ipfix.sonic_spam_spammer", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_spam_type": { - "path_match": "ipfix.sonic_spam_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_spam_to_email": { - "path_match": "ipfix.sonic_spam_to_email", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_spam_from_email": { - "path_match": "ipfix.sonic_spam_from_email", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_mem_total_ram": { - "path_match": "ipfix.sonic_mem_total_ram", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_mem_avail_ram": { - "path_match": "ipfix.sonic_mem_avail_ram", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_mem_used_ram": { - "path_match": "ipfix.sonic_mem_used_ram", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_mem_db_ram": { - "path_match": "ipfix.sonic_mem_db_ram", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_mem_flows": { - "path_match": "ipfix.sonic_mem_flows", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_mem_per_flow": { - "path_match": "ipfix.sonic_mem_per_flow", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_dev_iface_id": { - "path_match": "ipfix.sonic_dev_iface_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_dev_ip": { - "path_match": "ipfix.sonic_dev_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_dev_mac": { - "path_match": "ipfix.sonic_dev_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_dev_name": { - "path_match": "ipfix.sonic_dev_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_vpn_in_spi_id": { - "path_match": "ipfix.sonic_vpn_in_spi_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_vpn_out_spi_id": { - "path_match": "ipfix.sonic_vpn_out_spi_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_vpn_tunnel": { - "path_match": "ipfix.sonic_vpn_tunnel", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_vpn_local_gw": { - "path_match": "ipfix.sonic_vpn_local_gw", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_vpn_remote_gw": { - "path_match": "ipfix.sonic_vpn_remote_gw", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_vpn_tunnel_iface_id": { - "path_match": "ipfix.sonic_vpn_tunnel_iface_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_vpn_policy_type": { - "path_match": "ipfix.sonic_vpn_policy_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_vpn_protocol_type": { - "path_match": "ipfix.sonic_vpn_protocol_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_vpn_encrypt_type": { - "path_match": "ipfix.sonic_vpn_encrypt_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_vpn_auth_type": { - "path_match": "ipfix.sonic_vpn_auth_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_vpn_start_time": { - "path_match": "ipfix.sonic_vpn_start_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_vpn_end_time": { - "path_match": "ipfix.sonic_vpn_end_time", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_init_vpn_spi_out": { - "path_match": "ipfix.sonic_init_vpn_spi_out", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_resp_vpn_spi_out": { - "path_match": "ipfix.sonic_resp_vpn_spi_out", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_init_to_resp_delta_packets": { - "path_match": "ipfix.sonic_init_to_resp_delta_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_init_to_resp_delta_bytes": { - "path_match": "ipfix.sonic_init_to_resp_delta_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_resp_to_init_delta_packets": { - "path_match": "ipfix.sonic_resp_to_init_delta_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_resp_to_init_delta_bytes": { - "path_match": "ipfix.sonic_resp_to_init_delta_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_flow_block_reason": { - "path_match": "ipfix.sonic_flow_block_reason", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_mac": { - "path_match": "ipfix.sonic_if_stat_mac", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_ip": { - "path_match": "ipfix.sonic_if_stat_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_if_stat_security_type": { - "path_match": "ipfix.sonic_if_stat_security_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_if_stat_zone": { - "path_match": "ipfix.sonic_if_stat_zone", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_user_ip": { - "path_match": "ipfix.sonic_user_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.sonic_url_rating_val1": { - "path_match": "ipfix.sonic_url_rating_val1", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_url_rating_val2": { - "path_match": "ipfix.sonic_url_rating_val2", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_url_rating_val3": { - "path_match": "ipfix.sonic_url_rating_val3", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_url_rating_val4": { - "path_match": "ipfix.sonic_url_rating_val4", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app_bwm_attr": { - "path_match": "ipfix.sonic_app_bwm_attr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_init_to_resp_lost_packets": { - "path_match": "ipfix.sonic_voip_init_to_resp_lost_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_resp_to_init_lost_packets": { - "path_match": "ipfix.sonic_voip_resp_to_init_lost_packets", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_init_to_resp_avg_latency": { - "path_match": "ipfix.sonic_voip_init_to_resp_avg_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_init_to_resp_max_latency": { - "path_match": "ipfix.sonic_voip_init_to_resp_max_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_resp_to_init_avg_latency": { - "path_match": "ipfix.sonic_voip_resp_to_init_avg_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_voip_resp_to_init_max_latency": { - "path_match": "ipfix.sonic_voip_resp_to_init_max_latency", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app_content_type": { - "path_match": "ipfix.sonic_app_content_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_snwl_option": { - "path_match": "ipfix.sonic_snwl_option", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app_risk_attr": { - "path_match": "ipfix.sonic_app_risk_attr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app_tech_attr": { - "path_match": "ipfix.sonic_app_tech_attr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_app_attr_bit_mask": { - "path_match": "ipfix.sonic_app_attr_bit_mask", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_top_apps_sigid": { - "path_match": "ipfix.sonic_top_apps_sigid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sonic_top_apps_appname": { - "path_match": "ipfix.sonic_top_apps_appname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sonic_top_apps_rate": { - "path_match": "ipfix.sonic_top_apps_rate", - "mapping": { - "type": "long" - } - } - }, + { + "ipfix.sonic_timestamp": { + "path_match": "ipfix.sonic_timestamp", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_id": { + "path_match": "ipfix.sonic_flow_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_initiator_gw_mac": { + "path_match": "ipfix.sonic_initiator_gw_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_responder_gw_mac": { + "path_match": "ipfix.sonic_responder_gw_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_initiator_ip": { + "path_match": "ipfix.sonic_initiator_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_responder_ip": { + "path_match": "ipfix.sonic_responder_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_initiator_gw_ip": { + "path_match": "ipfix.sonic_initiator_gw_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_responder_gw_ip": { + "path_match": "ipfix.sonic_responder_gw_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_initiator_iface": { + "path_match": "ipfix.sonic_initiator_iface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_responder_iface": { + "path_match": "ipfix.sonic_responder_iface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_initiator_port": { + "path_match": "ipfix.sonic_initiator_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_responder_port": { + "path_match": "ipfix.sonic_responder_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_init_to_resp_packets": { + "path_match": "ipfix.sonic_init_to_resp_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_init_to_resp_bytes": { + "path_match": "ipfix.sonic_init_to_resp_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_resp_to_init_packets": { + "path_match": "ipfix.sonic_resp_to_init_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_resp_to_init_bytes": { + "path_match": "ipfix.sonic_resp_to_init_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_start_time": { + "path_match": "ipfix.sonic_flow_start_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_end_time": { + "path_match": "ipfix.sonic_flow_end_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_internal_flags": { + "path_match": "ipfix.sonic_internal_flags", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_protocol_type": { + "path_match": "ipfix.sonic_protocol_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_application_id": { + "path_match": "ipfix.sonic_application_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_ips_id": { + "path_match": "ipfix.sonic_ips_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_virus_id": { + "path_match": "ipfix.sonic_virus_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_spyware_id": { + "path_match": "ipfix.sonic_spyware_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_template_id": { + "path_match": "ipfix.sonic_template_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_table": { + "path_match": "ipfix.sonic_table", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_column_id": { + "path_match": "ipfix.sonic_column_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_column": { + "path_match": "ipfix.sonic_column", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_column_type": { + "path_match": "ipfix.sonic_column_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_column_standard_ipfix_id": { + "path_match": "ipfix.sonic_column_standard_ipfix_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_user_index": { + "path_match": "ipfix.sonic_user_index", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_user": { + "path_match": "ipfix.sonic_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_user_id": { + "path_match": "ipfix.sonic_user_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_user_domain": { + "path_match": "ipfix.sonic_user_domain", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_user_auth_type": { + "path_match": "ipfix.sonic_user_auth_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app_index": { + "path_match": "ipfix.sonic_app_index", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app_id": { + "path_match": "ipfix.sonic_app_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app": { + "path_match": "ipfix.sonic_app", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_app_cat_id": { + "path_match": "ipfix.sonic_app_cat_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app_cat": { + "path_match": "ipfix.sonic_app_cat", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_app_sig_id": { + "path_match": "ipfix.sonic_app_sig_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_gav_index": { + "path_match": "ipfix.sonic_gav_index", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_gav": { + "path_match": "ipfix.sonic_gav", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_gav_sig_id": { + "path_match": "ipfix.sonic_gav_sig_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_ips_index": { + "path_match": "ipfix.sonic_ips_index", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_ips": { + "path_match": "ipfix.sonic_ips", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_ips_cat_id": { + "path_match": "ipfix.sonic_ips_cat_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_ips_cat": { + "path_match": "ipfix.sonic_ips_cat", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_ips_sig_id": { + "path_match": "ipfix.sonic_ips_sig_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_aspy_index": { + "path_match": "ipfix.sonic_aspy_index", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_aspy": { + "path_match": "ipfix.sonic_aspy", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_aspy_prod_id": { + "path_match": "ipfix.sonic_aspy_prod_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_aspy_prod": { + "path_match": "ipfix.sonic_aspy_prod", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_aspy_sig_id": { + "path_match": "ipfix.sonic_aspy_sig_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_url": { + "path_match": "ipfix.sonic_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_url_ip": { + "path_match": "ipfix.sonic_url_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_rating_index": { + "path_match": "ipfix.sonic_rating_index", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_rating": { + "path_match": "ipfix.sonic_rating", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_region_id": { + "path_match": "ipfix.sonic_region_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_country_id": { + "path_match": "ipfix.sonic_country_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_country": { + "path_match": "ipfix.sonic_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_region": { + "path_match": "ipfix.sonic_region", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_location_ip": { + "path_match": "ipfix.sonic_location_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_location_region_id": { + "path_match": "ipfix.sonic_location_region_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_location_domain": { + "path_match": "ipfix.sonic_location_domain", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_if_stat_iface": { + "path_match": "ipfix.sonic_if_stat_iface", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_in_packets_rate": { + "path_match": "ipfix.sonic_if_stat_in_packets_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_out_packets_rate": { + "path_match": "ipfix.sonic_if_stat_out_packets_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_in_bytes_rate": { + "path_match": "ipfix.sonic_if_stat_in_bytes_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_out_bytes_rate": { + "path_match": "ipfix.sonic_if_stat_out_bytes_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_in_packet_size": { + "path_match": "ipfix.sonic_if_stat_in_packet_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_out_packet_size": { + "path_match": "ipfix.sonic_if_stat_out_packet_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_conn_rate": { + "path_match": "ipfix.sonic_if_stat_conn_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_init_bytes_rate": { + "path_match": "ipfix.sonic_flow_init_bytes_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_resp_bytes_rate": { + "path_match": "ipfix.sonic_flow_resp_bytes_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_init_packet_rate": { + "path_match": "ipfix.sonic_flow_init_packet_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_resp_packet_rate": { + "path_match": "ipfix.sonic_flow_resp_packet_rate", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_init_packet_size": { + "path_match": "ipfix.sonic_flow_init_packet_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_resp_packet_size": { + "path_match": "ipfix.sonic_flow_resp_packet_size", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_if_name": { + "path_match": "ipfix.sonic_if_stat_if_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_if_stat_if_type": { + "path_match": "ipfix.sonic_if_stat_if_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_if_speed": { + "path_match": "ipfix.sonic_if_stat_if_speed", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_if_state": { + "path_match": "ipfix.sonic_if_stat_if_state", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_if_mtu": { + "path_match": "ipfix.sonic_if_stat_if_mtu", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_if_mode": { + "path_match": "ipfix.sonic_if_stat_if_mode", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_url_flow_id": { + "path_match": "ipfix.sonic_url_flow_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_url_time_id": { + "path_match": "ipfix.sonic_url_time_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_core_stat_core_id": { + "path_match": "ipfix.sonic_core_stat_core_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_core_stat_core_util": { + "path_match": "ipfix.sonic_core_stat_core_util", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_flow_id": { + "path_match": "ipfix.sonic_voip_flow_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_time_id": { + "path_match": "ipfix.sonic_voip_time_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_init_call_id": { + "path_match": "ipfix.sonic_voip_init_call_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_voip_resp_call_id": { + "path_match": "ipfix.sonic_voip_resp_call_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_media_type": { + "path_match": "ipfix.sonic_media_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_media_protocol": { + "path_match": "ipfix.sonic_media_protocol", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_service": { + "path_match": "ipfix.sonic_service", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_service_ip_type": { + "path_match": "ipfix.sonic_service_ip_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_service_port_begin": { + "path_match": "ipfix.sonic_service_port_begin", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_service_port_end": { + "path_match": "ipfix.sonic_service_port_end", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_spam_sess_id": { + "path_match": "ipfix.sonic_spam_sess_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_spam_flow_id": { + "path_match": "ipfix.sonic_spam_flow_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_spam_time_id": { + "path_match": "ipfix.sonic_spam_time_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_spam_spammer": { + "path_match": "ipfix.sonic_spam_spammer", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_spam_type": { + "path_match": "ipfix.sonic_spam_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_spam_to_email": { + "path_match": "ipfix.sonic_spam_to_email", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_spam_from_email": { + "path_match": "ipfix.sonic_spam_from_email", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_mem_total_ram": { + "path_match": "ipfix.sonic_mem_total_ram", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_mem_avail_ram": { + "path_match": "ipfix.sonic_mem_avail_ram", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_mem_used_ram": { + "path_match": "ipfix.sonic_mem_used_ram", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_mem_db_ram": { + "path_match": "ipfix.sonic_mem_db_ram", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_mem_flows": { + "path_match": "ipfix.sonic_mem_flows", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_mem_per_flow": { + "path_match": "ipfix.sonic_mem_per_flow", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_dev_iface_id": { + "path_match": "ipfix.sonic_dev_iface_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_dev_ip": { + "path_match": "ipfix.sonic_dev_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_dev_mac": { + "path_match": "ipfix.sonic_dev_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_dev_name": { + "path_match": "ipfix.sonic_dev_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_vpn_in_spi_id": { + "path_match": "ipfix.sonic_vpn_in_spi_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_vpn_out_spi_id": { + "path_match": "ipfix.sonic_vpn_out_spi_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_vpn_tunnel": { + "path_match": "ipfix.sonic_vpn_tunnel", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_vpn_local_gw": { + "path_match": "ipfix.sonic_vpn_local_gw", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_vpn_remote_gw": { + "path_match": "ipfix.sonic_vpn_remote_gw", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_vpn_tunnel_iface_id": { + "path_match": "ipfix.sonic_vpn_tunnel_iface_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_vpn_policy_type": { + "path_match": "ipfix.sonic_vpn_policy_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_vpn_protocol_type": { + "path_match": "ipfix.sonic_vpn_protocol_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_vpn_encrypt_type": { + "path_match": "ipfix.sonic_vpn_encrypt_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_vpn_auth_type": { + "path_match": "ipfix.sonic_vpn_auth_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_vpn_start_time": { + "path_match": "ipfix.sonic_vpn_start_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_vpn_end_time": { + "path_match": "ipfix.sonic_vpn_end_time", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_init_vpn_spi_out": { + "path_match": "ipfix.sonic_init_vpn_spi_out", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_resp_vpn_spi_out": { + "path_match": "ipfix.sonic_resp_vpn_spi_out", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_init_to_resp_delta_packets": { + "path_match": "ipfix.sonic_init_to_resp_delta_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_init_to_resp_delta_bytes": { + "path_match": "ipfix.sonic_init_to_resp_delta_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_resp_to_init_delta_packets": { + "path_match": "ipfix.sonic_resp_to_init_delta_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_resp_to_init_delta_bytes": { + "path_match": "ipfix.sonic_resp_to_init_delta_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_flow_block_reason": { + "path_match": "ipfix.sonic_flow_block_reason", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_mac": { + "path_match": "ipfix.sonic_if_stat_mac", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_ip": { + "path_match": "ipfix.sonic_if_stat_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_if_stat_security_type": { + "path_match": "ipfix.sonic_if_stat_security_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_if_stat_zone": { + "path_match": "ipfix.sonic_if_stat_zone", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_user_ip": { + "path_match": "ipfix.sonic_user_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.sonic_url_rating_val1": { + "path_match": "ipfix.sonic_url_rating_val1", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_url_rating_val2": { + "path_match": "ipfix.sonic_url_rating_val2", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_url_rating_val3": { + "path_match": "ipfix.sonic_url_rating_val3", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_url_rating_val4": { + "path_match": "ipfix.sonic_url_rating_val4", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app_bwm_attr": { + "path_match": "ipfix.sonic_app_bwm_attr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_init_to_resp_lost_packets": { + "path_match": "ipfix.sonic_voip_init_to_resp_lost_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_resp_to_init_lost_packets": { + "path_match": "ipfix.sonic_voip_resp_to_init_lost_packets", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_init_to_resp_avg_latency": { + "path_match": "ipfix.sonic_voip_init_to_resp_avg_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_init_to_resp_max_latency": { + "path_match": "ipfix.sonic_voip_init_to_resp_max_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_resp_to_init_avg_latency": { + "path_match": "ipfix.sonic_voip_resp_to_init_avg_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_voip_resp_to_init_max_latency": { + "path_match": "ipfix.sonic_voip_resp_to_init_max_latency", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app_content_type": { + "path_match": "ipfix.sonic_app_content_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_snwl_option": { + "path_match": "ipfix.sonic_snwl_option", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app_risk_attr": { + "path_match": "ipfix.sonic_app_risk_attr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app_tech_attr": { + "path_match": "ipfix.sonic_app_tech_attr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_app_attr_bit_mask": { + "path_match": "ipfix.sonic_app_attr_bit_mask", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_top_apps_sigid": { + "path_match": "ipfix.sonic_top_apps_sigid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sonic_top_apps_appname": { + "path_match": "ipfix.sonic_top_apps_appname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sonic_top_apps_rate": { + "path_match": "ipfix.sonic_top_apps_rate", + "mapping": { + "type": "long" + } + } + }, - { - "ipfix.sophos_afc_proto": { - "path_match": "ipfix.sophos_afc_proto", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.sophos_afc_proto_name": { - "path_match": "ipfix.sophos_afc_proto_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.sophos_flow_direction": { - "path_match": "ipfix.sophos_flow_direction", - "mapping": { - "type": "long" - } - } - }, + { + "ipfix.sophos_afc_proto": { + "path_match": "ipfix.sophos_afc_proto", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.sophos_afc_proto_name": { + "path_match": "ipfix.sophos_afc_proto_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.sophos_flow_direction": { + "path_match": "ipfix.sophos_flow_direction", + "mapping": { + "type": "long" + } + } + }, - { - "ipfix.viptela_vpn_id": { - "path_match": "ipfix.viptela_vpn_id", - "mapping": { - "type": "long" - } - } - }, - - - - { - "ipfix.vmware_tenant_proto": { - "path_match": "ipfix.vmware_tenant_proto", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_tenant_src_ipv4": { - "path_match": "ipfix.vmware_tenant_src_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.vmware_tenant_dst_ipv4": { - "path_match": "ipfix.vmware_tenant_dst_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.vmware_tenant_src_ipv6": { - "path_match": "ipfix.vmware_tenant_src_ipv6", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.vmware_tenant_dst_ipv6": { - "path_match": "ipfix.vmware_tenant_dst_ipv6", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.vmware_tenant_src_port": { - "path_match": "ipfix.vmware_tenant_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_tenant_dst_port": { - "path_match": "ipfix.vmware_tenant_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_egress_iface_attr": { - "path_match": "ipfix.vmware_egress_iface_attr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_vxlan_export_role": { - "path_match": "ipfix.vmware_vxlan_export_role", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_ingress_iface_attr": { - "path_match": "ipfix.vmware_ingress_iface_attr", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_tunnel_type": { - "path_match": "ipfix.vmware_tunnel_type", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_tunnel_key": { - "path_match": "ipfix.vmware_tunnel_key", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.vmware_tunnel_src_ipv4_addr": { - "path_match": "ipfix.vmware_tunnel_src_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.vmware_tunnel_dst_ipv4_addr": { - "path_match": "ipfix.vmware_tunnel_dst_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "ipfix.vmware_tunnel_protocol_id": { - "path_match": "ipfix.vmware_tunnel_protocol_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_tunnel_src_transport_port": { - "path_match": "ipfix.vmware_tunnel_src_transport_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_tunnel_dst_transport_port": { - "path_match": "ipfix.vmware_tunnel_dst_transport_port", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.vmware_virt_observation_id": { - "path_match": "ipfix.vmware_virt_observation_id", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.viptela_vpn_id": { + "path_match": "ipfix.viptela_vpn_id", + "mapping": { + "type": "long" + } + } + }, + + + + { + "ipfix.vmware_tenant_proto": { + "path_match": "ipfix.vmware_tenant_proto", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_tenant_src_ipv4": { + "path_match": "ipfix.vmware_tenant_src_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.vmware_tenant_dst_ipv4": { + "path_match": "ipfix.vmware_tenant_dst_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.vmware_tenant_src_ipv6": { + "path_match": "ipfix.vmware_tenant_src_ipv6", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.vmware_tenant_dst_ipv6": { + "path_match": "ipfix.vmware_tenant_dst_ipv6", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.vmware_tenant_src_port": { + "path_match": "ipfix.vmware_tenant_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_tenant_dst_port": { + "path_match": "ipfix.vmware_tenant_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_egress_iface_attr": { + "path_match": "ipfix.vmware_egress_iface_attr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_vxlan_export_role": { + "path_match": "ipfix.vmware_vxlan_export_role", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_ingress_iface_attr": { + "path_match": "ipfix.vmware_ingress_iface_attr", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_tunnel_type": { + "path_match": "ipfix.vmware_tunnel_type", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_tunnel_key": { + "path_match": "ipfix.vmware_tunnel_key", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.vmware_tunnel_src_ipv4_addr": { + "path_match": "ipfix.vmware_tunnel_src_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.vmware_tunnel_dst_ipv4_addr": { + "path_match": "ipfix.vmware_tunnel_dst_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "ipfix.vmware_tunnel_protocol_id": { + "path_match": "ipfix.vmware_tunnel_protocol_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_tunnel_src_transport_port": { + "path_match": "ipfix.vmware_tunnel_src_transport_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_tunnel_dst_transport_port": { + "path_match": "ipfix.vmware_tunnel_dst_transport_port", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.vmware_virt_observation_id": { + "path_match": "ipfix.vmware_virt_observation_id", + "mapping": { + "type": "keyword" + } + } + }, - { - "ipfix.ziften_inbound": { - "path_match": "ipfix.ziften_inbound", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ziften_pid": { - "path_match": "ipfix.ziften_pid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ziften_parent_pid": { - "path_match": "ipfix.ziften_parent_pid", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ziften_image_path": { - "path_match": "ipfix.ziften_image_path", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_filename": { - "path_match": "ipfix.ziften_filename", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_platform": { - "path_match": "ipfix.ziften_platform", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_agent_guid": { - "path_match": "ipfix.ziften_agent_guid", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_hostname": { - "path_match": "ipfix.ziften_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_unk_269": { - "path_match": "ipfix.ziften_unk_269", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_file_sig": { - "path_match": "ipfix.ziften_file_sig", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_file_sig_algo": { - "path_match": "ipfix.ziften_file_sig_algo", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_file_sig_algo_char": { - "path_match": "ipfix.ziften_file_sig_algo_char", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_user_sid": { - "path_match": "ipfix.ziften_user_sid", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_parent_image_path": { - "path_match": "ipfix.ziften_parent_image_path", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_parent_file_sig": { - "path_match": "ipfix.ziften_parent_file_sig", - "mapping": { - "type": "keyword" - } - } - }, - { - "ipfix.ziften_acct_id": { - "path_match": "ipfix.ziften_acct_id", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ziften_mod_time_secs": { - "path_match": "ipfix.ziften_mod_time_secs", - "mapping": { - "type": "long" - } - } - }, - { - "ipfix.ziften_command": { - "path_match": "ipfix.ziften_command", - "mapping": { - "type": "keyword" - } - } - }, + { + "ipfix.ziften_inbound": { + "path_match": "ipfix.ziften_inbound", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ziften_pid": { + "path_match": "ipfix.ziften_pid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ziften_parent_pid": { + "path_match": "ipfix.ziften_parent_pid", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ziften_image_path": { + "path_match": "ipfix.ziften_image_path", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_filename": { + "path_match": "ipfix.ziften_filename", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_platform": { + "path_match": "ipfix.ziften_platform", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_agent_guid": { + "path_match": "ipfix.ziften_agent_guid", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_hostname": { + "path_match": "ipfix.ziften_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_unk_269": { + "path_match": "ipfix.ziften_unk_269", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_file_sig": { + "path_match": "ipfix.ziften_file_sig", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_file_sig_algo": { + "path_match": "ipfix.ziften_file_sig_algo", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_file_sig_algo_char": { + "path_match": "ipfix.ziften_file_sig_algo_char", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_user_sid": { + "path_match": "ipfix.ziften_user_sid", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_parent_image_path": { + "path_match": "ipfix.ziften_parent_image_path", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_parent_file_sig": { + "path_match": "ipfix.ziften_parent_file_sig", + "mapping": { + "type": "keyword" + } + } + }, + { + "ipfix.ziften_acct_id": { + "path_match": "ipfix.ziften_acct_id", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ziften_mod_time_secs": { + "path_match": "ipfix.ziften_mod_time_secs", + "mapping": { + "type": "long" + } + } + }, + { + "ipfix.ziften_command": { + "path_match": "ipfix.ziften_command", + "mapping": { + "type": "keyword" + } + } + }, - { - "netflow.absoluteError": { - "path_match": "netflow.absoluteError", - "mapping": { - "type": "double" - } - } - }, - { - "netflow.anonymizationFlags": { - "path_match": "netflow.anonymizationFlags", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.anonymizationTechnique": { - "path_match": "netflow.anonymizationTechnique", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.app_id": { - "path_match": "netflow.app_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.application_description": { - "path_match": "netflow.application_description", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.application_id": { - "path_match": "netflow.application_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.application_name": { - "path_match": "netflow.application_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.applicationCategoryName": { - "path_match": "netflow.applicationCategoryName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.applicationGroupName": { - "path_match": "netflow.applicationGroupName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.applicationSubCategoryName": { - "path_match": "netflow.applicationSubCategoryName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.bgp_ipv4_next_hop": { - "path_match": "netflow.bgp_ipv4_next_hop", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.bgp_ipv6_next_hop": { - "path_match": "netflow.bgp_ipv6_next_hop", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.bgpNextAdjacentAsNumber": { - "path_match": "netflow.bgpNextAdjacentAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.bgpPrevAdjacentAsNumber": { - "path_match": "netflow.bgpPrevAdjacentAsNumber", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.bgpValidityState": { - "path_match": "netflow.bgpValidityState", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.biflowDirection": { - "path_match": "netflow.biflowDirection", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.collectorCertificate": { - "path_match": "netflow.collectorCertificate", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.collectorIPv4Address": { - "path_match": "netflow.collectorIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.collectorIPv6Address": { - "path_match": "netflow.collectorIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.collectionTimeMilliseconds": { - "path_match": "netflow.collectionTimeMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.collectorTransportPort": { - "path_match": "netflow.collectorTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.commonPropertiesId": { - "path_match": "netflow.commonPropertiesId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.confidenceLevel": { - "path_match": "netflow.confidenceLevel", - "mapping": { - "type": "double" - } - } - }, - { - "netflow.conn_id": { - "path_match": "netflow.conn_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.connectionSumDurationSeconds": { - "path_match": "netflow.connectionSumDurationSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.connectionTransactionId": { - "path_match": "netflow.connectionTransactionId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dataLinkFrameSection": { - "path_match": "netflow.dataLinkFrameSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.dataLinkFrameSize": { - "path_match": "netflow.dataLinkFrameSize", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dataLinkFrameType": { - "path_match": "netflow.dataLinkFrameType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dataRecordsReliability": { - "path_match": "netflow.dataRecordsReliability", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.destinationIPv6Prefix": { - "path_match": "netflow.destinationIPv6Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.digestHashValue": { - "path_match": "netflow.digestHashValue", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.direction": { - "path_match": "netflow.direction", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.distinctCountOfDestinationIPAddress": { - "path_match": "netflow.distinctCountOfDestinationIPAddress", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.distinctCountOfDestinationIPv4Address": { - "path_match": "netflow.distinctCountOfDestinationIPv4Address", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.distinctCountOfDestinationIPv6Address": { - "path_match": "netflow.distinctCountOfDestinationIPv6Address", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.distinctCountOfSourceIPAddress": { - "path_match": "netflow.distinctCountOfSourceIPAddress", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.distinctCountOfSourceIPv4Address": { - "path_match": "netflow.distinctCountOfSourceIPv4Address", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.distinctCountOfSourceIPv6Address": { - "path_match": "netflow.distinctCountOfSourceIPv6Address", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dot1qCustomerDEI": { - "path_match": "netflow.dot1qCustomerDEI", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dot1qCustomerDestinationMacAddress": { - "path_match": "netflow.dot1qCustomerDestinationMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.dot1qCustomerPriority": { - "path_match": "netflow.dot1qCustomerPriority", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dot1qCustomerSourceMacAddress": { - "path_match": "netflow.dot1qCustomerSourceMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.dot1qCustomerVlanId": { - "path_match": "netflow.dot1qCustomerVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dot1qDEI": { - "path_match": "netflow.dot1qDEI", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dot1qPriority": { - "path_match": "netflow.dot1qPriority", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dot1qServiceInstanceId": { - "path_match": "netflow.dot1qServiceInstanceId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dot1qServiceInstancePriority": { - "path_match": "netflow.dot1qServiceInstancePriority", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dot1qServiceInstanceTag": { - "path_match": "netflow.dot1qServiceInstanceTag", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.dot1qVlanId": { - "path_match": "netflow.dot1qVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.droppedLayer2OctetDeltaCount": { - "path_match": "netflow.droppedLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.droppedLayer2OctetTotalCount": { - "path_match": "netflow.droppedLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.droppedOctetDeltaCount": { - "path_match": "netflow.droppedOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.droppedOctetTotalCount": { - "path_match": "netflow.droppedOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.droppedPacketDeltaCount": { - "path_match": "netflow.droppedPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.droppedPacketTotalCount": { - "path_match": "netflow.droppedPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dst_as": { - "path_match": "netflow.dst_as", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dst_mask": { - "path_match": "netflow.dst_mask", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dst_tos": { - "path_match": "netflow.dst_tos", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.dst_vlan": { - "path_match": "netflow.dst_vlan", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.egressBroadcastPacketTotalCount": { - "path_match": "netflow.egressBroadcastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.egressInterfaceType": { - "path_match": "netflow.egressInterfaceType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.egressPhysicalInterface": { - "path_match": "netflow.egressPhysicalInterface", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.egressUnicastPacketTotalCount": { - "path_match": "netflow.egressUnicastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.egressVRFID": { - "path_match": "netflow.egressVRFID", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.encryptedTechnology": { - "path_match": "netflow.encryptedTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.engine_id": { - "path_match": "netflow.engine_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.engine_type": { - "path_match": "netflow.engine_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ethernetHeaderLength": { - "path_match": "netflow.ethernetHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ethernetPayloadLength": { - "path_match": "netflow.ethernetPayloadLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ethernetTotalLength": { - "path_match": "netflow.ethernetTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ethernetType": { - "path_match": "netflow.ethernetType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.event_time_msec": { - "path_match": "netflow.event_time_msec", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.exporterCertificate": { - "path_match": "netflow.exporterCertificate", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.exporterIPv4Address": { - "path_match": "netflow.exporterIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.exporterIPv6Address": { - "path_match": "netflow.exporterIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.exporterTransportPort": { - "path_match": "netflow.exporterTransportPort", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.exportingProcessId": { - "path_match": "netflow.exportingProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.exportInterface": { - "path_match": "netflow.exportInterface", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.exportProtocolVersion": { - "path_match": "netflow.exportProtocolVersion", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.exportSctpStreamId": { - "path_match": "netflow.exportSctpStreamId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.exportTransportProtocol": { - "path_match": "netflow.exportTransportProtocol", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.first_switched": { - "path_match": "netflow.first_switched", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.flow_active_timeout": { - "path_match": "netflow.flow_active_timeout", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_end_msec": { - "path_match": "netflow.flow_end_msec", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_end_reason": { - "path_match": "netflow.flow_end_reason", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_inactive_timeout": { - "path_match": "netflow.flow_inactive_timeout", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_records": { - "path_match": "netflow.flow_records", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_sampler_id": { - "path_match": "netflow.flow_sampler_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_sampler_mode": { - "path_match": "netflow.flow_sampler_mode", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_sampler_random_interval": { - "path_match": "netflow.flow_sampler_random_interval", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_seq_num": { - "path_match": "netflow.flow_seq_num", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flow_start_msec": { - "path_match": "netflow.flow_start_msec", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowDurationMicroseconds": { - "path_match": "netflow.flowDurationMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowDurationMilliseconds": { - "path_match": "netflow.flowDurationMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowEndDeltaMicroseconds": { - "path_match": "netflow.flowEndDeltaMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowEndMicroseconds": { - "path_match": "netflow.flowEndMicroseconds", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.flowEndNanoseconds": { - "path_match": "netflow.flowEndNanoseconds", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.flowEndSeconds": { - "path_match": "netflow.flowEndSeconds", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.flowKeyIndicator": { - "path_match": "netflow.flowKeyIndicator", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flows": { - "path_match": "netflow.flows", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowSamplingTimeInterval": { - "path_match": "netflow.flowSamplingTimeInterval", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowSamplingTimeSpacing": { - "path_match": "netflow.flowSamplingTimeSpacing", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowSelectedFlowDeltaCount": { - "path_match": "netflow.flowSelectedFlowDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowSelectedOctetDeltaCount": { - "path_match": "netflow.flowSelectedOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowSelectedPacketDeltaCount": { - "path_match": "netflow.flowSelectedPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowSelectorAlgorithm": { - "path_match": "netflow.flowSelectorAlgorithm", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowset_id": { - "path_match": "netflow.flowset_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowStartDeltaMicroseconds": { - "path_match": "netflow.flowStartDeltaMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.flowStartMicroseconds": { - "path_match": "netflow.flowStartMicroseconds", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.flowStartNanoseconds": { - "path_match": "netflow.flowStartNanoseconds", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.flowStartSeconds": { - "path_match": "netflow.flowStartSeconds", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.forwarding_status.reason": { - "path_match": "netflow.forwarding_status.reason", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.forwarding_status.status": { - "path_match": "netflow.forwarding_status.status", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.fragmentFlags": { - "path_match": "netflow.fragmentFlags", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.fw_event": { - "path_match": "netflow.fw_event", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.fw_ext_event": { - "path_match": "netflow.fw_ext_event", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.fwd_flow_delta_bytes": { - "path_match": "netflow.fwd_flow_delta_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.greKey": { - "path_match": "netflow.greKey", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashDigestOutput": { - "path_match": "netflow.hashDigestOutput", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashFlowDomain": { - "path_match": "netflow.hashFlowDomain", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashInitialiserValue": { - "path_match": "netflow.hashInitialiserValue", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashIPPayloadOffset": { - "path_match": "netflow.hashIPPayloadOffset", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashIPPayloadSize": { - "path_match": "netflow.hashIPPayloadSize", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashOutputRangeMax": { - "path_match": "netflow.hashOutputRangeMax", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashOutputRangeMin": { - "path_match": "netflow.hashOutputRangeMin", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashSelectedRangeMax": { - "path_match": "netflow.hashSelectedRangeMax", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.hashSelectedRangeMin": { - "path_match": "netflow.hashSelectedRangeMin", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.icmp_code_ipv4": { - "path_match": "netflow.icmp_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.icmp_code_ipv6": { - "path_match": "netflow.icmp_code_ipv6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.icmp_type": { - "path_match": "netflow.icmp_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.icmp_type_ipv4": { - "path_match": "netflow.icmp_type_ipv4", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.icmp_type_ipv6": { - "path_match": "netflow.icmp_type_ipv6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.icmpTypeCodeIPv6": { - "path_match": "netflow.icmpTypeCodeIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.if_desc": { - "path_match": "netflow.if_desc", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.if_name": { - "path_match": "netflow.if_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ignoredDataRecordTotalCount": { - "path_match": "netflow.ignoredDataRecordTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ignoredLayer2FrameTotalCount": { - "path_match": "netflow.ignoredLayer2FrameTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ignoredLayer2OctetTotalCount": { - "path_match": "netflow.ignoredLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ignoredOctetTotalCount": { - "path_match": "netflow.ignoredOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ignoredPacketTotalCount": { - "path_match": "netflow.ignoredPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.in_bytes": { - "path_match": "netflow.in_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.in_dst_mac": { - "path_match": "netflow.in_dst_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.in_permanent_bytes": { - "path_match": "netflow.in_permanent_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.in_permanent_pkts": { - "path_match": "netflow.in_permanent_pkts", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.in_pkts": { - "path_match": "netflow.in_pkts", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.in_src_mac": { - "path_match": "netflow.in_src_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.informationElementDataType": { - "path_match": "netflow.informationElementDataType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.informationElementDescription": { - "path_match": "netflow.informationElementDescription", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.informationElementId": { - "path_match": "netflow.informationElementId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.informationElementIndex": { - "path_match": "netflow.informationElementIndex", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.informationElementName": { - "path_match": "netflow.informationElementName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.informationElementRangeBegin": { - "path_match": "netflow.informationElementRangeBegin", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.informationElementRangeEnd": { - "path_match": "netflow.informationElementRangeEnd", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.informationElementSemantics": { - "path_match": "netflow.informationElementSemantics", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.informationElementUnits": { - "path_match": "netflow.informationElementUnits", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ingressBroadcastPacketTotalCount": { - "path_match": "netflow.ingressBroadcastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ingressInterfaceType": { - "path_match": "netflow.ingressInterfaceType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ingressMulticastPacketTotalCount": { - "path_match": "netflow.ingressMulticastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ingressPhysicalInterface": { - "path_match": "netflow.ingressPhysicalInterface", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ingressUnicastPacketTotalCount": { - "path_match": "netflow.ingressUnicastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ingressVRFID": { - "path_match": "netflow.ingressVRFID", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.initiatorPackets": { - "path_match": "netflow.initiatorPackets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.input_snmp": { - "path_match": "netflow.input_snmp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.intermediateProcessId": { - "path_match": "netflow.intermediateProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ip_dscp": { - "path_match": "netflow.ip_dscp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ip_protocol_version": { - "path_match": "netflow.ip_protocol_version", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ip_tos": { - "path_match": "netflow.ip_tos", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipHeaderLength": { - "path_match": "netflow.ipHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipHeaderPacketSection": { - "path_match": "netflow.ipHeaderPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ipPayloadLength": { - "path_match": "netflow.ipPayloadLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipPayloadPacketSection": { - "path_match": "netflow.ipPayloadPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ipPrecedence": { - "path_match": "netflow.ipPrecedence", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.IPSecSPI": { - "path_match": "netflow.IPSecSPI", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipTotalLength": { - "path_match": "netflow.ipTotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipTTL": { - "path_match": "netflow.ipTTL", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipv4_dst_addr": { - "path_match": "netflow.ipv4_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ipv4_dst_prefix": { - "path_match": "netflow.ipv4_dst_prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ipv4_ident": { - "path_match": "netflow.ipv4_ident", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipv4_next_hop": { - "path_match": "netflow.ipv4_next_hop", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ipv4_src_addr": { - "path_match": "netflow.ipv4_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ipv4_src_prefix": { - "path_match": "netflow.ipv4_src_prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ipv4IHL": { - "path_match": "netflow.ipv4IHL", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipv4Options": { - "path_match": "netflow.ipv4Options", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipv6_dst_addr": { - "path_match": "netflow.ipv6_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ipv6_dst_mask": { - "path_match": "netflow.ipv6_dst_mask", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipv6_flow_label": { - "path_match": "netflow.ipv6_flow_label", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipv6_next_hop": { - "path_match": "netflow.ipv6_next_hop", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ipv6_option_headers": { - "path_match": "netflow.ipv6_option_headers", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ipv6_src_addr": { - "path_match": "netflow.ipv6_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ipv6_src_mask": { - "path_match": "netflow.ipv6_src_mask", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.isMulticast": { - "path_match": "netflow.isMulticast", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.l4_dst_port": { - "path_match": "netflow.l4_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.l4_src_port": { - "path_match": "netflow.l4_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.last_switched": { - "path_match": "netflow.last_switched", - "mapping": { - "type": "date" - } - } - }, - { - "netflow.layer2FrameDeltaCount": { - "path_match": "netflow.layer2FrameDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.layer2FrameTotalCount": { - "path_match": "netflow.layer2FrameTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.layer2OctetDeltaCount": { - "path_match": "netflow.layer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.layer2OctetDeltaSumOfSquares": { - "path_match": "netflow.layer2OctetDeltaSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.layer2OctetTotalCount": { - "path_match": "netflow.layer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.layer2OctetTotalSumOfSquares": { - "path_match": "netflow.layer2OctetTotalSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.layer2SegmentId": { - "path_match": "netflow.layer2SegmentId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.lineCardId": { - "path_match": "netflow.lineCardId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.lowerCILimit": { - "path_match": "netflow.lowerCILimit", - "mapping": { - "type": "double" - } - } - }, - { - "netflow.max_pkt_length": { - "path_match": "netflow.max_pkt_length", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.max_ttl": { - "path_match": "netflow.max_ttl", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.maxExportSeconds": { - "path_match": "netflow.maxExportSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.maxFlowEndMicroseconds": { - "path_match": "netflow.maxFlowEndMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.maxFlowEndMilliseconds": { - "path_match": "netflow.maxFlowEndMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.maxFlowEndNanoseconds": { - "path_match": "netflow.maxFlowEndNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.maxFlowEndSeconds": { - "path_match": "netflow.maxFlowEndSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.maximumLayer2TotalLength": { - "path_match": "netflow.maximumLayer2TotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.messageMD5Checksum": { - "path_match": "netflow.messageMD5Checksum", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.messageScope": { - "path_match": "netflow.messageScope", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.meteringProcessId": { - "path_match": "netflow.meteringProcessId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.metroEvcId": { - "path_match": "netflow.metroEvcId", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.metroEvcType": { - "path_match": "netflow.metroEvcType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.min_pkt_length": { - "path_match": "netflow.min_pkt_length", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.min_ttl": { - "path_match": "netflow.min_ttl", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.minExportSeconds": { - "path_match": "netflow.minExportSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.minFlowStartMicroseconds": { - "path_match": "netflow.minFlowStartMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.minFlowStartMilliseconds": { - "path_match": "netflow.minFlowStartMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.minFlowStartNanoseconds": { - "path_match": "netflow.minFlowStartNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.minFlowStartSeconds": { - "path_match": "netflow.minFlowStartSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.minimumLayer2TotalLength": { - "path_match": "netflow.minimumLayer2TotalLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.monitoringIntervalEndMilliSeconds": { - "path_match": "netflow.monitoringIntervalEndMilliSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.monitoringIntervalStartMilliSeconds": { - "path_match": "netflow.monitoringIntervalStartMilliSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mpls_label_stack_octets.bottom_of_stack": { - "path_match": "netflow.mpls_label_stack_octets.bottom_of_stack", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mpls_label_stack_octets.experimental": { - "path_match": "netflow.mpls_label_stack_octets.experimental", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mpls_label_stack_octets.label": { - "path_match": "netflow.mpls_label_stack_octets.label", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mpls_label_stack_octets.ttl": { - "path_match": "netflow.mpls_label_stack_octets.ttl", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mpls_top_label_ip": { - "path_match": "netflow.mpls_top_label_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.mpls_top_label_type": { - "path_match": "netflow.mpls_top_label_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mplsLabelStackDepth": { - "path_match": "netflow.mplsLabelStackDepth", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mplsLabelStackSection": { - "path_match": "netflow.mplsLabelStackSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.mplsPayloadPacketSection": { - "path_match": "netflow.mplsPayloadPacketSection", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.mplsTopLabelExp": { - "path_match": "netflow.mplsTopLabelExp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mplsTopLabelIPv6Address": { - "path_match": "netflow.mplsTopLabelIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.mplsTopLabelTTL": { - "path_match": "netflow.mplsTopLabelTTL", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mul_dst_bytes": { - "path_match": "netflow.mul_dst_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mul_dst_pkts": { - "path_match": "netflow.mul_dst_pkts", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.mul_igmp_type": { - "path_match": "netflow.mul_igmp_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.natEvent": { - "path_match": "netflow.natEvent", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.natOriginatingAddressRealm": { - "path_match": "netflow.natOriginatingAddressRealm", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.natPoolId": { - "path_match": "netflow.natPoolId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.natPoolName": { - "path_match": "netflow.natPoolName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.natType": { - "path_match": "netflow.natType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.newConnectionDeltaCount": { - "path_match": "netflow.newConnectionDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.nextHeaderIPv6": { - "path_match": "netflow.nextHeaderIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.notSentFlowTotalCount": { - "path_match": "netflow.notSentFlowTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.notSentLayer2OctetTotalCount": { - "path_match": "netflow.notSentLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.notSentOctetTotalCount": { - "path_match": "netflow.notSentOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.notSentPacketTotalCount": { - "path_match": "netflow.notSentPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.nprobe_proto": { - "path_match": "netflow.nprobe_proto", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.nprobe_proto_name": { - "path_match": "netflow.nprobe_proto_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.observationDomainId": { - "path_match": "netflow.observationDomainId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.observationDomainName": { - "path_match": "netflow.observationDomainName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.observationPointId": { - "path_match": "netflow.observationPointId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.observationPointType": { - "path_match": "netflow.observationPointType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.observationTimeMicroseconds": { - "path_match": "netflow.observationTimeMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.observationTimeNanoseconds": { - "path_match": "netflow.observationTimeNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.observationTimeSeconds": { - "path_match": "netflow.observationTimeSeconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.observedFlowTotalCount": { - "path_match": "netflow.observedFlowTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.octetDeltaSumOfSquares": { - "path_match": "netflow.octetDeltaSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.octetTotalSumOfSquares": { - "path_match": "netflow.octetTotalSumOfSquares", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.opaqueOctets": { - "path_match": "netflow.opaqueOctets", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.originalExporterIPv4Address": { - "path_match": "netflow.originalExporterIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.originalExporterIPv6Address": { - "path_match": "netflow.originalExporterIPv6Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.originalFlowsCompleted": { - "path_match": "netflow.originalFlowsCompleted", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.originalFlowsInitiated": { - "path_match": "netflow.originalFlowsInitiated", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.originalFlowsPresent": { - "path_match": "netflow.originalFlowsPresent", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.originalObservationDomainId": { - "path_match": "netflow.originalObservationDomainId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.out_bytes": { - "path_match": "netflow.out_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.out_dst_mac": { - "path_match": "netflow.out_dst_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.out_pkts": { - "path_match": "netflow.out_pkts", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.out_src_mac": { - "path_match": "netflow.out_src_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.output_snmp": { - "path_match": "netflow.output_snmp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.p2pTechnology": { - "path_match": "netflow.p2pTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.payloadLengthIPv6": { - "path_match": "netflow.payloadLengthIPv6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.portId": { - "path_match": "netflow.portId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.portRangeNumPorts": { - "path_match": "netflow.portRangeNumPorts", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.portRangeStepSize": { - "path_match": "netflow.portRangeStepSize", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postDot1qCustomerVlanId": { - "path_match": "netflow.postDot1qCustomerVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postDot1qVlanId": { - "path_match": "netflow.postDot1qVlanId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postIpDiffServCodePoint": { - "path_match": "netflow.postIpDiffServCodePoint", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postIpPrecedence": { - "path_match": "netflow.postIpPrecedence", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postLayer2OctetDeltaCount": { - "path_match": "netflow.postLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postLayer2OctetTotalCount": { - "path_match": "netflow.postLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postMCastLayer2OctetDeltaCount": { - "path_match": "netflow.postMCastLayer2OctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postMCastLayer2OctetTotalCount": { - "path_match": "netflow.postMCastLayer2OctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postMCastPacketTotalCount": { - "path_match": "netflow.postMCastPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postMCastOctetTotalCount": { - "path_match": "netflow.postMCastOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postMplsTopLabelExp": { - "path_match": "netflow.postMplsTopLabelExp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postNATPortBlockEnd": { - "path_match": "netflow.postNATPortBlockEnd", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postNATPortBlockStart": { - "path_match": "netflow.postNATPortBlockStart", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postOctetTotalCount": { - "path_match": "netflow.postOctetTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.postPacketTotalCount": { - "path_match": "netflow.postPacketTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.privateEnterpriseNumber": { - "path_match": "netflow.privateEnterpriseNumber", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.protocol": { - "path_match": "netflow.protocol", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.pseudoWireControlWord": { - "path_match": "netflow.pseudoWireControlWord", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.pseudoWireDestinationIPv4Address": { - "path_match": "netflow.pseudoWireDestinationIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.pseudoWireId": { - "path_match": "netflow.pseudoWireId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.pseudoWireType": { - "path_match": "netflow.pseudoWireType", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.relativeError": { - "path_match": "netflow.relativeError", - "mapping": { - "type": "double" - } - } - }, - { - "netflow.responderPackets": { - "path_match": "netflow.responderPackets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.rev_flow_delta_bytes": { - "path_match": "netflow.rev_flow_delta_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.rfc3550JitterMicroseconds": { - "path_match": "netflow.rfc3550JitterMicroseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.rfc3550JitterMilliseconds": { - "path_match": "netflow.rfc3550JitterMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.rfc3550JitterNanoseconds": { - "path_match": "netflow.rfc3550JitterNanoseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.rtpSequenceNumber": { - "path_match": "netflow.rtpSequenceNumber", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.sampler_name": { - "path_match": "netflow.sampler_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.sampling_algorithm": { - "path_match": "netflow.sampling_algorithm", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.sampling_interval": { - "path_match": "netflow.sampling_interval", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.samplingFlowInterval": { - "path_match": "netflow.samplingFlowInterval", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.samplingFlowSpacing": { - "path_match": "netflow.samplingFlowSpacing", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.samplingPacketInterval": { - "path_match": "netflow.samplingPacketInterval", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.samplingPacketSpace": { - "path_match": "netflow.samplingPacketSpace", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.samplingPopulation": { - "path_match": "netflow.samplingPopulation", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.samplingProbability": { - "path_match": "netflow.samplingProbability", - "mapping": { - "type": "double" - } - } - }, - { - "netflow.samplingSize": { - "path_match": "netflow.samplingSize", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.samplingTimeInterval": { - "path_match": "netflow.samplingTimeInterval", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.samplingTimeSpace": { - "path_match": "netflow.samplingTimeSpace", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.scope_system": { - "path_match": "netflow.scope_system", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.sectionExportedOctets": { - "path_match": "netflow.sectionExportedOctets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.sectionOffset": { - "path_match": "netflow.sectionOffset", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.selectionSequenceId": { - "path_match": "netflow.selectionSequenceId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.selectorAlgorithm": { - "path_match": "netflow.selectorAlgorithm", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.selectorId": { - "path_match": "netflow.selectorId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.selectorIDTotalFlowsObserved": { - "path_match": "netflow.selectorIDTotalFlowsObserved", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.selectorIDTotalFlowsSelected": { - "path_match": "netflow.selectorIDTotalFlowsSelected", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.selectorIdTotalPktsObserved": { - "path_match": "netflow.selectorIdTotalPktsObserved", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.selectorIdTotalPktsSelected": { - "path_match": "netflow.selectorIdTotalPktsSelected", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.selectorName": { - "path_match": "netflow.selectorName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.sessionScope": { - "path_match": "netflow.sessionScope", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.sourceIPv6Prefix": { - "path_match": "netflow.sourceIPv6Prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.src_as": { - "path_match": "netflow.src_as", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.src_mask": { - "path_match": "netflow.src_mask", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.src_tos": { - "path_match": "netflow.src_tos", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.src_vlan": { - "path_match": "netflow.src_vlan", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.staIPv4Address": { - "path_match": "netflow.staIPv4Address", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.staMacAddress": { - "path_match": "netflow.staMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.systemInitTimeMilliseconds": { - "path_match": "netflow.systemInitTimeMilliseconds", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcp_dst_port": { - "path_match": "netflow.tcp_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcp_flags": { - "path_match": "netflow.tcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcp_src_port": { - "path_match": "netflow.tcp_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpAcknowledgementNumber": { - "path_match": "netflow.tcpAcknowledgementNumber", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpAckTotalCount": { - "path_match": "netflow.tcpAckTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpDestinationPort": { - "path_match": "netflow.tcpDestinationPort", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpFinTotalCount": { - "path_match": "netflow.tcpFinTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpHeaderLength": { - "path_match": "netflow.tcpHeaderLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpOptions": { - "path_match": "netflow.tcpOptions", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpPshTotalCount": { - "path_match": "netflow.tcpPshTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpRstTotalCount": { - "path_match": "netflow.tcpRstTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpSequenceNumber": { - "path_match": "netflow.tcpSequenceNumber", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpSynTotalCount": { - "path_match": "netflow.tcpSynTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpUrgentPointer": { - "path_match": "netflow.tcpUrgentPointer", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpUrgTotalCount": { - "path_match": "netflow.tcpUrgTotalCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpWindowScale": { - "path_match": "netflow.tcpWindowScale", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tcpWindowSize": { - "path_match": "netflow.tcpWindowSize", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.templateId": { - "path_match": "netflow.templateId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.total_bytes_exp": { - "path_match": "netflow.total_bytes_exp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.total_flows_exp": { - "path_match": "netflow.total_flows_exp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.total_pkts_exp": { - "path_match": "netflow.total_pkts_exp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.totalLengthIPv4": { - "path_match": "netflow.totalLengthIPv4", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.transportOctetDeltaCount": { - "path_match": "netflow.transportOctetDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.transportPacketDeltaCount": { - "path_match": "netflow.transportPacketDeltaCount", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.tunnelTechnology": { - "path_match": "netflow.tunnelTechnology", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.udp_dst_port": { - "path_match": "netflow.udp_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.udp_src_port": { - "path_match": "netflow.udp_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.udpMessageLength": { - "path_match": "netflow.udpMessageLength", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.upperCILimit": { - "path_match": "netflow.upperCILimit", - "mapping": { - "type": "double" - } - } - }, - { - "netflow.user_id": { - "path_match": "netflow.user_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.username": { - "path_match": "netflow.username", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.userName": { - "path_match": "netflow.userName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.valueDistributionMethod": { - "path_match": "netflow.valueDistributionMethod", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.virtualStationInterfaceId": { - "path_match": "netflow.virtualStationInterfaceId", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.virtualStationInterfaceName": { - "path_match": "netflow.virtualStationInterfaceName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.virtualStationName": { - "path_match": "netflow.virtualStationName", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.virtualStationUUID": { - "path_match": "netflow.virtualStationUUID", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.VRFname": { - "path_match": "netflow.VRFname", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.wlan_id": { - "path_match": "netflow.wlan_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.wlanChannelId": { - "path_match": "netflow.wlanChannelId", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.wlanSSID": { - "path_match": "netflow.wlanSSID", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.wtpMacAddress": { - "path_match": "netflow.wtpMacAddress", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.xlate_dst_addr_ipv4": { - "path_match": "netflow.xlate_dst_addr_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.xlate_dst_addr_ipv6": { - "path_match": "netflow.xlate_dst_addr_ipv6", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.xlate_dst_port": { - "path_match": "netflow.xlate_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.xlate_src_addr_ipv4": { - "path_match": "netflow.xlate_src_addr_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.xlate_src_addr_ipv6": { - "path_match": "netflow.xlate_src_addr_ipv6", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.xlate_src_port": { - "path_match": "netflow.xlate_src_port", - "mapping": { - "type": "long" - } - } - }, + { + "netflow.absoluteError": { + "path_match": "netflow.absoluteError", + "mapping": { + "type": "double" + } + } + }, + { + "netflow.anonymizationFlags": { + "path_match": "netflow.anonymizationFlags", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.anonymizationTechnique": { + "path_match": "netflow.anonymizationTechnique", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.app_id": { + "path_match": "netflow.app_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.application_description": { + "path_match": "netflow.application_description", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.application_id": { + "path_match": "netflow.application_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.application_name": { + "path_match": "netflow.application_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.applicationCategoryName": { + "path_match": "netflow.applicationCategoryName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.applicationGroupName": { + "path_match": "netflow.applicationGroupName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.applicationSubCategoryName": { + "path_match": "netflow.applicationSubCategoryName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.bgp_ipv4_next_hop": { + "path_match": "netflow.bgp_ipv4_next_hop", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.bgp_ipv6_next_hop": { + "path_match": "netflow.bgp_ipv6_next_hop", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.bgpNextAdjacentAsNumber": { + "path_match": "netflow.bgpNextAdjacentAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.bgpPrevAdjacentAsNumber": { + "path_match": "netflow.bgpPrevAdjacentAsNumber", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.bgpValidityState": { + "path_match": "netflow.bgpValidityState", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.biflowDirection": { + "path_match": "netflow.biflowDirection", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.collectorCertificate": { + "path_match": "netflow.collectorCertificate", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.collectorIPv4Address": { + "path_match": "netflow.collectorIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.collectorIPv6Address": { + "path_match": "netflow.collectorIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.collectionTimeMilliseconds": { + "path_match": "netflow.collectionTimeMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.collectorTransportPort": { + "path_match": "netflow.collectorTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.commonPropertiesId": { + "path_match": "netflow.commonPropertiesId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.confidenceLevel": { + "path_match": "netflow.confidenceLevel", + "mapping": { + "type": "double" + } + } + }, + { + "netflow.conn_id": { + "path_match": "netflow.conn_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.connectionSumDurationSeconds": { + "path_match": "netflow.connectionSumDurationSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.connectionTransactionId": { + "path_match": "netflow.connectionTransactionId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dataLinkFrameSection": { + "path_match": "netflow.dataLinkFrameSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.dataLinkFrameSize": { + "path_match": "netflow.dataLinkFrameSize", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dataLinkFrameType": { + "path_match": "netflow.dataLinkFrameType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dataRecordsReliability": { + "path_match": "netflow.dataRecordsReliability", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.destinationIPv6Prefix": { + "path_match": "netflow.destinationIPv6Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.digestHashValue": { + "path_match": "netflow.digestHashValue", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.direction": { + "path_match": "netflow.direction", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.distinctCountOfDestinationIPAddress": { + "path_match": "netflow.distinctCountOfDestinationIPAddress", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.distinctCountOfDestinationIPv4Address": { + "path_match": "netflow.distinctCountOfDestinationIPv4Address", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.distinctCountOfDestinationIPv6Address": { + "path_match": "netflow.distinctCountOfDestinationIPv6Address", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.distinctCountOfSourceIPAddress": { + "path_match": "netflow.distinctCountOfSourceIPAddress", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.distinctCountOfSourceIPv4Address": { + "path_match": "netflow.distinctCountOfSourceIPv4Address", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.distinctCountOfSourceIPv6Address": { + "path_match": "netflow.distinctCountOfSourceIPv6Address", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dot1qCustomerDEI": { + "path_match": "netflow.dot1qCustomerDEI", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dot1qCustomerDestinationMacAddress": { + "path_match": "netflow.dot1qCustomerDestinationMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.dot1qCustomerPriority": { + "path_match": "netflow.dot1qCustomerPriority", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dot1qCustomerSourceMacAddress": { + "path_match": "netflow.dot1qCustomerSourceMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.dot1qCustomerVlanId": { + "path_match": "netflow.dot1qCustomerVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dot1qDEI": { + "path_match": "netflow.dot1qDEI", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dot1qPriority": { + "path_match": "netflow.dot1qPriority", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dot1qServiceInstanceId": { + "path_match": "netflow.dot1qServiceInstanceId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dot1qServiceInstancePriority": { + "path_match": "netflow.dot1qServiceInstancePriority", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dot1qServiceInstanceTag": { + "path_match": "netflow.dot1qServiceInstanceTag", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.dot1qVlanId": { + "path_match": "netflow.dot1qVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.droppedLayer2OctetDeltaCount": { + "path_match": "netflow.droppedLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.droppedLayer2OctetTotalCount": { + "path_match": "netflow.droppedLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.droppedOctetDeltaCount": { + "path_match": "netflow.droppedOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.droppedOctetTotalCount": { + "path_match": "netflow.droppedOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.droppedPacketDeltaCount": { + "path_match": "netflow.droppedPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.droppedPacketTotalCount": { + "path_match": "netflow.droppedPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dst_as": { + "path_match": "netflow.dst_as", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dst_mask": { + "path_match": "netflow.dst_mask", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dst_tos": { + "path_match": "netflow.dst_tos", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.dst_vlan": { + "path_match": "netflow.dst_vlan", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.egressBroadcastPacketTotalCount": { + "path_match": "netflow.egressBroadcastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.egressInterfaceType": { + "path_match": "netflow.egressInterfaceType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.egressPhysicalInterface": { + "path_match": "netflow.egressPhysicalInterface", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.egressUnicastPacketTotalCount": { + "path_match": "netflow.egressUnicastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.egressVRFID": { + "path_match": "netflow.egressVRFID", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.encryptedTechnology": { + "path_match": "netflow.encryptedTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.engine_id": { + "path_match": "netflow.engine_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.engine_type": { + "path_match": "netflow.engine_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ethernetHeaderLength": { + "path_match": "netflow.ethernetHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ethernetPayloadLength": { + "path_match": "netflow.ethernetPayloadLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ethernetTotalLength": { + "path_match": "netflow.ethernetTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ethernetType": { + "path_match": "netflow.ethernetType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.event_time_msec": { + "path_match": "netflow.event_time_msec", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.exporterCertificate": { + "path_match": "netflow.exporterCertificate", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.exporterIPv4Address": { + "path_match": "netflow.exporterIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.exporterIPv6Address": { + "path_match": "netflow.exporterIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.exporterTransportPort": { + "path_match": "netflow.exporterTransportPort", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.exportingProcessId": { + "path_match": "netflow.exportingProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.exportInterface": { + "path_match": "netflow.exportInterface", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.exportProtocolVersion": { + "path_match": "netflow.exportProtocolVersion", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.exportSctpStreamId": { + "path_match": "netflow.exportSctpStreamId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.exportTransportProtocol": { + "path_match": "netflow.exportTransportProtocol", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.first_switched": { + "path_match": "netflow.first_switched", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.flow_active_timeout": { + "path_match": "netflow.flow_active_timeout", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_end_msec": { + "path_match": "netflow.flow_end_msec", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_end_reason": { + "path_match": "netflow.flow_end_reason", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_inactive_timeout": { + "path_match": "netflow.flow_inactive_timeout", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_records": { + "path_match": "netflow.flow_records", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_sampler_id": { + "path_match": "netflow.flow_sampler_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_sampler_mode": { + "path_match": "netflow.flow_sampler_mode", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_sampler_random_interval": { + "path_match": "netflow.flow_sampler_random_interval", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_seq_num": { + "path_match": "netflow.flow_seq_num", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flow_start_msec": { + "path_match": "netflow.flow_start_msec", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowDurationMicroseconds": { + "path_match": "netflow.flowDurationMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowDurationMilliseconds": { + "path_match": "netflow.flowDurationMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowEndDeltaMicroseconds": { + "path_match": "netflow.flowEndDeltaMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowEndMicroseconds": { + "path_match": "netflow.flowEndMicroseconds", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.flowEndNanoseconds": { + "path_match": "netflow.flowEndNanoseconds", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.flowEndSeconds": { + "path_match": "netflow.flowEndSeconds", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.flowKeyIndicator": { + "path_match": "netflow.flowKeyIndicator", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flows": { + "path_match": "netflow.flows", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowSamplingTimeInterval": { + "path_match": "netflow.flowSamplingTimeInterval", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowSamplingTimeSpacing": { + "path_match": "netflow.flowSamplingTimeSpacing", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowSelectedFlowDeltaCount": { + "path_match": "netflow.flowSelectedFlowDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowSelectedOctetDeltaCount": { + "path_match": "netflow.flowSelectedOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowSelectedPacketDeltaCount": { + "path_match": "netflow.flowSelectedPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowSelectorAlgorithm": { + "path_match": "netflow.flowSelectorAlgorithm", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowset_id": { + "path_match": "netflow.flowset_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowStartDeltaMicroseconds": { + "path_match": "netflow.flowStartDeltaMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.flowStartMicroseconds": { + "path_match": "netflow.flowStartMicroseconds", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.flowStartNanoseconds": { + "path_match": "netflow.flowStartNanoseconds", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.flowStartSeconds": { + "path_match": "netflow.flowStartSeconds", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.forwarding_status.reason": { + "path_match": "netflow.forwarding_status.reason", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.forwarding_status.status": { + "path_match": "netflow.forwarding_status.status", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.fragmentFlags": { + "path_match": "netflow.fragmentFlags", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.fw_event": { + "path_match": "netflow.fw_event", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.fw_ext_event": { + "path_match": "netflow.fw_ext_event", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.fwd_flow_delta_bytes": { + "path_match": "netflow.fwd_flow_delta_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.greKey": { + "path_match": "netflow.greKey", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashDigestOutput": { + "path_match": "netflow.hashDigestOutput", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashFlowDomain": { + "path_match": "netflow.hashFlowDomain", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashInitialiserValue": { + "path_match": "netflow.hashInitialiserValue", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashIPPayloadOffset": { + "path_match": "netflow.hashIPPayloadOffset", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashIPPayloadSize": { + "path_match": "netflow.hashIPPayloadSize", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashOutputRangeMax": { + "path_match": "netflow.hashOutputRangeMax", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashOutputRangeMin": { + "path_match": "netflow.hashOutputRangeMin", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashSelectedRangeMax": { + "path_match": "netflow.hashSelectedRangeMax", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.hashSelectedRangeMin": { + "path_match": "netflow.hashSelectedRangeMin", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.icmp_code_ipv4": { + "path_match": "netflow.icmp_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.icmp_code_ipv6": { + "path_match": "netflow.icmp_code_ipv6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.icmp_type": { + "path_match": "netflow.icmp_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.icmp_type_ipv4": { + "path_match": "netflow.icmp_type_ipv4", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.icmp_type_ipv6": { + "path_match": "netflow.icmp_type_ipv6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.icmpTypeCodeIPv6": { + "path_match": "netflow.icmpTypeCodeIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.if_desc": { + "path_match": "netflow.if_desc", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.if_name": { + "path_match": "netflow.if_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ignoredDataRecordTotalCount": { + "path_match": "netflow.ignoredDataRecordTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ignoredLayer2FrameTotalCount": { + "path_match": "netflow.ignoredLayer2FrameTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ignoredLayer2OctetTotalCount": { + "path_match": "netflow.ignoredLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ignoredOctetTotalCount": { + "path_match": "netflow.ignoredOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ignoredPacketTotalCount": { + "path_match": "netflow.ignoredPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.in_bytes": { + "path_match": "netflow.in_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.in_dst_mac": { + "path_match": "netflow.in_dst_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.in_permanent_bytes": { + "path_match": "netflow.in_permanent_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.in_permanent_pkts": { + "path_match": "netflow.in_permanent_pkts", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.in_pkts": { + "path_match": "netflow.in_pkts", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.in_src_mac": { + "path_match": "netflow.in_src_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.informationElementDataType": { + "path_match": "netflow.informationElementDataType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.informationElementDescription": { + "path_match": "netflow.informationElementDescription", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.informationElementId": { + "path_match": "netflow.informationElementId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.informationElementIndex": { + "path_match": "netflow.informationElementIndex", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.informationElementName": { + "path_match": "netflow.informationElementName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.informationElementRangeBegin": { + "path_match": "netflow.informationElementRangeBegin", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.informationElementRangeEnd": { + "path_match": "netflow.informationElementRangeEnd", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.informationElementSemantics": { + "path_match": "netflow.informationElementSemantics", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.informationElementUnits": { + "path_match": "netflow.informationElementUnits", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ingressBroadcastPacketTotalCount": { + "path_match": "netflow.ingressBroadcastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ingressInterfaceType": { + "path_match": "netflow.ingressInterfaceType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ingressMulticastPacketTotalCount": { + "path_match": "netflow.ingressMulticastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ingressPhysicalInterface": { + "path_match": "netflow.ingressPhysicalInterface", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ingressUnicastPacketTotalCount": { + "path_match": "netflow.ingressUnicastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ingressVRFID": { + "path_match": "netflow.ingressVRFID", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.initiatorPackets": { + "path_match": "netflow.initiatorPackets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.input_snmp": { + "path_match": "netflow.input_snmp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.intermediateProcessId": { + "path_match": "netflow.intermediateProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ip_dscp": { + "path_match": "netflow.ip_dscp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ip_protocol_version": { + "path_match": "netflow.ip_protocol_version", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ip_tos": { + "path_match": "netflow.ip_tos", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipHeaderLength": { + "path_match": "netflow.ipHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipHeaderPacketSection": { + "path_match": "netflow.ipHeaderPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ipPayloadLength": { + "path_match": "netflow.ipPayloadLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipPayloadPacketSection": { + "path_match": "netflow.ipPayloadPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ipPrecedence": { + "path_match": "netflow.ipPrecedence", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.IPSecSPI": { + "path_match": "netflow.IPSecSPI", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipTotalLength": { + "path_match": "netflow.ipTotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipTTL": { + "path_match": "netflow.ipTTL", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipv4_dst_addr": { + "path_match": "netflow.ipv4_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ipv4_dst_prefix": { + "path_match": "netflow.ipv4_dst_prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ipv4_ident": { + "path_match": "netflow.ipv4_ident", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipv4_next_hop": { + "path_match": "netflow.ipv4_next_hop", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ipv4_src_addr": { + "path_match": "netflow.ipv4_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ipv4_src_prefix": { + "path_match": "netflow.ipv4_src_prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ipv4IHL": { + "path_match": "netflow.ipv4IHL", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipv4Options": { + "path_match": "netflow.ipv4Options", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipv6_dst_addr": { + "path_match": "netflow.ipv6_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ipv6_dst_mask": { + "path_match": "netflow.ipv6_dst_mask", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipv6_flow_label": { + "path_match": "netflow.ipv6_flow_label", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipv6_next_hop": { + "path_match": "netflow.ipv6_next_hop", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ipv6_option_headers": { + "path_match": "netflow.ipv6_option_headers", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ipv6_src_addr": { + "path_match": "netflow.ipv6_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ipv6_src_mask": { + "path_match": "netflow.ipv6_src_mask", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.isMulticast": { + "path_match": "netflow.isMulticast", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.l4_dst_port": { + "path_match": "netflow.l4_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.l4_src_port": { + "path_match": "netflow.l4_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.last_switched": { + "path_match": "netflow.last_switched", + "mapping": { + "type": "date" + } + } + }, + { + "netflow.layer2FrameDeltaCount": { + "path_match": "netflow.layer2FrameDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.layer2FrameTotalCount": { + "path_match": "netflow.layer2FrameTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.layer2OctetDeltaCount": { + "path_match": "netflow.layer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.layer2OctetDeltaSumOfSquares": { + "path_match": "netflow.layer2OctetDeltaSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.layer2OctetTotalCount": { + "path_match": "netflow.layer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.layer2OctetTotalSumOfSquares": { + "path_match": "netflow.layer2OctetTotalSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.layer2SegmentId": { + "path_match": "netflow.layer2SegmentId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.lineCardId": { + "path_match": "netflow.lineCardId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.lowerCILimit": { + "path_match": "netflow.lowerCILimit", + "mapping": { + "type": "double" + } + } + }, + { + "netflow.max_pkt_length": { + "path_match": "netflow.max_pkt_length", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.max_ttl": { + "path_match": "netflow.max_ttl", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.maxExportSeconds": { + "path_match": "netflow.maxExportSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.maxFlowEndMicroseconds": { + "path_match": "netflow.maxFlowEndMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.maxFlowEndMilliseconds": { + "path_match": "netflow.maxFlowEndMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.maxFlowEndNanoseconds": { + "path_match": "netflow.maxFlowEndNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.maxFlowEndSeconds": { + "path_match": "netflow.maxFlowEndSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.maximumLayer2TotalLength": { + "path_match": "netflow.maximumLayer2TotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.messageMD5Checksum": { + "path_match": "netflow.messageMD5Checksum", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.messageScope": { + "path_match": "netflow.messageScope", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.meteringProcessId": { + "path_match": "netflow.meteringProcessId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.metroEvcId": { + "path_match": "netflow.metroEvcId", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.metroEvcType": { + "path_match": "netflow.metroEvcType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.min_pkt_length": { + "path_match": "netflow.min_pkt_length", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.min_ttl": { + "path_match": "netflow.min_ttl", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.minExportSeconds": { + "path_match": "netflow.minExportSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.minFlowStartMicroseconds": { + "path_match": "netflow.minFlowStartMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.minFlowStartMilliseconds": { + "path_match": "netflow.minFlowStartMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.minFlowStartNanoseconds": { + "path_match": "netflow.minFlowStartNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.minFlowStartSeconds": { + "path_match": "netflow.minFlowStartSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.minimumLayer2TotalLength": { + "path_match": "netflow.minimumLayer2TotalLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.monitoringIntervalEndMilliSeconds": { + "path_match": "netflow.monitoringIntervalEndMilliSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.monitoringIntervalStartMilliSeconds": { + "path_match": "netflow.monitoringIntervalStartMilliSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mpls_label_stack_octets.bottom_of_stack": { + "path_match": "netflow.mpls_label_stack_octets.bottom_of_stack", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mpls_label_stack_octets.experimental": { + "path_match": "netflow.mpls_label_stack_octets.experimental", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mpls_label_stack_octets.label": { + "path_match": "netflow.mpls_label_stack_octets.label", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mpls_label_stack_octets.ttl": { + "path_match": "netflow.mpls_label_stack_octets.ttl", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mpls_top_label_ip": { + "path_match": "netflow.mpls_top_label_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.mpls_top_label_type": { + "path_match": "netflow.mpls_top_label_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mplsLabelStackDepth": { + "path_match": "netflow.mplsLabelStackDepth", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mplsLabelStackSection": { + "path_match": "netflow.mplsLabelStackSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.mplsPayloadPacketSection": { + "path_match": "netflow.mplsPayloadPacketSection", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.mplsTopLabelExp": { + "path_match": "netflow.mplsTopLabelExp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mplsTopLabelIPv6Address": { + "path_match": "netflow.mplsTopLabelIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.mplsTopLabelTTL": { + "path_match": "netflow.mplsTopLabelTTL", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mul_dst_bytes": { + "path_match": "netflow.mul_dst_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mul_dst_pkts": { + "path_match": "netflow.mul_dst_pkts", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.mul_igmp_type": { + "path_match": "netflow.mul_igmp_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.natEvent": { + "path_match": "netflow.natEvent", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.natOriginatingAddressRealm": { + "path_match": "netflow.natOriginatingAddressRealm", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.natPoolId": { + "path_match": "netflow.natPoolId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.natPoolName": { + "path_match": "netflow.natPoolName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.natType": { + "path_match": "netflow.natType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.newConnectionDeltaCount": { + "path_match": "netflow.newConnectionDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.nextHeaderIPv6": { + "path_match": "netflow.nextHeaderIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.notSentFlowTotalCount": { + "path_match": "netflow.notSentFlowTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.notSentLayer2OctetTotalCount": { + "path_match": "netflow.notSentLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.notSentOctetTotalCount": { + "path_match": "netflow.notSentOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.notSentPacketTotalCount": { + "path_match": "netflow.notSentPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.nprobe_proto": { + "path_match": "netflow.nprobe_proto", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.nprobe_proto_name": { + "path_match": "netflow.nprobe_proto_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.observationDomainId": { + "path_match": "netflow.observationDomainId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.observationDomainName": { + "path_match": "netflow.observationDomainName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.observationPointId": { + "path_match": "netflow.observationPointId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.observationPointType": { + "path_match": "netflow.observationPointType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.observationTimeMicroseconds": { + "path_match": "netflow.observationTimeMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.observationTimeNanoseconds": { + "path_match": "netflow.observationTimeNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.observationTimeSeconds": { + "path_match": "netflow.observationTimeSeconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.observedFlowTotalCount": { + "path_match": "netflow.observedFlowTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.octetDeltaSumOfSquares": { + "path_match": "netflow.octetDeltaSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.octetTotalSumOfSquares": { + "path_match": "netflow.octetTotalSumOfSquares", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.opaqueOctets": { + "path_match": "netflow.opaqueOctets", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.originalExporterIPv4Address": { + "path_match": "netflow.originalExporterIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.originalExporterIPv6Address": { + "path_match": "netflow.originalExporterIPv6Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.originalFlowsCompleted": { + "path_match": "netflow.originalFlowsCompleted", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.originalFlowsInitiated": { + "path_match": "netflow.originalFlowsInitiated", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.originalFlowsPresent": { + "path_match": "netflow.originalFlowsPresent", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.originalObservationDomainId": { + "path_match": "netflow.originalObservationDomainId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.out_bytes": { + "path_match": "netflow.out_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.out_dst_mac": { + "path_match": "netflow.out_dst_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.out_pkts": { + "path_match": "netflow.out_pkts", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.out_src_mac": { + "path_match": "netflow.out_src_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.output_snmp": { + "path_match": "netflow.output_snmp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.p2pTechnology": { + "path_match": "netflow.p2pTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.payloadLengthIPv6": { + "path_match": "netflow.payloadLengthIPv6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.portId": { + "path_match": "netflow.portId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.portRangeNumPorts": { + "path_match": "netflow.portRangeNumPorts", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.portRangeStepSize": { + "path_match": "netflow.portRangeStepSize", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postDot1qCustomerVlanId": { + "path_match": "netflow.postDot1qCustomerVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postDot1qVlanId": { + "path_match": "netflow.postDot1qVlanId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postIpDiffServCodePoint": { + "path_match": "netflow.postIpDiffServCodePoint", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postIpPrecedence": { + "path_match": "netflow.postIpPrecedence", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postLayer2OctetDeltaCount": { + "path_match": "netflow.postLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postLayer2OctetTotalCount": { + "path_match": "netflow.postLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postMCastLayer2OctetDeltaCount": { + "path_match": "netflow.postMCastLayer2OctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postMCastLayer2OctetTotalCount": { + "path_match": "netflow.postMCastLayer2OctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postMCastPacketTotalCount": { + "path_match": "netflow.postMCastPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postMCastOctetTotalCount": { + "path_match": "netflow.postMCastOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postMplsTopLabelExp": { + "path_match": "netflow.postMplsTopLabelExp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postNATPortBlockEnd": { + "path_match": "netflow.postNATPortBlockEnd", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postNATPortBlockStart": { + "path_match": "netflow.postNATPortBlockStart", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postOctetTotalCount": { + "path_match": "netflow.postOctetTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.postPacketTotalCount": { + "path_match": "netflow.postPacketTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.privateEnterpriseNumber": { + "path_match": "netflow.privateEnterpriseNumber", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.protocol": { + "path_match": "netflow.protocol", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.pseudoWireControlWord": { + "path_match": "netflow.pseudoWireControlWord", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.pseudoWireDestinationIPv4Address": { + "path_match": "netflow.pseudoWireDestinationIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.pseudoWireId": { + "path_match": "netflow.pseudoWireId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.pseudoWireType": { + "path_match": "netflow.pseudoWireType", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.relativeError": { + "path_match": "netflow.relativeError", + "mapping": { + "type": "double" + } + } + }, + { + "netflow.responderPackets": { + "path_match": "netflow.responderPackets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.rev_flow_delta_bytes": { + "path_match": "netflow.rev_flow_delta_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.rfc3550JitterMicroseconds": { + "path_match": "netflow.rfc3550JitterMicroseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.rfc3550JitterMilliseconds": { + "path_match": "netflow.rfc3550JitterMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.rfc3550JitterNanoseconds": { + "path_match": "netflow.rfc3550JitterNanoseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.rtpSequenceNumber": { + "path_match": "netflow.rtpSequenceNumber", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.sampler_name": { + "path_match": "netflow.sampler_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.sampling_algorithm": { + "path_match": "netflow.sampling_algorithm", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.sampling_interval": { + "path_match": "netflow.sampling_interval", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.samplingFlowInterval": { + "path_match": "netflow.samplingFlowInterval", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.samplingFlowSpacing": { + "path_match": "netflow.samplingFlowSpacing", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.samplingPacketInterval": { + "path_match": "netflow.samplingPacketInterval", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.samplingPacketSpace": { + "path_match": "netflow.samplingPacketSpace", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.samplingPopulation": { + "path_match": "netflow.samplingPopulation", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.samplingProbability": { + "path_match": "netflow.samplingProbability", + "mapping": { + "type": "double" + } + } + }, + { + "netflow.samplingSize": { + "path_match": "netflow.samplingSize", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.samplingTimeInterval": { + "path_match": "netflow.samplingTimeInterval", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.samplingTimeSpace": { + "path_match": "netflow.samplingTimeSpace", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.scope_system": { + "path_match": "netflow.scope_system", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.sectionExportedOctets": { + "path_match": "netflow.sectionExportedOctets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.sectionOffset": { + "path_match": "netflow.sectionOffset", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.selectionSequenceId": { + "path_match": "netflow.selectionSequenceId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.selectorAlgorithm": { + "path_match": "netflow.selectorAlgorithm", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.selectorId": { + "path_match": "netflow.selectorId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.selectorIDTotalFlowsObserved": { + "path_match": "netflow.selectorIDTotalFlowsObserved", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.selectorIDTotalFlowsSelected": { + "path_match": "netflow.selectorIDTotalFlowsSelected", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.selectorIdTotalPktsObserved": { + "path_match": "netflow.selectorIdTotalPktsObserved", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.selectorIdTotalPktsSelected": { + "path_match": "netflow.selectorIdTotalPktsSelected", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.selectorName": { + "path_match": "netflow.selectorName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.sessionScope": { + "path_match": "netflow.sessionScope", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.sourceIPv6Prefix": { + "path_match": "netflow.sourceIPv6Prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.src_as": { + "path_match": "netflow.src_as", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.src_mask": { + "path_match": "netflow.src_mask", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.src_tos": { + "path_match": "netflow.src_tos", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.src_vlan": { + "path_match": "netflow.src_vlan", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.staIPv4Address": { + "path_match": "netflow.staIPv4Address", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.staMacAddress": { + "path_match": "netflow.staMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.systemInitTimeMilliseconds": { + "path_match": "netflow.systemInitTimeMilliseconds", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcp_dst_port": { + "path_match": "netflow.tcp_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcp_flags": { + "path_match": "netflow.tcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcp_src_port": { + "path_match": "netflow.tcp_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpAcknowledgementNumber": { + "path_match": "netflow.tcpAcknowledgementNumber", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpAckTotalCount": { + "path_match": "netflow.tcpAckTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpDestinationPort": { + "path_match": "netflow.tcpDestinationPort", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpFinTotalCount": { + "path_match": "netflow.tcpFinTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpHeaderLength": { + "path_match": "netflow.tcpHeaderLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpOptions": { + "path_match": "netflow.tcpOptions", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpPshTotalCount": { + "path_match": "netflow.tcpPshTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpRstTotalCount": { + "path_match": "netflow.tcpRstTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpSequenceNumber": { + "path_match": "netflow.tcpSequenceNumber", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpSynTotalCount": { + "path_match": "netflow.tcpSynTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpUrgentPointer": { + "path_match": "netflow.tcpUrgentPointer", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpUrgTotalCount": { + "path_match": "netflow.tcpUrgTotalCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpWindowScale": { + "path_match": "netflow.tcpWindowScale", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tcpWindowSize": { + "path_match": "netflow.tcpWindowSize", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.templateId": { + "path_match": "netflow.templateId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.total_bytes_exp": { + "path_match": "netflow.total_bytes_exp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.total_flows_exp": { + "path_match": "netflow.total_flows_exp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.total_pkts_exp": { + "path_match": "netflow.total_pkts_exp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.totalLengthIPv4": { + "path_match": "netflow.totalLengthIPv4", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.transportOctetDeltaCount": { + "path_match": "netflow.transportOctetDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.transportPacketDeltaCount": { + "path_match": "netflow.transportPacketDeltaCount", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.tunnelTechnology": { + "path_match": "netflow.tunnelTechnology", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.udp_dst_port": { + "path_match": "netflow.udp_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.udp_src_port": { + "path_match": "netflow.udp_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.udpMessageLength": { + "path_match": "netflow.udpMessageLength", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.upperCILimit": { + "path_match": "netflow.upperCILimit", + "mapping": { + "type": "double" + } + } + }, + { + "netflow.user_id": { + "path_match": "netflow.user_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.username": { + "path_match": "netflow.username", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.userName": { + "path_match": "netflow.userName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.valueDistributionMethod": { + "path_match": "netflow.valueDistributionMethod", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.virtualStationInterfaceId": { + "path_match": "netflow.virtualStationInterfaceId", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.virtualStationInterfaceName": { + "path_match": "netflow.virtualStationInterfaceName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.virtualStationName": { + "path_match": "netflow.virtualStationName", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.virtualStationUUID": { + "path_match": "netflow.virtualStationUUID", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.VRFname": { + "path_match": "netflow.VRFname", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.wlan_id": { + "path_match": "netflow.wlan_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.wlanChannelId": { + "path_match": "netflow.wlanChannelId", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.wlanSSID": { + "path_match": "netflow.wlanSSID", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.wtpMacAddress": { + "path_match": "netflow.wtpMacAddress", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.xlate_dst_addr_ipv4": { + "path_match": "netflow.xlate_dst_addr_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.xlate_dst_addr_ipv6": { + "path_match": "netflow.xlate_dst_addr_ipv6", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.xlate_dst_port": { + "path_match": "netflow.xlate_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.xlate_src_addr_ipv4": { + "path_match": "netflow.xlate_src_addr_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.xlate_src_addr_ipv6": { + "path_match": "netflow.xlate_src_addr_ipv6", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.xlate_src_port": { + "path_match": "netflow.xlate_src_port", + "mapping": { + "type": "long" + } + } + }, - { - "netflow.cisco_avc_p2p_tech": { - "path_match": "netflow.cisco_avc_p2p_tech", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_tunnel_tech": { - "path_match": "netflow.cisco_avc_tunnel_tech", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_encrypt_tech": { - "path_match": "netflow.cisco_avc_encrypt_tech", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_ipt_dialing_phone": { - "path_match": "netflow.cisco_ipt_dialing_phone", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_ipt_dialing_user": { - "path_match": "netflow.cisco_ipt_dialing_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_ipt_dialed_phone": { - "path_match": "netflow.cisco_ipt_dialed_phone", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_ipt_dialed_user": { - "path_match": "netflow.cisco_ipt_dialed_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_ipt_call_duration": { - "path_match": "netflow.cisco_ipt_call_duration", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_ipt_call_end_reason": { - "path_match": "netflow.cisco_ipt_call_end_reason", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_ipt_calls_dialed": { - "path_match": "netflow.cisco_ipt_calls_dialed", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_ipt_calls_connected": { - "path_match": "netflow.cisco_ipt_calls_connected", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_ipt_calls_failed": { - "path_match": "netflow.cisco_ipt_calls_failed", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_nexus_fastpath_src_addr": { - "path_match": "netflow.cisco_nexus_fastpath_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_nexus_fastpath_src_port": { - "path_match": "netflow.cisco_nexus_fastpath_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_nexus_fastpath_dst_addr": { - "path_match": "netflow.cisco_nexus_fastpath_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_nexus_fastpath_dst_port": { - "path_match": "netflow.cisco_nexus_fastpath_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_endpoint_process_user": { - "path_match": "netflow.cisco_endpoint_process_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_endpoint_process_name": { - "path_match": "netflow.cisco_endpoint_process_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_endpoint_process_hash": { - "path_match": "netflow.cisco_endpoint_process_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_endpoint_process_parent_user": { - "path_match": "netflow.cisco_endpoint_process_parent_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_endpoint_process_parent_name": { - "path_match": "netflow.cisco_endpoint_process_parent_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_endpoint_process_parent_hash": { - "path_match": "netflow.cisco_endpoint_process_parent_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_pfr_policy_id": { - "path_match": "netflow.cisco_pfr_policy_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_map_name": { - "path_match": "netflow.cisco_pfr_map_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_pfr_reason": { - "path_match": "netflow.cisco_pfr_reason", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_fw_ingress_acl_id": { - "path_match": "netflow.cisco_fw_ingress_acl_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_fw_egress_acl_id": { - "path_match": "netflow.cisco_fw_egress_acl_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_fw_ext_event": { - "path_match": "netflow.cisco_fw_ext_event", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_fw_event_level": { - "path_match": "netflow.cisco_fw_event_level", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_event_level_id": { - "path_match": "netflow.cisco_fw_event_level_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_config_value": { - "path_match": "netflow.cisco_fw_config_value", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_erm_code": { - "path_match": "netflow.cisco_fw_erm_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_erm_descr": { - "path_match": "netflow.cisco_fw_erm_descr", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_trustsec_src_id": { - "path_match": "netflow.cisco_trustsec_src_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_trustsec_dst_id": { - "path_match": "netflow.cisco_trustsec_dst_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_trustsec_src_name": { - "path_match": "netflow.cisco_trustsec_src_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_trustsec_dst_name": { - "path_match": "netflow.cisco_trustsec_dst_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_trustsec_switch_derived_sgt": { - "path_match": "netflow.cisco_trustsec_switch_derived_sgt", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_fw_blackout_secs": { - "path_match": "netflow.cisco_fw_blackout_secs", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_half_open_sessions_rate_1min_max": { - "path_match": "netflow.cisco_fw_half_open_sessions_rate_1min_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_half_open_sessions_rate_1min": { - "path_match": "netflow.cisco_fw_half_open_sessions_rate_1min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_zonepair_id": { - "path_match": "netflow.cisco_fw_zonepair_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_sessions_max": { - "path_match": "netflow.cisco_fw_sessions_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_zonepair": { - "path_match": "netflow.cisco_fw_zonepair", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_fw_ext_event_descr": { - "path_match": "netflow.cisco_fw_ext_event_descr", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_fw_drop_pass_summary_packets": { - "path_match": "netflow.cisco_fw_drop_pass_summary_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_half_open_sessions": { - "path_match": "netflow.cisco_fw_half_open_sessions", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_dre_input": { - "path_match": "netflow.cisco_waas_dre_input", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_dre_output": { - "path_match": "netflow.cisco_waas_dre_output", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_lz_input": { - "path_match": "netflow.cisco_waas_lz_input", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_lz_output": { - "path_match": "netflow.cisco_waas_lz_output", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_conn_mode": { - "path_match": "netflow.cisco_waas_conn_mode", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_input_bytes": { - "path_match": "netflow.cisco_waas_input_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_output_bytes": { - "path_match": "netflow.cisco_waas_output_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_short_term_packets_drop": { - "path_match": "netflow.cisco_avc_transport_short_term_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_long_term_packets_drop": { - "path_match": "netflow.cisco_avc_transport_long_term_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_media_bytes": { - "path_match": "netflow.cisco_avc_app_media_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_media_byte_rate": { - "path_match": "netflow.cisco_avc_app_media_byte_rate", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_media_packets": { - "path_match": "netflow.cisco_avc_app_media_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_media_packet_rate": { - "path_match": "netflow.cisco_avc_app_media_packet_rate", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_media_packet_rate_variation": { - "path_match": "netflow.cisco_avc_app_media_packet_rate_variation", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_media_event": { - "path_match": "netflow.cisco_avc_app_media_event", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_monitor_event": { - "path_match": "netflow.cisco_avc_app_monitor_event", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_packets_expected": { - "path_match": "netflow.cisco_avc_transport_packets_expected", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtt": { - "path_match": "netflow.cisco_avc_transport_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_packet_sets_lost": { - "path_match": "netflow.cisco_avc_transport_packet_sets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_short_term_packets_lost": { - "path_match": "netflow.cisco_avc_transport_short_term_packets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_long_term_packets_lost": { - "path_match": "netflow.cisco_avc_transport_long_term_packets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_packet_loss_rate": { - "path_match": "netflow.cisco_avc_transport_packet_loss_rate", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtp_ssrc": { - "path_match": "netflow.cisco_avc_transport_rtp_ssrc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtp_jitter_mean": { - "path_match": "netflow.cisco_avc_transport_rtp_jitter_mean", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtp_jitter_min": { - "path_match": "netflow.cisco_avc_transport_rtp_jitter_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtp_jitter_max": { - "path_match": "netflow.cisco_avc_transport_rtp_jitter_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_controlled_tc": { - "path_match": "netflow.cisco_avc_controlled_tc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_in_policy_tc": { - "path_match": "netflow.cisco_avc_in_policy_tc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_media_packet_rate_variation_min": { - "path_match": "netflow.cisco_avc_app_media_packet_rate_variation_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_media_packet_rate_variation_max": { - "path_match": "netflow.cisco_avc_app_media_packet_rate_variation_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtp_flows": { - "path_match": "netflow.cisco_avc_transport_rtp_flows", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtp_payload_type": { - "path_match": "netflow.cisco_avc_transport_rtp_payload_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_packet_loss_rate_min": { - "path_match": "netflow.cisco_avc_transport_packet_loss_rate_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_packet_loss_rate_max": { - "path_match": "netflow.cisco_avc_transport_packet_loss_rate_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtt_sum": { - "path_match": "netflow.cisco_avc_transport_rtt_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtt_min": { - "path_match": "netflow.cisco_avc_transport_rtt_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transport_rtt_max": { - "path_match": "netflow.cisco_avc_transport_rtt_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_metadata_global_session_id": { - "path_match": "netflow.cisco_avc_metadata_global_session_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_metadata_multi_party_session_id": { - "path_match": "netflow.cisco_avc_metadata_multi_party_session_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_metadata_clock_rate": { - "path_match": "netflow.cisco_avc_metadata_clock_rate", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_network_delay_avg": { - "path_match": "netflow.cisco_avc_network_delay_avg", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_one_way_delay": { - "path_match": "netflow.cisco_avc_one_way_delay", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_tcp_window_size_min": { - "path_match": "netflow.cisco_avc_tcp_window_size_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_tcp_window_size_max": { - "path_match": "netflow.cisco_avc_tcp_window_size_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_tcp_max_segment_size": { - "path_match": "netflow.cisco_avc_tcp_max_segment_size", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_tcp_window_size_sum": { - "path_match": "netflow.cisco_avc_tcp_window_size_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_rtp_jitter_interarrival_avg": { - "path_match": "netflow.cisco_avc_rtp_jitter_interarrival_avg", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_src_site_id": { - "path_match": "netflow.cisco_pfr_src_site_id", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_pfr_dst_site_id": { - "path_match": "netflow.cisco_pfr_dst_site_id", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_avc_transport_byte_loss_rate": { - "path_match": "netflow.cisco_avc_transport_byte_loss_rate", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_event_tc_nomitigation_err_bw_count": { - "path_match": "netflow.cisco_pfr_event_tc_nomitigation_err_bw_count", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_event_tc_nomitigation_err_perf_count": { - "path_match": "netflow.cisco_pfr_event_tc_nomitigation_err_perf_count", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_dst_site_prefix": { - "path_match": "netflow.cisco_pfr_dst_site_prefix", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_pfr_dst_site_prefix_mask": { - "path_match": "netflow.cisco_pfr_dst_site_prefix_mask", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_label_id": { - "path_match": "netflow.cisco_pfr_label_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_br_addr": { - "path_match": "netflow.cisco_pfr_br_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_pfr_state": { - "path_match": "netflow.cisco_pfr_state", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_reason_id": { - "path_match": "netflow.cisco_pfr_reason_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_threshold": { - "path_match": "netflow.cisco_pfr_threshold", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_pfr_priority": { - "path_match": "netflow.cisco_pfr_priority", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_long_term_rtt": { - "path_match": "netflow.cisco_avc_long_term_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_mos_below_counts": { - "path_match": "netflow.cisco_avc_mos_below_counts", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_rsvp_bandwidth_pool": { - "path_match": "netflow.cisco_avc_rsvp_bandwidth_pool", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_rollup_counter": { - "path_match": "netflow.cisco_avc_rollup_counter", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_kth_tier_percent": { - "path_match": "netflow.cisco_avc_kth_tier_percent", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_kth_bw_fee": { - "path_match": "netflow.cisco_avc_kth_bw_fee", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_src_port_min": { - "path_match": "netflow.cisco_avc_src_port_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_src_port_max": { - "path_match": "netflow.cisco_avc_src_port_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_dst_port_min": { - "path_match": "netflow.cisco_avc_dst_port_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_dst_port_max": { - "path_match": "netflow.cisco_avc_dst_port_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_link_capacity": { - "path_match": "netflow.cisco_avc_link_capacity", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_ingress_bw": { - "path_match": "netflow.cisco_avc_ingress_bw", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_ingress_bw_max": { - "path_match": "netflow.cisco_avc_ingress_bw_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_egress_bw": { - "path_match": "netflow.cisco_avc_egress_bw", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_egress_bw_max": { - "path_match": "netflow.cisco_avc_egress_bw_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_ingress_rollup_bw": { - "path_match": "netflow.cisco_avc_ingress_rollup_bw", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_egress_rollup_bw": { - "path_match": "netflow.cisco_avc_egress_rollup_bw", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_cost_target_bw": { - "path_match": "netflow.cisco_avc_cost_target_bw", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_kth_rollup_bw": { - "path_match": "netflow.cisco_avc_kth_rollup_bw", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_link_group_name": { - "path_match": "netflow.cisco_avc_link_group_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_bgp_community": { - "path_match": "netflow.cisco_avc_bgp_community", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_avc_bgp_prepend": { - "path_match": "netflow.cisco_avc_bgp_prepend", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_cost_discard_rollup_count": { - "path_match": "netflow.cisco_avc_cost_discard_rollup_count", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_user": { - "path_match": "netflow.cisco_fw_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_fw_xlate_src_addr_ipv4": { - "path_match": "netflow.cisco_fw_xlate_src_addr_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_fw_xlate_dst_addr_ipv4": { - "path_match": "netflow.cisco_fw_xlate_dst_addr_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_fw_xlate_src_port": { - "path_match": "netflow.cisco_fw_xlate_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_xlate_dst_port": { - "path_match": "netflow.cisco_fw_xlate_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_fw_event": { - "path_match": "netflow.cisco_fw_event", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_client_long_lived_network_delay_max": { - "path_match": "netflow.cisco_avc_client_long_lived_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_long_lived_network_delay_min": { - "path_match": "netflow.cisco_avc_client_long_lived_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_long_lived_network_delay_max": { - "path_match": "netflow.cisco_avc_server_long_lived_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_long_lived_network_delay_min": { - "path_match": "netflow.cisco_avc_server_long_lived_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_policy_qos_class_hierarchy": { - "path_match": "netflow.cisco_policy_qos_class_hierarchy", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_server_bytes": { - "path_match": "netflow.cisco_avc_server_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_bytes": { - "path_match": "netflow.cisco_avc_client_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_concurrent_sessions": { - "path_match": "netflow.cisco_avc_concurrent_sessions", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_segment": { - "path_match": "netflow.cisco_waas_segment", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_waas_passthru_reason": { - "path_match": "netflow.cisco_waas_passthru_reason", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_long_lived_network_delay_sum": { - "path_match": "netflow.cisco_avc_server_long_lived_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_long_lived_network_delay_sum": { - "path_match": "netflow.cisco_avc_client_long_lived_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_total_long_lived_network_delay_sum": { - "path_match": "netflow.cisco_avc_total_long_lived_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_total_long_lived_network_delay_samples": { - "path_match": "netflow.cisco_avc_total_long_lived_network_delay_samples", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_long_lived_network_delay_samples": { - "path_match": "netflow.cisco_avc_server_long_lived_network_delay_samples", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_long_lived_network_delay_samples": { - "path_match": "netflow.cisco_avc_client_long_lived_network_delay_samples", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_packets": { - "path_match": "netflow.cisco_avc_client_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_packets": { - "path_match": "netflow.cisco_avc_server_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_retrans_bytes": { - "path_match": "netflow.cisco_avc_client_retrans_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_retrans_packets": { - "path_match": "netflow.cisco_avc_client_retrans_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_retrans_bytes": { - "path_match": "netflow.cisco_avc_server_retrans_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_retrans_packets": { - "path_match": "netflow.cisco_avc_server_retrans_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transact_time_delta": { - "path_match": "netflow.cisco_avc_transact_time_delta", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transact_time_total": { - "path_match": "netflow.cisco_avc_transact_time_total", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transact_time_max": { - "path_match": "netflow.cisco_avc_transact_time_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_transact_time_min": { - "path_match": "netflow.cisco_avc_transact_time_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_resps": { - "path_match": "netflow.cisco_avc_server_resps", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_resp_histogram1": { - "path_match": "netflow.cisco_avc_resp_histogram1", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_resp_histogram2": { - "path_match": "netflow.cisco_avc_resp_histogram2", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_resp_histogram3": { - "path_match": "netflow.cisco_avc_resp_histogram3", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_resp_histogram4": { - "path_match": "netflow.cisco_avc_resp_histogram4", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_resp_histogram5": { - "path_match": "netflow.cisco_avc_resp_histogram5", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_resp_histogram6": { - "path_match": "netflow.cisco_avc_resp_histogram6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_resp_histogram7": { - "path_match": "netflow.cisco_avc_resp_histogram7", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_late_resps": { - "path_match": "netflow.cisco_avc_server_late_resps", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_resp_time_sum": { - "path_match": "netflow.cisco_avc_server_resp_time_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_resp_time_max": { - "path_match": "netflow.cisco_avc_server_resp_time_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_resp_time_min": { - "path_match": "netflow.cisco_avc_server_resp_time_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_delay_sum": { - "path_match": "netflow.cisco_avc_app_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_delay_max": { - "path_match": "netflow.cisco_avc_app_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_delay_min": { - "path_match": "netflow.cisco_avc_app_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_total_delay_sum": { - "path_match": "netflow.cisco_avc_total_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_total_delay_max": { - "path_match": "netflow.cisco_avc_total_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_total_delay_min": { - "path_match": "netflow.cisco_avc_total_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_total_network_delay_sum": { - "path_match": "netflow.cisco_avc_total_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_total_network_delay_max": { - "path_match": "netflow.cisco_avc_total_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_total_network_delay_min": { - "path_match": "netflow.cisco_avc_total_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_network_delay_sum": { - "path_match": "netflow.cisco_avc_client_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_network_delay_max": { - "path_match": "netflow.cisco_avc_client_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_client_network_delay_min": { - "path_match": "netflow.cisco_avc_client_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_network_delay_sum": { - "path_match": "netflow.cisco_avc_server_network_delay_sum", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_network_delay_max": { - "path_match": "netflow.cisco_avc_server_network_delay_max", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_network_delay_min": { - "path_match": "netflow.cisco_avc_server_network_delay_min", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_rtp_short_term_mos": { - "path_match": "netflow.cisco_avc_rtp_short_term_mos", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_rtp_mos": { - "path_match": "netflow.cisco_avc_rtp_mos", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_rtp_mos_total": { - "path_match": "netflow.cisco_avc_rtp_mos_total", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_http_uri_stats": { - "path_match": "netflow.cisco_avc_app_http_uri_stats", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_policy_qos_queue_id": { - "path_match": "netflow.cisco_avc_policy_qos_queue_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_policy_qos_queue_drops": { - "path_match": "netflow.cisco_avc_policy_qos_queue_drops", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_eta_idp_old": { - "path_match": "netflow.cisco_eta_idp_old", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_eta_slpt_old": { - "path_match": "netflow.cisco_eta_slpt_old", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_wlan_id": { - "path_match": "netflow.cisco_wlan_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_category": { - "path_match": "netflow.cisco_avc_app_category", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_app_sub_category": { - "path_match": "netflow.cisco_avc_app_sub_category", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_app_group": { - "path_match": "netflow.cisco_avc_app_group", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_app_http_host": { - "path_match": "netflow.cisco_avc_app_http_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_client_ipv4_addr": { - "path_match": "netflow.cisco_avc_client_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_avc_server_ipv4_addr": { - "path_match": "netflow.cisco_avc_server_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_avc_client_ipv6_addr": { - "path_match": "netflow.cisco_avc_client_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_avc_server_ipv6_addr": { - "path_match": "netflow.cisco_avc_server_ipv6_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.cisco_avc_client_l4_port": { - "path_match": "netflow.cisco_avc_client_l4_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_server_l4_port": { - "path_match": "netflow.cisco_avc_server_l4_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_conn_id": { - "path_match": "netflow.cisco_avc_conn_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_avc_app_traffic_class": { - "path_match": "netflow.cisco_avc_app_traffic_class", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_avc_app_business_relevance": { - "path_match": "netflow.cisco_avc_app_business_relevance", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_udid": { - "path_match": "netflow.cisco_nvzflow_udid", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_user": { - "path_match": "netflow.cisco_nvzflow_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_os_name": { - "path_match": "netflow.cisco_nvzflow_os_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_os_ver": { - "path_match": "netflow.cisco_nvzflow_os_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_sys_vendor": { - "path_match": "netflow.cisco_nvzflow_sys_vendor", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_sys_type": { - "path_match": "netflow.cisco_nvzflow_sys_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_proc_acct": { - "path_match": "netflow.cisco_nvzflow_proc_acct", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_parent_proc_acct": { - "path_match": "netflow.cisco_nvzflow_parent_proc_acct", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_proc": { - "path_match": "netflow.cisco_nvzflow_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_proc_hash": { - "path_match": "netflow.cisco_nvzflow_proc_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_parent_proc": { - "path_match": "netflow.cisco_nvzflow_parent_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_parent_proc_hash": { - "path_match": "netflow.cisco_nvzflow_parent_proc_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_dns_suffix": { - "path_match": "netflow.cisco_nvzflow_dns_suffix", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_dst_hostname": { - "path_match": "netflow.cisco_nvzflow_dst_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_l4_bytes_in": { - "path_match": "netflow.cisco_nvzflow_l4_bytes_in", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_nvzflow_l4_bytes_out": { - "path_match": "netflow.cisco_nvzflow_l4_bytes_out", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_nvzflow_os_edition": { - "path_match": "netflow.cisco_nvzflow_os_edition", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_module_list": { - "path_match": "netflow.cisco_nvzflow_module_list", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_hash_list": { - "path_match": "netflow.cisco_nvzflow_hash_list", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_coord_list": { - "path_match": "netflow.cisco_nvzflow_coord_list", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_iface_info_uid": { - "path_match": "netflow.cisco_nvzflow_iface_info_uid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_nvzflow_iface_index": { - "path_match": "netflow.cisco_nvzflow_iface_index", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_nvzflow_iface_type": { - "path_match": "netflow.cisco_nvzflow_iface_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_nvzflow_iface_name": { - "path_match": "netflow.cisco_nvzflow_iface_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_nvzflow_iface_details_list": { - "path_match": "netflow.cisco_nvzflow_iface_details_list", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.cisco_timestamp_abs_monitor_interval_start": { - "path_match": "netflow.cisco_timestamp_abs_monitor_interval_start", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.cisco_timestamp_abs_monitor_interval_end": { - "path_match": "netflow.cisco_timestamp_abs_monitor_interval_end", - "mapping": { - "type": "long" - } - } - }, + { + "netflow.cisco_avc_p2p_tech": { + "path_match": "netflow.cisco_avc_p2p_tech", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_tunnel_tech": { + "path_match": "netflow.cisco_avc_tunnel_tech", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_encrypt_tech": { + "path_match": "netflow.cisco_avc_encrypt_tech", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_ipt_dialing_phone": { + "path_match": "netflow.cisco_ipt_dialing_phone", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_ipt_dialing_user": { + "path_match": "netflow.cisco_ipt_dialing_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_ipt_dialed_phone": { + "path_match": "netflow.cisco_ipt_dialed_phone", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_ipt_dialed_user": { + "path_match": "netflow.cisco_ipt_dialed_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_ipt_call_duration": { + "path_match": "netflow.cisco_ipt_call_duration", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_ipt_call_end_reason": { + "path_match": "netflow.cisco_ipt_call_end_reason", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_ipt_calls_dialed": { + "path_match": "netflow.cisco_ipt_calls_dialed", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_ipt_calls_connected": { + "path_match": "netflow.cisco_ipt_calls_connected", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_ipt_calls_failed": { + "path_match": "netflow.cisco_ipt_calls_failed", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_nexus_fastpath_src_addr": { + "path_match": "netflow.cisco_nexus_fastpath_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_nexus_fastpath_src_port": { + "path_match": "netflow.cisco_nexus_fastpath_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_nexus_fastpath_dst_addr": { + "path_match": "netflow.cisco_nexus_fastpath_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_nexus_fastpath_dst_port": { + "path_match": "netflow.cisco_nexus_fastpath_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_endpoint_process_user": { + "path_match": "netflow.cisco_endpoint_process_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_endpoint_process_name": { + "path_match": "netflow.cisco_endpoint_process_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_endpoint_process_hash": { + "path_match": "netflow.cisco_endpoint_process_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_endpoint_process_parent_user": { + "path_match": "netflow.cisco_endpoint_process_parent_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_endpoint_process_parent_name": { + "path_match": "netflow.cisco_endpoint_process_parent_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_endpoint_process_parent_hash": { + "path_match": "netflow.cisco_endpoint_process_parent_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_pfr_policy_id": { + "path_match": "netflow.cisco_pfr_policy_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_map_name": { + "path_match": "netflow.cisco_pfr_map_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_pfr_reason": { + "path_match": "netflow.cisco_pfr_reason", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_fw_ingress_acl_id": { + "path_match": "netflow.cisco_fw_ingress_acl_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_fw_egress_acl_id": { + "path_match": "netflow.cisco_fw_egress_acl_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_fw_ext_event": { + "path_match": "netflow.cisco_fw_ext_event", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_fw_event_level": { + "path_match": "netflow.cisco_fw_event_level", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_event_level_id": { + "path_match": "netflow.cisco_fw_event_level_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_config_value": { + "path_match": "netflow.cisco_fw_config_value", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_erm_code": { + "path_match": "netflow.cisco_fw_erm_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_erm_descr": { + "path_match": "netflow.cisco_fw_erm_descr", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_trustsec_src_id": { + "path_match": "netflow.cisco_trustsec_src_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_trustsec_dst_id": { + "path_match": "netflow.cisco_trustsec_dst_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_trustsec_src_name": { + "path_match": "netflow.cisco_trustsec_src_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_trustsec_dst_name": { + "path_match": "netflow.cisco_trustsec_dst_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_trustsec_switch_derived_sgt": { + "path_match": "netflow.cisco_trustsec_switch_derived_sgt", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_fw_blackout_secs": { + "path_match": "netflow.cisco_fw_blackout_secs", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_half_open_sessions_rate_1min_max": { + "path_match": "netflow.cisco_fw_half_open_sessions_rate_1min_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_half_open_sessions_rate_1min": { + "path_match": "netflow.cisco_fw_half_open_sessions_rate_1min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_zonepair_id": { + "path_match": "netflow.cisco_fw_zonepair_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_sessions_max": { + "path_match": "netflow.cisco_fw_sessions_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_zonepair": { + "path_match": "netflow.cisco_fw_zonepair", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_fw_ext_event_descr": { + "path_match": "netflow.cisco_fw_ext_event_descr", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_fw_drop_pass_summary_packets": { + "path_match": "netflow.cisco_fw_drop_pass_summary_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_half_open_sessions": { + "path_match": "netflow.cisco_fw_half_open_sessions", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_dre_input": { + "path_match": "netflow.cisco_waas_dre_input", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_dre_output": { + "path_match": "netflow.cisco_waas_dre_output", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_lz_input": { + "path_match": "netflow.cisco_waas_lz_input", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_lz_output": { + "path_match": "netflow.cisco_waas_lz_output", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_conn_mode": { + "path_match": "netflow.cisco_waas_conn_mode", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_input_bytes": { + "path_match": "netflow.cisco_waas_input_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_output_bytes": { + "path_match": "netflow.cisco_waas_output_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_short_term_packets_drop": { + "path_match": "netflow.cisco_avc_transport_short_term_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_long_term_packets_drop": { + "path_match": "netflow.cisco_avc_transport_long_term_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_media_bytes": { + "path_match": "netflow.cisco_avc_app_media_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_media_byte_rate": { + "path_match": "netflow.cisco_avc_app_media_byte_rate", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_media_packets": { + "path_match": "netflow.cisco_avc_app_media_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_media_packet_rate": { + "path_match": "netflow.cisco_avc_app_media_packet_rate", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_media_packet_rate_variation": { + "path_match": "netflow.cisco_avc_app_media_packet_rate_variation", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_media_event": { + "path_match": "netflow.cisco_avc_app_media_event", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_monitor_event": { + "path_match": "netflow.cisco_avc_app_monitor_event", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_packets_expected": { + "path_match": "netflow.cisco_avc_transport_packets_expected", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtt": { + "path_match": "netflow.cisco_avc_transport_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_packet_sets_lost": { + "path_match": "netflow.cisco_avc_transport_packet_sets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_short_term_packets_lost": { + "path_match": "netflow.cisco_avc_transport_short_term_packets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_long_term_packets_lost": { + "path_match": "netflow.cisco_avc_transport_long_term_packets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_packet_loss_rate": { + "path_match": "netflow.cisco_avc_transport_packet_loss_rate", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtp_ssrc": { + "path_match": "netflow.cisco_avc_transport_rtp_ssrc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtp_jitter_mean": { + "path_match": "netflow.cisco_avc_transport_rtp_jitter_mean", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtp_jitter_min": { + "path_match": "netflow.cisco_avc_transport_rtp_jitter_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtp_jitter_max": { + "path_match": "netflow.cisco_avc_transport_rtp_jitter_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_controlled_tc": { + "path_match": "netflow.cisco_avc_controlled_tc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_in_policy_tc": { + "path_match": "netflow.cisco_avc_in_policy_tc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_media_packet_rate_variation_min": { + "path_match": "netflow.cisco_avc_app_media_packet_rate_variation_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_media_packet_rate_variation_max": { + "path_match": "netflow.cisco_avc_app_media_packet_rate_variation_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtp_flows": { + "path_match": "netflow.cisco_avc_transport_rtp_flows", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtp_payload_type": { + "path_match": "netflow.cisco_avc_transport_rtp_payload_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_packet_loss_rate_min": { + "path_match": "netflow.cisco_avc_transport_packet_loss_rate_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_packet_loss_rate_max": { + "path_match": "netflow.cisco_avc_transport_packet_loss_rate_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtt_sum": { + "path_match": "netflow.cisco_avc_transport_rtt_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtt_min": { + "path_match": "netflow.cisco_avc_transport_rtt_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transport_rtt_max": { + "path_match": "netflow.cisco_avc_transport_rtt_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_metadata_global_session_id": { + "path_match": "netflow.cisco_avc_metadata_global_session_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_metadata_multi_party_session_id": { + "path_match": "netflow.cisco_avc_metadata_multi_party_session_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_metadata_clock_rate": { + "path_match": "netflow.cisco_avc_metadata_clock_rate", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_network_delay_avg": { + "path_match": "netflow.cisco_avc_network_delay_avg", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_one_way_delay": { + "path_match": "netflow.cisco_avc_one_way_delay", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_tcp_window_size_min": { + "path_match": "netflow.cisco_avc_tcp_window_size_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_tcp_window_size_max": { + "path_match": "netflow.cisco_avc_tcp_window_size_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_tcp_max_segment_size": { + "path_match": "netflow.cisco_avc_tcp_max_segment_size", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_tcp_window_size_sum": { + "path_match": "netflow.cisco_avc_tcp_window_size_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_rtp_jitter_interarrival_avg": { + "path_match": "netflow.cisco_avc_rtp_jitter_interarrival_avg", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_src_site_id": { + "path_match": "netflow.cisco_pfr_src_site_id", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_pfr_dst_site_id": { + "path_match": "netflow.cisco_pfr_dst_site_id", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_avc_transport_byte_loss_rate": { + "path_match": "netflow.cisco_avc_transport_byte_loss_rate", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_event_tc_nomitigation_err_bw_count": { + "path_match": "netflow.cisco_pfr_event_tc_nomitigation_err_bw_count", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_event_tc_nomitigation_err_perf_count": { + "path_match": "netflow.cisco_pfr_event_tc_nomitigation_err_perf_count", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_dst_site_prefix": { + "path_match": "netflow.cisco_pfr_dst_site_prefix", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_pfr_dst_site_prefix_mask": { + "path_match": "netflow.cisco_pfr_dst_site_prefix_mask", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_label_id": { + "path_match": "netflow.cisco_pfr_label_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_br_addr": { + "path_match": "netflow.cisco_pfr_br_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_pfr_state": { + "path_match": "netflow.cisco_pfr_state", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_reason_id": { + "path_match": "netflow.cisco_pfr_reason_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_threshold": { + "path_match": "netflow.cisco_pfr_threshold", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_pfr_priority": { + "path_match": "netflow.cisco_pfr_priority", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_long_term_rtt": { + "path_match": "netflow.cisco_avc_long_term_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_mos_below_counts": { + "path_match": "netflow.cisco_avc_mos_below_counts", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_rsvp_bandwidth_pool": { + "path_match": "netflow.cisco_avc_rsvp_bandwidth_pool", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_rollup_counter": { + "path_match": "netflow.cisco_avc_rollup_counter", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_kth_tier_percent": { + "path_match": "netflow.cisco_avc_kth_tier_percent", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_kth_bw_fee": { + "path_match": "netflow.cisco_avc_kth_bw_fee", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_src_port_min": { + "path_match": "netflow.cisco_avc_src_port_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_src_port_max": { + "path_match": "netflow.cisco_avc_src_port_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_dst_port_min": { + "path_match": "netflow.cisco_avc_dst_port_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_dst_port_max": { + "path_match": "netflow.cisco_avc_dst_port_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_link_capacity": { + "path_match": "netflow.cisco_avc_link_capacity", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_ingress_bw": { + "path_match": "netflow.cisco_avc_ingress_bw", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_ingress_bw_max": { + "path_match": "netflow.cisco_avc_ingress_bw_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_egress_bw": { + "path_match": "netflow.cisco_avc_egress_bw", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_egress_bw_max": { + "path_match": "netflow.cisco_avc_egress_bw_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_ingress_rollup_bw": { + "path_match": "netflow.cisco_avc_ingress_rollup_bw", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_egress_rollup_bw": { + "path_match": "netflow.cisco_avc_egress_rollup_bw", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_cost_target_bw": { + "path_match": "netflow.cisco_avc_cost_target_bw", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_kth_rollup_bw": { + "path_match": "netflow.cisco_avc_kth_rollup_bw", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_link_group_name": { + "path_match": "netflow.cisco_avc_link_group_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_bgp_community": { + "path_match": "netflow.cisco_avc_bgp_community", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_avc_bgp_prepend": { + "path_match": "netflow.cisco_avc_bgp_prepend", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_cost_discard_rollup_count": { + "path_match": "netflow.cisco_avc_cost_discard_rollup_count", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_user": { + "path_match": "netflow.cisco_fw_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_fw_xlate_src_addr_ipv4": { + "path_match": "netflow.cisco_fw_xlate_src_addr_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_fw_xlate_dst_addr_ipv4": { + "path_match": "netflow.cisco_fw_xlate_dst_addr_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_fw_xlate_src_port": { + "path_match": "netflow.cisco_fw_xlate_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_xlate_dst_port": { + "path_match": "netflow.cisco_fw_xlate_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_fw_event": { + "path_match": "netflow.cisco_fw_event", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_client_long_lived_network_delay_max": { + "path_match": "netflow.cisco_avc_client_long_lived_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_long_lived_network_delay_min": { + "path_match": "netflow.cisco_avc_client_long_lived_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_long_lived_network_delay_max": { + "path_match": "netflow.cisco_avc_server_long_lived_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_long_lived_network_delay_min": { + "path_match": "netflow.cisco_avc_server_long_lived_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_policy_qos_class_hierarchy": { + "path_match": "netflow.cisco_policy_qos_class_hierarchy", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_server_bytes": { + "path_match": "netflow.cisco_avc_server_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_bytes": { + "path_match": "netflow.cisco_avc_client_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_concurrent_sessions": { + "path_match": "netflow.cisco_avc_concurrent_sessions", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_segment": { + "path_match": "netflow.cisco_waas_segment", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_waas_passthru_reason": { + "path_match": "netflow.cisco_waas_passthru_reason", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_long_lived_network_delay_sum": { + "path_match": "netflow.cisco_avc_server_long_lived_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_long_lived_network_delay_sum": { + "path_match": "netflow.cisco_avc_client_long_lived_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_total_long_lived_network_delay_sum": { + "path_match": "netflow.cisco_avc_total_long_lived_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_total_long_lived_network_delay_samples": { + "path_match": "netflow.cisco_avc_total_long_lived_network_delay_samples", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_long_lived_network_delay_samples": { + "path_match": "netflow.cisco_avc_server_long_lived_network_delay_samples", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_long_lived_network_delay_samples": { + "path_match": "netflow.cisco_avc_client_long_lived_network_delay_samples", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_packets": { + "path_match": "netflow.cisco_avc_client_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_packets": { + "path_match": "netflow.cisco_avc_server_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_retrans_bytes": { + "path_match": "netflow.cisco_avc_client_retrans_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_retrans_packets": { + "path_match": "netflow.cisco_avc_client_retrans_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_retrans_bytes": { + "path_match": "netflow.cisco_avc_server_retrans_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_retrans_packets": { + "path_match": "netflow.cisco_avc_server_retrans_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transact_time_delta": { + "path_match": "netflow.cisco_avc_transact_time_delta", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transact_time_total": { + "path_match": "netflow.cisco_avc_transact_time_total", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transact_time_max": { + "path_match": "netflow.cisco_avc_transact_time_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_transact_time_min": { + "path_match": "netflow.cisco_avc_transact_time_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_resps": { + "path_match": "netflow.cisco_avc_server_resps", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_resp_histogram1": { + "path_match": "netflow.cisco_avc_resp_histogram1", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_resp_histogram2": { + "path_match": "netflow.cisco_avc_resp_histogram2", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_resp_histogram3": { + "path_match": "netflow.cisco_avc_resp_histogram3", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_resp_histogram4": { + "path_match": "netflow.cisco_avc_resp_histogram4", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_resp_histogram5": { + "path_match": "netflow.cisco_avc_resp_histogram5", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_resp_histogram6": { + "path_match": "netflow.cisco_avc_resp_histogram6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_resp_histogram7": { + "path_match": "netflow.cisco_avc_resp_histogram7", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_late_resps": { + "path_match": "netflow.cisco_avc_server_late_resps", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_resp_time_sum": { + "path_match": "netflow.cisco_avc_server_resp_time_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_resp_time_max": { + "path_match": "netflow.cisco_avc_server_resp_time_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_resp_time_min": { + "path_match": "netflow.cisco_avc_server_resp_time_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_delay_sum": { + "path_match": "netflow.cisco_avc_app_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_delay_max": { + "path_match": "netflow.cisco_avc_app_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_delay_min": { + "path_match": "netflow.cisco_avc_app_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_total_delay_sum": { + "path_match": "netflow.cisco_avc_total_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_total_delay_max": { + "path_match": "netflow.cisco_avc_total_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_total_delay_min": { + "path_match": "netflow.cisco_avc_total_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_total_network_delay_sum": { + "path_match": "netflow.cisco_avc_total_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_total_network_delay_max": { + "path_match": "netflow.cisco_avc_total_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_total_network_delay_min": { + "path_match": "netflow.cisco_avc_total_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_network_delay_sum": { + "path_match": "netflow.cisco_avc_client_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_network_delay_max": { + "path_match": "netflow.cisco_avc_client_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_client_network_delay_min": { + "path_match": "netflow.cisco_avc_client_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_network_delay_sum": { + "path_match": "netflow.cisco_avc_server_network_delay_sum", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_network_delay_max": { + "path_match": "netflow.cisco_avc_server_network_delay_max", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_network_delay_min": { + "path_match": "netflow.cisco_avc_server_network_delay_min", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_rtp_short_term_mos": { + "path_match": "netflow.cisco_avc_rtp_short_term_mos", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_rtp_mos": { + "path_match": "netflow.cisco_avc_rtp_mos", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_rtp_mos_total": { + "path_match": "netflow.cisco_avc_rtp_mos_total", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_http_uri_stats": { + "path_match": "netflow.cisco_avc_app_http_uri_stats", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_policy_qos_queue_id": { + "path_match": "netflow.cisco_avc_policy_qos_queue_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_policy_qos_queue_drops": { + "path_match": "netflow.cisco_avc_policy_qos_queue_drops", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_eta_idp_old": { + "path_match": "netflow.cisco_eta_idp_old", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_eta_slpt_old": { + "path_match": "netflow.cisco_eta_slpt_old", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_wlan_id": { + "path_match": "netflow.cisco_wlan_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_category": { + "path_match": "netflow.cisco_avc_app_category", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_app_sub_category": { + "path_match": "netflow.cisco_avc_app_sub_category", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_app_group": { + "path_match": "netflow.cisco_avc_app_group", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_app_http_host": { + "path_match": "netflow.cisco_avc_app_http_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_client_ipv4_addr": { + "path_match": "netflow.cisco_avc_client_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_avc_server_ipv4_addr": { + "path_match": "netflow.cisco_avc_server_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_avc_client_ipv6_addr": { + "path_match": "netflow.cisco_avc_client_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_avc_server_ipv6_addr": { + "path_match": "netflow.cisco_avc_server_ipv6_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.cisco_avc_client_l4_port": { + "path_match": "netflow.cisco_avc_client_l4_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_server_l4_port": { + "path_match": "netflow.cisco_avc_server_l4_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_conn_id": { + "path_match": "netflow.cisco_avc_conn_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_avc_app_traffic_class": { + "path_match": "netflow.cisco_avc_app_traffic_class", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_avc_app_business_relevance": { + "path_match": "netflow.cisco_avc_app_business_relevance", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_udid": { + "path_match": "netflow.cisco_nvzflow_udid", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_user": { + "path_match": "netflow.cisco_nvzflow_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_os_name": { + "path_match": "netflow.cisco_nvzflow_os_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_os_ver": { + "path_match": "netflow.cisco_nvzflow_os_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_sys_vendor": { + "path_match": "netflow.cisco_nvzflow_sys_vendor", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_sys_type": { + "path_match": "netflow.cisco_nvzflow_sys_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_proc_acct": { + "path_match": "netflow.cisco_nvzflow_proc_acct", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_parent_proc_acct": { + "path_match": "netflow.cisco_nvzflow_parent_proc_acct", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_proc": { + "path_match": "netflow.cisco_nvzflow_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_proc_hash": { + "path_match": "netflow.cisco_nvzflow_proc_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_parent_proc": { + "path_match": "netflow.cisco_nvzflow_parent_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_parent_proc_hash": { + "path_match": "netflow.cisco_nvzflow_parent_proc_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_dns_suffix": { + "path_match": "netflow.cisco_nvzflow_dns_suffix", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_dst_hostname": { + "path_match": "netflow.cisco_nvzflow_dst_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_l4_bytes_in": { + "path_match": "netflow.cisco_nvzflow_l4_bytes_in", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_nvzflow_l4_bytes_out": { + "path_match": "netflow.cisco_nvzflow_l4_bytes_out", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_nvzflow_os_edition": { + "path_match": "netflow.cisco_nvzflow_os_edition", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_module_list": { + "path_match": "netflow.cisco_nvzflow_module_list", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_hash_list": { + "path_match": "netflow.cisco_nvzflow_hash_list", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_coord_list": { + "path_match": "netflow.cisco_nvzflow_coord_list", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_iface_info_uid": { + "path_match": "netflow.cisco_nvzflow_iface_info_uid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_nvzflow_iface_index": { + "path_match": "netflow.cisco_nvzflow_iface_index", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_nvzflow_iface_type": { + "path_match": "netflow.cisco_nvzflow_iface_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_nvzflow_iface_name": { + "path_match": "netflow.cisco_nvzflow_iface_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_nvzflow_iface_details_list": { + "path_match": "netflow.cisco_nvzflow_iface_details_list", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.cisco_timestamp_abs_monitor_interval_start": { + "path_match": "netflow.cisco_timestamp_abs_monitor_interval_start", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.cisco_timestamp_abs_monitor_interval_end": { + "path_match": "netflow.cisco_timestamp_abs_monitor_interval_end", + "mapping": { + "type": "long" + } + } + }, - { - "netflow.ericsson_nat_context_id": { - "path_match": "netflow.ericsson_nat_context_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ericsson_nat_context_name": { - "path_match": "netflow.ericsson_nat_context_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ericsson_nat_assign_ts_secs": { - "path_match": "netflow.ericsson_nat_assign_ts_secs", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ericsson_nat_unassign_ts_secs": { - "path_match": "netflow.ericsson_nat_unassign_ts_secs", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ericsson_nat_int_ipv4": { - "path_match": "netflow.ericsson_nat_internal_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ericsson_nat_ext_ipv4": { - "path_match": "netflow.ericsson_nat_external_ipv4", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ericsson_nat_ext_port_start": { - "path_match": "netflow.ericsson_nat_external_port_start", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ericsson_nat_ext_port_end": { - "path_match": "netflow.ericsson_nat_external_port_end", - "mapping": { - "type": "long" - } - } - }, + { + "netflow.ericsson_nat_context_id": { + "path_match": "netflow.ericsson_nat_context_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ericsson_nat_context_name": { + "path_match": "netflow.ericsson_nat_context_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ericsson_nat_assign_ts_secs": { + "path_match": "netflow.ericsson_nat_assign_ts_secs", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ericsson_nat_unassign_ts_secs": { + "path_match": "netflow.ericsson_nat_unassign_ts_secs", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ericsson_nat_int_ipv4": { + "path_match": "netflow.ericsson_nat_internal_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ericsson_nat_ext_ipv4": { + "path_match": "netflow.ericsson_nat_external_ipv4", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ericsson_nat_ext_port_start": { + "path_match": "netflow.ericsson_nat_external_port_start", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ericsson_nat_ext_port_end": { + "path_match": "netflow.ericsson_nat_external_port_end", + "mapping": { + "type": "long" + } + } + }, - - { - "netflow.ntop_src_frags": { - "path_match": "netflow.ntop_src_frags", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_frags": { - "path_match": "netflow.ntop_dst_frags", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_to_dst_max_throughput": { - "path_match": "netflow.ntop_src_to_dst_max_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_to_dst_min_throughput": { - "path_match": "netflow.ntop_src_to_dst_min_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_to_dst_avg_throughput": { - "path_match": "netflow.ntop_src_to_dst_avg_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_to_src_max_throughput": { - "path_match": "netflow.ntop_dst_to_src_max_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_to_src_min_throughput": { - "path_match": "netflow.ntop_dst_to_src_min_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_to_src_avg_throughput": { - "path_match": "netflow.ntop_dst_to_src_avg_throughput", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_upto_128_bytes": { - "path_match": "netflow.ntop_packets_upto_128_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_128_to_256_bytes": { - "path_match": "netflow.ntop_packets_128_to_256_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_256_to_512_bytes": { - "path_match": "netflow.ntop_packets_256_to_512_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_512_to_1024_bytes": { - "path_match": "netflow.ntop_packets_512_to_1024_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_1024_to_1514_bytes": { - "path_match": "netflow.ntop_packets_1024_to_1514_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_over_1514_bytes": { - "path_match": "netflow.ntop_packets_over_1514_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_cumulative_icmp_type": { - "path_match": "netflow.ntop_cumulative_icmp_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_country": { - "path_match": "netflow.ntop_src_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_src_city": { - "path_match": "netflow.ntop_src_city", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dst_country": { - "path_match": "netflow.ntop_dst_country", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dst_city": { - "path_match": "netflow.ntop_dst_city", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_flow_proto_port": { - "path_match": "netflow.ntop_flow_proto_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tunnel_id": { - "path_match": "netflow.ntop_tunnel_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_longest_flow_packet": { - "path_match": "netflow.ntop_longest_flow_packet", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_shortest_flow_packet": { - "path_match": "netflow.ntop_shortest_flow_packet", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_retrans_in_packets": { - "path_match": "netflow.ntop_retrans_in_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_retrans_out_packets": { - "path_match": "netflow.ntop_retrans_out_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_ooorder_in_packets": { - "path_match": "netflow.ntop_ooorder_in_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_ooorder_out_packets": { - "path_match": "netflow.ntop_ooorder_out_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_untunneled_protocol": { - "path_match": "netflow.ntop_untunneled_protocol", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_untunneled_ipv4_src_addr": { - "path_match": "netflow.ntop_untunneled_ipv4_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_untunneled_l4_src_port": { - "path_match": "netflow.ntop_untunneled_l4_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_untunneled_ipv4_dst_addr": { - "path_match": "netflow.ntop_untunneled_ipv4_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_untunneled_l4_dst_port": { - "path_match": "netflow.ntop_untunneled_l4_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_l7_proto": { - "path_match": "netflow.ntop_l7_proto", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_l7_proto_name": { - "path_match": "netflow.ntop_l7_proto_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_downstram_tunnel_id": { - "path_match": "netflow.ntop_downstram_tunnel_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_flow_user": { - "path_match": "netflow.ntop_flow_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_flow_server": { - "path_match": "netflow.ntop_flow_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_client_nw_latency_ms": { - "path_match": "netflow.ntop_client_nw_latency_ms", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_server_nw_latency_ms": { - "path_match": "netflow.ntop_server_nw_latency_ms", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_appl_latency_ms": { - "path_match": "netflow.ntop_appl_latency_ms", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_plugin": { - "path_match": "netflow.ntop_plugin", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_retrans_in_bytes": { - "path_match": "netflow.ntop_retrans_in_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_retrans_out_bytes": { - "path_match": "netflow.ntop_retrans_out_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_call_id": { - "path_match": "netflow.ntop_sip_call_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_sip_calling_party": { - "path_match": "netflow.ntop_sip_calling_party", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_sip_called_party": { - "path_match": "netflow.ntop_sip_called_party", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_sip_rtp_codecs": { - "path_match": "netflow.ntop_sip_rtp_codecs", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_sip_invite_time": { - "path_match": "netflow.ntop_sip_invite_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_trying_time": { - "path_match": "netflow.ntop_sip_trying_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_ringing_time": { - "path_match": "netflow.ntop_sip_ringing_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_ok_time": { - "path_match": "netflow.ntop_sip_ok_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_invite_failure_time": { - "path_match": "netflow.ntop_sip_invite_failure_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_bye_time": { - "path_match": "netflow.ntop_sip_bye_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_bye_ok_time": { - "path_match": "netflow.ntop_sip_bye_ok_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_cancel_time": { - "path_match": "netflow.ntop_sip_cancel_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_cancel_ok_time": { - "path_match": "netflow.ntop_sip_cancel_ok_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_rtp_ipv4_src_addr": { - "path_match": "netflow.ntop_sip_rtp_ipv4_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_sip_rtp_l4_src_port": { - "path_match": "netflow.ntop_sip_rtp_l4_src_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_rtp_ipv4_dst_addr": { - "path_match": "netflow.ntop_sip_rtp_ipv4_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_sip_rtp_l4_dst_port": { - "path_match": "netflow.ntop_sip_rtp_l4_dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_resp_code": { - "path_match": "netflow.ntop_sip_resp_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_sip_reason_cause": { - "path_match": "netflow.ntop_sip_reason_cause", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_first_seq": { - "path_match": "netflow.ntop_rtp_first_seq", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_first_ts": { - "path_match": "netflow.ntop_rtp_first_ts", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_last_seq": { - "path_match": "netflow.ntop_rtp_last_seq", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_last_ts": { - "path_match": "netflow.ntop_rtp_last_ts", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_in_jitter": { - "path_match": "netflow.ntop_rtp_in_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_out_jitter": { - "path_match": "netflow.ntop_rtp_out_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_in_packets_lost": { - "path_match": "netflow.ntop_rtp_in_packets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_out_packets_lost": { - "path_match": "netflow.ntop_rtp_out_packets_lost", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_out_payload_type": { - "path_match": "netflow.ntop_rtp_out_payload_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_in_max_delta": { - "path_match": "netflow.ntop_rtp_in_max_delta", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_out_max_delta": { - "path_match": "netflow.ntop_rtp_out_max_delta", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_in_payload_type": { - "path_match": "netflow.ntop_rtp_in_payload_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_proc_id": { - "path_match": "netflow.ntop_src_proc_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_proc": { - "path_match": "netflow.ntop_src_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_http_url": { - "path_match": "netflow.ntop_http_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_http_ret_code": { - "path_match": "netflow.ntop_http_ret_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_http_referrer": { - "path_match": "netflow.ntop_http_referrer", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_http_user_agent": { - "path_match": "netflow.ntop_http_user_agent", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_http_mime": { - "path_match": "netflow.ntop_http_mime", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_smtp_mail_from": { - "path_match": "netflow.ntop_smtp_mail_from", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_smtp_rcpt_to": { - "path_match": "netflow.ntop_smtp_rcpt_to", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_http_host": { - "path_match": "netflow.ntop_http_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ssl_server": { - "path_match": "netflow.ntop_ssl_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_bittorrent_hash": { - "path_match": "netflow.ntop_bittorrent_hash", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_mysql_server_ver": { - "path_match": "netflow.ntop_mysql_server_ver", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_mysql_user": { - "path_match": "netflow.ntop_mysql_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_mysql_db": { - "path_match": "netflow.ntop_mysql_db", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_mysql_query": { - "path_match": "netflow.ntop_mysql_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_mysql_resp": { - "path_match": "netflow.ntop_mysql_resp", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_oracle_user": { - "path_match": "netflow.ntop_oracle_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_oracle_query": { - "path_match": "netflow.ntop_oracle_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_oracle_resp_code": { - "path_match": "netflow.ntop_oracle_resp_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_oracle_resp_string": { - "path_match": "netflow.ntop_oracle_resp_string", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_oracle_query_duration": { - "path_match": "netflow.ntop_oracle_query_duration", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dns_query": { - "path_match": "netflow.ntop_dns_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dns_query_id": { - "path_match": "netflow.ntop_dns_query_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dns_query_type": { - "path_match": "netflow.ntop_dns_query_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dns_ret_code": { - "path_match": "netflow.ntop_dns_ret_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dns_answers": { - "path_match": "netflow.ntop_dns_answers", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_pop_user": { - "path_match": "netflow.ntop_pop_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv1_req_msg_type": { - "path_match": "netflow.ntop_gtpv1_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_resp_msg_type": { - "path_match": "netflow.ntop_gtpv1_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_c2s_teid_data": { - "path_match": "netflow.ntop_gtpv1_c2s_teid_data", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_c2s_teid_ctrl": { - "path_match": "netflow.ntop_gtpv1_c2s_teid_ctrl", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_s2c_teid_data": { - "path_match": "netflow.ntop_gtpv1_s2c_teid_data", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_s2c_teid_ctrl": { - "path_match": "netflow.ntop_gtpv1_s2c_teid_ctrl", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_end_user_ip": { - "path_match": "netflow.ntop_gtpv1_end_user_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv1_end_user_imsi": { - "path_match": "netflow.ntop_gtpv1_end_user_imsi", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv1_end_user_msisdn": { - "path_match": "netflow.ntop_gtpv1_end_user_msisdn", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv1_end_user_imei": { - "path_match": "netflow.ntop_gtpv1_end_user_imei", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv1_apn": { - "path_match": "netflow.ntop_gtpv1_apn", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv1_rai_mcc": { - "path_match": "netflow.ntop_gtpv1_rai_mcc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_rai_mnc": { - "path_match": "netflow.ntop_gtpv1_rai_mnc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_uli_cell_lac": { - "path_match": "netflow.ntop_gtpv1_uli_cell_lac", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_uli_cell_ci": { - "path_match": "netflow.ntop_gtpv1_uli_cell_ci", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_uli_sac": { - "path_match": "netflow.ntop_gtpv1_uli_sac", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_rai_type": { - "path_match": "netflow.ntop_gtpv1_rai_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_radius_req_msg_type": { - "path_match": "netflow.ntop_radius_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_radius_resp_msg_type": { - "path_match": "netflow.ntop_radius_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_radius_user": { - "path_match": "netflow.ntop_radius_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_radius_calling_station_id": { - "path_match": "netflow.ntop_radius_calling_station_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_radius_called_station_id": { - "path_match": "netflow.ntop_radius_called_station_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_radius_nas_ip": { - "path_match": "netflow.ntop_radius_nas_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_radius_nas_id": { - "path_match": "netflow.ntop_radius_nas_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_radius_user_imsi": { - "path_match": "netflow.ntop_radius_user_imsi", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_radius_user_imei": { - "path_match": "netflow.ntop_radius_user_imei", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_radius_framed_ip": { - "path_match": "netflow.ntop_radius_framed_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_radius_acct_sess_id": { - "path_match": "netflow.ntop_radius_acct_sess_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_radius_acct_status_type": { - "path_match": "netflow.ntop_radius_acct_status_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_radius_acct_in_octets": { - "path_match": "netflow.ntop_radius_acct_in_octets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_radius_acct_out_octets": { - "path_match": "netflow.ntop_radius_acct_out_octets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_radius_acct_in_packets": { - "path_match": "netflow.ntop_radius_acct_in_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_radius_acct_out_packets": { - "path_match": "netflow.ntop_radius_acct_out_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_imap_login": { - "path_match": "netflow.ntop_imap_login", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv2_req_msg_type": { - "path_match": "netflow.ntop_gtpv2_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_resp_msg_type": { - "path_match": "netflow.ntop_gtpv2_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_c2s_s1u_gtpu_teid": { - "path_match": "netflow.ntop_gtpv2_c2s_s1u_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_c2s_s1u_gtpu_ip": { - "path_match": "netflow.ntop_gtpv2_c2s_s1u_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv2_s2c_s1u_gtpu_teid": { - "path_match": "netflow.ntop_gtpv2_s2c_s1u_gtpu_teid", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv2_s2c_s1u_gtpu_ip": { - "path_match": "netflow.ntop_gtpv2_s2c_s1u_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv2_end_user_imsi": { - "path_match": "netflow.ntop_gtpv2_end_user_imsi", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv2_and_user_msisdn": { - "path_match": "netflow.ntop_gtpv2_and_user_msisdn", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv2_apn": { - "path_match": "netflow.ntop_gtpv2_apn", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv2_uli_mcc": { - "path_match": "netflow.ntop_gtpv2_uli_mcc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_uli_mnc": { - "path_match": "netflow.ntop_gtpv2_uli_mnc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_uli_cell_tac": { - "path_match": "netflow.ntop_gtpv2_uli_cell_tac", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_uli_cell_id": { - "path_match": "netflow.ntop_gtpv2_uli_cell_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_rat_type": { - "path_match": "netflow.ntop_gtpv2_rat_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_pdn_ip": { - "path_match": "netflow.ntop_gtpv2_pdn_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv2_end_user_imei": { - "path_match": "netflow.ntop_gtpv2_end_user_imei", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_src_as_path_1": { - "path_match": "netflow.ntop_src_as_path_1", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_2": { - "path_match": "netflow.ntop_src_as_path_2", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_3": { - "path_match": "netflow.ntop_src_as_path_3", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_4": { - "path_match": "netflow.ntop_src_as_path_4", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_5": { - "path_match": "netflow.ntop_src_as_path_5", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_6": { - "path_match": "netflow.ntop_src_as_path_6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_7": { - "path_match": "netflow.ntop_src_as_path_7", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_8": { - "path_match": "netflow.ntop_src_as_path_8", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_9": { - "path_match": "netflow.ntop_src_as_path_9", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_as_path_10": { - "path_match": "netflow.ntop_src_as_path_10", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_1": { - "path_match": "netflow.ntop_dst_as_path_1", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_2": { - "path_match": "netflow.ntop_dst_as_path_2", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_3": { - "path_match": "netflow.ntop_dst_as_path_3", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_4": { - "path_match": "netflow.ntop_dst_as_path_4", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_5": { - "path_match": "netflow.ntop_dst_as_path_5", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_6": { - "path_match": "netflow.ntop_dst_as_path_6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_7": { - "path_match": "netflow.ntop_dst_as_path_7", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_8": { - "path_match": "netflow.ntop_dst_as_path_8", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_9": { - "path_match": "netflow.ntop_dst_as_path_9", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_as_path_10": { - "path_match": "netflow.ntop_dst_as_path_10", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_mysql_appl_latency_usec": { - "path_match": "netflow.ntop_mysql_appl_latency_usec", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv0_req_msg_type": { - "path_match": "netflow.ntop_gtpv0_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv0_resp_msg_type": { - "path_match": "netflow.ntop_gtpv0_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv0_tid": { - "path_match": "netflow.ntop_gtpv0_tid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv0_end_user_ip": { - "path_match": "netflow.ntop_gtpv0_end_user_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv0_end_user_msisdn": { - "path_match": "netflow.ntop_gtpv0_end_user_msisdn", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv0_apn": { - "path_match": "netflow.ntop_gtpv0_apn", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_gtpv0_rai_mcc": { - "path_match": "netflow.ntop_gtpv0_rai_mcc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv0_rai_mnc": { - "path_match": "netflow.ntop_gtpv0_rai_mnc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv0_rai_cell_lac": { - "path_match": "netflow.ntop_gtpv0_rai_cell_lac", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv0_rai_cell_rac": { - "path_match": "netflow.ntop_gtpv0_rai_cell_rac", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv0_resp_cause": { - "path_match": "netflow.ntop_gtpv0_resp_cause", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_resp_cause": { - "path_match": "netflow.ntop_gtpv1_resp_cause", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_resp_cause": { - "path_match": "netflow.ntop_gtpv2_resp_cause", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_5_32": { - "path_match": "netflow.ntop_packets_ttl_5_32", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_32_64": { - "path_match": "netflow.ntop_packets_ttl_32_64", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_64_96": { - "path_match": "netflow.ntop_packets_ttl_64_96", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_96_128": { - "path_match": "netflow.ntop_packets_ttl_96_128", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_128_160": { - "path_match": "netflow.ntop_packets_ttl_128_160", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_160_192": { - "path_match": "netflow.ntop_packets_ttl_160_192", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_192_224": { - "path_match": "netflow.ntop_packets_ttl_192_224", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_224_225": { - "path_match": "netflow.ntop_packets_ttl_224_225", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_rai_lac": { - "path_match": "netflow.ntop_gtpv1_rai_lac", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_rai_rac": { - "path_match": "netflow.ntop_gtpv1_rai_rac", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_uli_mcc": { - "path_match": "netflow.ntop_gtpv1_uli_mcc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv1_uli_mnc": { - "path_match": "netflow.ntop_gtpv1_uli_mnc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_2_5": { - "path_match": "netflow.ntop_packets_ttl_2_5", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_packets_ttl_eq_1": { - "path_match": "netflow.ntop_packets_ttl_eq_1", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_sip_call_id": { - "path_match": "netflow.ntop_rtp_sip_call_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_in_src_osi_sap": { - "path_match": "netflow.ntop_in_src_osi_sap", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_out_dst_osi_sap": { - "path_match": "netflow.ntop_out_dst_osi_sap", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_whois_das_domain": { - "path_match": "netflow.ntop_whois_das_domain", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dns_ttl_answer": { - "path_match": "netflow.ntop_dns_ttl_answer", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dhcp_client_mac": { - "path_match": "netflow.ntop_dhcp_client_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dhcp_client_ip": { - "path_match": "netflow.ntop_dhcp_client_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_dhcp_client": { - "path_match": "netflow.ntop_dhcp_client", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ftp_login": { - "path_match": "netflow.ntop_ftp_login", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ftp_password": { - "path_match": "netflow.ntop_ftp_password", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ftp_command": { - "path_match": "netflow.ntop_ftp_command", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ftp_command_ret_code": { - "path_match": "netflow.ntop_ftp_command_ret_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_http_method": { - "path_match": "netflow.ntop_http_method", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_http_site": { - "path_match": "netflow.ntop_http_site", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_sip_c_ip": { - "path_match": "netflow.ntop_sip_c_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_sip_call_state": { - "path_match": "netflow.ntop_sip_call_state", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_rtp_in_mos": { - "path_match": "netflow.ntop_rtp_in_mos", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_in_r_factor": { - "path_match": "netflow.ntop_rtp_in_r_factor", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_proc_user": { - "path_match": "netflow.ntop_src_proc_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_src_father_proc_pid": { - "path_match": "netflow.ntop_src_father_proc_pid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_father_proc": { - "path_match": "netflow.ntop_src_father_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dst_proc_pid": { - "path_match": "netflow.ntop_dst_proc_pid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_proc": { - "path_match": "netflow.ntop_dst_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dst_proc_user": { - "path_match": "netflow.ntop_dst_proc_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dst_father_proc_pid": { - "path_match": "netflow.ntop_dst_father_proc_pid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_father_proc": { - "path_match": "netflow.ntop_dst_father_proc", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_rtp_rtt": { - "path_match": "netflow.ntop_rtp_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_in_transit": { - "path_match": "netflow.ntop_rtp_in_transit", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_out_transit": { - "path_match": "netflow.ntop_rtp_out_transit", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_proc_actual_memory": { - "path_match": "netflow.ntop_src_proc_actual_memory", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_proc_peak_memory": { - "path_match": "netflow.ntop_src_proc_peak_memory", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_proc_avg_cpu_load": { - "path_match": "netflow.ntop_src_proc_avg_cpu_load", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_proc_page_faults": { - "path_match": "netflow.ntop_src_proc_page_faults", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_proc_actual_memory": { - "path_match": "netflow.ntop_dst_proc_actual_memory", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_proc_peak_memory": { - "path_match": "netflow.ntop_dst_proc_peak_memory", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_proc_avg_cpu_load": { - "path_match": "netflow.ntop_dst_proc_avg_cpu_load", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_proc_page_faults": { - "path_match": "netflow.ntop_dst_proc_page_faults", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_duration_in": { - "path_match": "netflow.ntop_duration_in", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_duration_out": { - "path_match": "netflow.ntop_duration_out", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_proc_pctg_iowait": { - "path_match": "netflow.ntop_src_proc_pctg_iowait", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_proc_pctg_iowait": { - "path_match": "netflow.ntop_dst_proc_pctg_iowait", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_dtmf_tones": { - "path_match": "netflow.ntop_rtp_dtmf_tones", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_untunneled_ipv6_src_addr": { - "path_match": "netflow.ntop_untunneled_ipv6_src_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_untunneled_ipv6_dst_addr": { - "path_match": "netflow.ntop_untunneled_ipv6_dst_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_dns_resp": { - "path_match": "netflow.ntop_dns_resp", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_diameter_req_msg_type": { - "path_match": "netflow.ntop_diameter_req_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_diameter_resp_msg_type": { - "path_match": "netflow.ntop_diameter_resp_msg_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_diameter_req_origin_host": { - "path_match": "netflow.ntop_diameter_req_origin_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_diameter_resp_origin_host": { - "path_match": "netflow.ntop_diameter_resp_origin_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_diameter_req_user": { - "path_match": "netflow.ntop_diameter_req_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_diameter_resp_result_code": { - "path_match": "netflow.ntop_diameter_resp_result_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_diameter_exp_res_vendor_id": { - "path_match": "netflow.ntop_diameter_exp_res_vendor_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_diameter_exp_res_result_code": { - "path_match": "netflow.ntop_diameter_exp_res_result_code", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_s1ap_enb_ue_s1ap_id": { - "path_match": "netflow.ntop_s1ap_enb_ue_s1ap_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_s1ap_mme_ue_s1ap_id": { - "path_match": "netflow.ntop_s1ap_mme_ue_s1ap_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_s1ap_msg_emm_type_mme_to_enb": { - "path_match": "netflow.ntop_s1ap_msg_emm_type_mme_to_enb", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_s1ap_msg_esm_type_mme_to_enb": { - "path_match": "netflow.ntop_s1ap_msg_esm_type_mme_to_enb", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_s1ap_msg_emm_type_enb_to_mme": { - "path_match": "netflow.ntop_s1ap_msg_emm_type_enb_to_mme", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_s1ap_msg_esm_type_enb_to_mme": { - "path_match": "netflow.ntop_s1ap_msg_esm_type_enb_to_mme", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_s1ap_cause_enb_to_mme": { - "path_match": "netflow.ntop_s1ap_cause_enb_to_mme", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_s1ap_detailed_cause_enb_to_mme": { - "path_match": "netflow.ntop_s1ap_detailed_cause_enb_to_mme", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tcp_win_min_in": { - "path_match": "netflow.ntop_tcp_win_min_in", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tcp_win_max_in": { - "path_match": "netflow.ntop_tcp_win_max_in", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tcp_win_mss_in": { - "path_match": "netflow.ntop_tcp_win_mss_in", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tcp_win_scale_in": { - "path_match": "netflow.ntop_tcp_win_scale_in", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tcp_win_min_out": { - "path_match": "netflow.ntop_tcp_win_min_out", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tcp_win_max_out": { - "path_match": "netflow.ntop_tcp_win_max_out", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tcp_win_mss_out": { - "path_match": "netflow.ntop_tcp_win_mss_out", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_tcp_win_scale_out": { - "path_match": "netflow.ntop_tcp_win_scale_out", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dhcp_remote_id": { - "path_match": "netflow.ntop_dhcp_remote_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dhcp_subscriber_id": { - "path_match": "netflow.ntop_dhcp_subscriber_id", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_src_proc_uid": { - "path_match": "netflow.ntop_src_proc_uid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_dst_proc_uid": { - "path_match": "netflow.ntop_dst_proc_uid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_application": { - "path_match": "netflow.ntop_application", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_user": { - "path_match": "netflow.ntop_user", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dhcp_message_type": { - "path_match": "netflow.ntop_dhcp_message_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_rtp_in_packets_drop": { - "path_match": "netflow.ntop_rtp_in_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_out_packets_drop": { - "path_match": "netflow.ntop_rtp_out_packets_drop", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_out_mos": { - "path_match": "netflow.ntop_rtp_out_mos", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_out_r_factor": { - "path_match": "netflow.ntop_rtp_out_r_factor", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_mos": { - "path_match": "netflow.ntop_rtp_mos", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gptv2_s5_s8_gtpc_teid": { - "path_match": "netflow.ntop_gptv2_s5_s8_gtpc_teid", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_rtp_r_factor": { - "path_match": "netflow.ntop_rtp_r_factor", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_rtp_ssrc": { - "path_match": "netflow.ntop_rtp_ssrc", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_payload_hash": { - "path_match": "netflow.ntop_payload_hash", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_c2s_s5_s8_gtpu_teid": { - "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_s2c_s5_s8_gtpu_teid": { - "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_c2s_s5_s8_gtpu_ip": { - "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv2_s2c_s5_s8_gtpu_ip": { - "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_src_as_map": { - "path_match": "netflow.ntop_src_as_map", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_dst_as_map": { - "path_match": "netflow.ntop_dst_as_map", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_diameter_hop_by_hop_id": { - "path_match": "netflow.ntop_diameter_hop_by_hop_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_upstream_sess_id": { - "path_match": "netflow.ntop_upstream_sess_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_downstream_sess_id": { - "path_match": "netflow.ntop_downstream_sess_id", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_src_long": { - "path_match": "netflow.ntop_src_long", - "mapping": { - "type": "float" - } - } - }, - { - "netflow.ntop_src_lat": { - "path_match": "netflow.ntop_src_lat", - "mapping": { - "type": "float" - } - } - }, - { - "netflow.ntop_dst_long": { - "path_match": "netflow.ntop_dst_long", - "mapping": { - "type": "float" - } - } - }, - { - "netflow.ntop_dst_lat": { - "path_match": "netflow.ntop_dst_lat", - "mapping": { - "type": "float" - } - } - }, - { - "netflow.ntop_diameter_clr_cancel_type": { - "path_match": "netflow.ntop_diameter_clr_cancel_type", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_diameter_clr_flags": { - "path_match": "netflow.ntop_diameter_clr_flags", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_c2s_s5_s8_gtpc_ip": { - "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_gtpc_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv2_s2c_s5_s8_gtpc_ip": { - "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_gtpc_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid": { - "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid": { - "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip": { - "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip": { - "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.ntop_http_x_forwarded_for": { - "path_match": "netflow.ntop_http_x_forwarded_for", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_http_via": { - "path_match": "netflow.ntop_http_via", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ssdp_host": { - "path_match": "netflow.ntop_ssdp_host", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ssdp_usn": { - "path_match": "netflow.ntop_ssdp_usn", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_netbios_query": { - "path_match": "netflow.ntop_netbios_query", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_netbios_query_type": { - "path_match": "netflow.ntop_netbios_query_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_netbios_resp": { - "path_match": "netflow.ntop_netbios_resp", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_netbios_query_os": { - "path_match": "netflow.ntop_netbios_query_os", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ssdp_server": { - "path_match": "netflow.ntop_ssdp_server", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ssdp_type": { - "path_match": "netflow.ntop_ssdp_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_ssdp_method": { - "path_match": "netflow.ntop_ssdp_method", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.ntop_nprobe_ipv4_addr": { - "path_match": "netflow.ntop_nprobe_ipv4_addr", - "mapping": { - "type": "ip" - } - } - }, + + { + "netflow.ntop_src_frags": { + "path_match": "netflow.ntop_src_frags", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_frags": { + "path_match": "netflow.ntop_dst_frags", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_to_dst_max_throughput": { + "path_match": "netflow.ntop_src_to_dst_max_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_to_dst_min_throughput": { + "path_match": "netflow.ntop_src_to_dst_min_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_to_dst_avg_throughput": { + "path_match": "netflow.ntop_src_to_dst_avg_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_to_src_max_throughput": { + "path_match": "netflow.ntop_dst_to_src_max_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_to_src_min_throughput": { + "path_match": "netflow.ntop_dst_to_src_min_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_to_src_avg_throughput": { + "path_match": "netflow.ntop_dst_to_src_avg_throughput", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_upto_128_bytes": { + "path_match": "netflow.ntop_packets_upto_128_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_128_to_256_bytes": { + "path_match": "netflow.ntop_packets_128_to_256_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_256_to_512_bytes": { + "path_match": "netflow.ntop_packets_256_to_512_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_512_to_1024_bytes": { + "path_match": "netflow.ntop_packets_512_to_1024_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_1024_to_1514_bytes": { + "path_match": "netflow.ntop_packets_1024_to_1514_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_over_1514_bytes": { + "path_match": "netflow.ntop_packets_over_1514_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_cumulative_icmp_type": { + "path_match": "netflow.ntop_cumulative_icmp_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_country": { + "path_match": "netflow.ntop_src_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_src_city": { + "path_match": "netflow.ntop_src_city", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dst_country": { + "path_match": "netflow.ntop_dst_country", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dst_city": { + "path_match": "netflow.ntop_dst_city", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_flow_proto_port": { + "path_match": "netflow.ntop_flow_proto_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tunnel_id": { + "path_match": "netflow.ntop_tunnel_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_longest_flow_packet": { + "path_match": "netflow.ntop_longest_flow_packet", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_shortest_flow_packet": { + "path_match": "netflow.ntop_shortest_flow_packet", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_retrans_in_packets": { + "path_match": "netflow.ntop_retrans_in_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_retrans_out_packets": { + "path_match": "netflow.ntop_retrans_out_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_ooorder_in_packets": { + "path_match": "netflow.ntop_ooorder_in_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_ooorder_out_packets": { + "path_match": "netflow.ntop_ooorder_out_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_untunneled_protocol": { + "path_match": "netflow.ntop_untunneled_protocol", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_untunneled_ipv4_src_addr": { + "path_match": "netflow.ntop_untunneled_ipv4_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_untunneled_l4_src_port": { + "path_match": "netflow.ntop_untunneled_l4_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_untunneled_ipv4_dst_addr": { + "path_match": "netflow.ntop_untunneled_ipv4_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_untunneled_l4_dst_port": { + "path_match": "netflow.ntop_untunneled_l4_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_l7_proto": { + "path_match": "netflow.ntop_l7_proto", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_l7_proto_name": { + "path_match": "netflow.ntop_l7_proto_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_downstram_tunnel_id": { + "path_match": "netflow.ntop_downstram_tunnel_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_flow_user": { + "path_match": "netflow.ntop_flow_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_flow_server": { + "path_match": "netflow.ntop_flow_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_client_nw_latency_ms": { + "path_match": "netflow.ntop_client_nw_latency_ms", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_server_nw_latency_ms": { + "path_match": "netflow.ntop_server_nw_latency_ms", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_appl_latency_ms": { + "path_match": "netflow.ntop_appl_latency_ms", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_plugin": { + "path_match": "netflow.ntop_plugin", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_retrans_in_bytes": { + "path_match": "netflow.ntop_retrans_in_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_retrans_out_bytes": { + "path_match": "netflow.ntop_retrans_out_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_call_id": { + "path_match": "netflow.ntop_sip_call_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_sip_calling_party": { + "path_match": "netflow.ntop_sip_calling_party", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_sip_called_party": { + "path_match": "netflow.ntop_sip_called_party", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_sip_rtp_codecs": { + "path_match": "netflow.ntop_sip_rtp_codecs", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_sip_invite_time": { + "path_match": "netflow.ntop_sip_invite_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_trying_time": { + "path_match": "netflow.ntop_sip_trying_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_ringing_time": { + "path_match": "netflow.ntop_sip_ringing_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_ok_time": { + "path_match": "netflow.ntop_sip_ok_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_invite_failure_time": { + "path_match": "netflow.ntop_sip_invite_failure_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_bye_time": { + "path_match": "netflow.ntop_sip_bye_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_bye_ok_time": { + "path_match": "netflow.ntop_sip_bye_ok_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_cancel_time": { + "path_match": "netflow.ntop_sip_cancel_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_cancel_ok_time": { + "path_match": "netflow.ntop_sip_cancel_ok_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_rtp_ipv4_src_addr": { + "path_match": "netflow.ntop_sip_rtp_ipv4_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_sip_rtp_l4_src_port": { + "path_match": "netflow.ntop_sip_rtp_l4_src_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_rtp_ipv4_dst_addr": { + "path_match": "netflow.ntop_sip_rtp_ipv4_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_sip_rtp_l4_dst_port": { + "path_match": "netflow.ntop_sip_rtp_l4_dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_resp_code": { + "path_match": "netflow.ntop_sip_resp_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_sip_reason_cause": { + "path_match": "netflow.ntop_sip_reason_cause", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_first_seq": { + "path_match": "netflow.ntop_rtp_first_seq", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_first_ts": { + "path_match": "netflow.ntop_rtp_first_ts", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_last_seq": { + "path_match": "netflow.ntop_rtp_last_seq", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_last_ts": { + "path_match": "netflow.ntop_rtp_last_ts", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_in_jitter": { + "path_match": "netflow.ntop_rtp_in_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_out_jitter": { + "path_match": "netflow.ntop_rtp_out_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_in_packets_lost": { + "path_match": "netflow.ntop_rtp_in_packets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_out_packets_lost": { + "path_match": "netflow.ntop_rtp_out_packets_lost", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_out_payload_type": { + "path_match": "netflow.ntop_rtp_out_payload_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_in_max_delta": { + "path_match": "netflow.ntop_rtp_in_max_delta", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_out_max_delta": { + "path_match": "netflow.ntop_rtp_out_max_delta", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_in_payload_type": { + "path_match": "netflow.ntop_rtp_in_payload_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_proc_id": { + "path_match": "netflow.ntop_src_proc_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_proc": { + "path_match": "netflow.ntop_src_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_http_url": { + "path_match": "netflow.ntop_http_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_http_ret_code": { + "path_match": "netflow.ntop_http_ret_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_http_referrer": { + "path_match": "netflow.ntop_http_referrer", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_http_user_agent": { + "path_match": "netflow.ntop_http_user_agent", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_http_mime": { + "path_match": "netflow.ntop_http_mime", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_smtp_mail_from": { + "path_match": "netflow.ntop_smtp_mail_from", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_smtp_rcpt_to": { + "path_match": "netflow.ntop_smtp_rcpt_to", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_http_host": { + "path_match": "netflow.ntop_http_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ssl_server": { + "path_match": "netflow.ntop_ssl_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_bittorrent_hash": { + "path_match": "netflow.ntop_bittorrent_hash", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_mysql_server_ver": { + "path_match": "netflow.ntop_mysql_server_ver", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_mysql_user": { + "path_match": "netflow.ntop_mysql_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_mysql_db": { + "path_match": "netflow.ntop_mysql_db", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_mysql_query": { + "path_match": "netflow.ntop_mysql_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_mysql_resp": { + "path_match": "netflow.ntop_mysql_resp", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_oracle_user": { + "path_match": "netflow.ntop_oracle_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_oracle_query": { + "path_match": "netflow.ntop_oracle_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_oracle_resp_code": { + "path_match": "netflow.ntop_oracle_resp_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_oracle_resp_string": { + "path_match": "netflow.ntop_oracle_resp_string", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_oracle_query_duration": { + "path_match": "netflow.ntop_oracle_query_duration", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dns_query": { + "path_match": "netflow.ntop_dns_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dns_query_id": { + "path_match": "netflow.ntop_dns_query_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dns_query_type": { + "path_match": "netflow.ntop_dns_query_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dns_ret_code": { + "path_match": "netflow.ntop_dns_ret_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dns_answers": { + "path_match": "netflow.ntop_dns_answers", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_pop_user": { + "path_match": "netflow.ntop_pop_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv1_req_msg_type": { + "path_match": "netflow.ntop_gtpv1_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_resp_msg_type": { + "path_match": "netflow.ntop_gtpv1_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_c2s_teid_data": { + "path_match": "netflow.ntop_gtpv1_c2s_teid_data", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_c2s_teid_ctrl": { + "path_match": "netflow.ntop_gtpv1_c2s_teid_ctrl", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_s2c_teid_data": { + "path_match": "netflow.ntop_gtpv1_s2c_teid_data", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_s2c_teid_ctrl": { + "path_match": "netflow.ntop_gtpv1_s2c_teid_ctrl", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_end_user_ip": { + "path_match": "netflow.ntop_gtpv1_end_user_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv1_end_user_imsi": { + "path_match": "netflow.ntop_gtpv1_end_user_imsi", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv1_end_user_msisdn": { + "path_match": "netflow.ntop_gtpv1_end_user_msisdn", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv1_end_user_imei": { + "path_match": "netflow.ntop_gtpv1_end_user_imei", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv1_apn": { + "path_match": "netflow.ntop_gtpv1_apn", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv1_rai_mcc": { + "path_match": "netflow.ntop_gtpv1_rai_mcc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_rai_mnc": { + "path_match": "netflow.ntop_gtpv1_rai_mnc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_uli_cell_lac": { + "path_match": "netflow.ntop_gtpv1_uli_cell_lac", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_uli_cell_ci": { + "path_match": "netflow.ntop_gtpv1_uli_cell_ci", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_uli_sac": { + "path_match": "netflow.ntop_gtpv1_uli_sac", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_rai_type": { + "path_match": "netflow.ntop_gtpv1_rai_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_radius_req_msg_type": { + "path_match": "netflow.ntop_radius_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_radius_resp_msg_type": { + "path_match": "netflow.ntop_radius_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_radius_user": { + "path_match": "netflow.ntop_radius_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_radius_calling_station_id": { + "path_match": "netflow.ntop_radius_calling_station_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_radius_called_station_id": { + "path_match": "netflow.ntop_radius_called_station_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_radius_nas_ip": { + "path_match": "netflow.ntop_radius_nas_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_radius_nas_id": { + "path_match": "netflow.ntop_radius_nas_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_radius_user_imsi": { + "path_match": "netflow.ntop_radius_user_imsi", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_radius_user_imei": { + "path_match": "netflow.ntop_radius_user_imei", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_radius_framed_ip": { + "path_match": "netflow.ntop_radius_framed_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_radius_acct_sess_id": { + "path_match": "netflow.ntop_radius_acct_sess_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_radius_acct_status_type": { + "path_match": "netflow.ntop_radius_acct_status_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_radius_acct_in_octets": { + "path_match": "netflow.ntop_radius_acct_in_octets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_radius_acct_out_octets": { + "path_match": "netflow.ntop_radius_acct_out_octets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_radius_acct_in_packets": { + "path_match": "netflow.ntop_radius_acct_in_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_radius_acct_out_packets": { + "path_match": "netflow.ntop_radius_acct_out_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_imap_login": { + "path_match": "netflow.ntop_imap_login", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv2_req_msg_type": { + "path_match": "netflow.ntop_gtpv2_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_resp_msg_type": { + "path_match": "netflow.ntop_gtpv2_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_c2s_s1u_gtpu_teid": { + "path_match": "netflow.ntop_gtpv2_c2s_s1u_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_c2s_s1u_gtpu_ip": { + "path_match": "netflow.ntop_gtpv2_c2s_s1u_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv2_s2c_s1u_gtpu_teid": { + "path_match": "netflow.ntop_gtpv2_s2c_s1u_gtpu_teid", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv2_s2c_s1u_gtpu_ip": { + "path_match": "netflow.ntop_gtpv2_s2c_s1u_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv2_end_user_imsi": { + "path_match": "netflow.ntop_gtpv2_end_user_imsi", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv2_and_user_msisdn": { + "path_match": "netflow.ntop_gtpv2_and_user_msisdn", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv2_apn": { + "path_match": "netflow.ntop_gtpv2_apn", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv2_uli_mcc": { + "path_match": "netflow.ntop_gtpv2_uli_mcc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_uli_mnc": { + "path_match": "netflow.ntop_gtpv2_uli_mnc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_uli_cell_tac": { + "path_match": "netflow.ntop_gtpv2_uli_cell_tac", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_uli_cell_id": { + "path_match": "netflow.ntop_gtpv2_uli_cell_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_rat_type": { + "path_match": "netflow.ntop_gtpv2_rat_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_pdn_ip": { + "path_match": "netflow.ntop_gtpv2_pdn_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv2_end_user_imei": { + "path_match": "netflow.ntop_gtpv2_end_user_imei", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_src_as_path_1": { + "path_match": "netflow.ntop_src_as_path_1", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_2": { + "path_match": "netflow.ntop_src_as_path_2", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_3": { + "path_match": "netflow.ntop_src_as_path_3", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_4": { + "path_match": "netflow.ntop_src_as_path_4", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_5": { + "path_match": "netflow.ntop_src_as_path_5", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_6": { + "path_match": "netflow.ntop_src_as_path_6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_7": { + "path_match": "netflow.ntop_src_as_path_7", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_8": { + "path_match": "netflow.ntop_src_as_path_8", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_9": { + "path_match": "netflow.ntop_src_as_path_9", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_as_path_10": { + "path_match": "netflow.ntop_src_as_path_10", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_1": { + "path_match": "netflow.ntop_dst_as_path_1", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_2": { + "path_match": "netflow.ntop_dst_as_path_2", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_3": { + "path_match": "netflow.ntop_dst_as_path_3", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_4": { + "path_match": "netflow.ntop_dst_as_path_4", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_5": { + "path_match": "netflow.ntop_dst_as_path_5", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_6": { + "path_match": "netflow.ntop_dst_as_path_6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_7": { + "path_match": "netflow.ntop_dst_as_path_7", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_8": { + "path_match": "netflow.ntop_dst_as_path_8", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_9": { + "path_match": "netflow.ntop_dst_as_path_9", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_as_path_10": { + "path_match": "netflow.ntop_dst_as_path_10", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_mysql_appl_latency_usec": { + "path_match": "netflow.ntop_mysql_appl_latency_usec", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv0_req_msg_type": { + "path_match": "netflow.ntop_gtpv0_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv0_resp_msg_type": { + "path_match": "netflow.ntop_gtpv0_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv0_tid": { + "path_match": "netflow.ntop_gtpv0_tid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv0_end_user_ip": { + "path_match": "netflow.ntop_gtpv0_end_user_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv0_end_user_msisdn": { + "path_match": "netflow.ntop_gtpv0_end_user_msisdn", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv0_apn": { + "path_match": "netflow.ntop_gtpv0_apn", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_gtpv0_rai_mcc": { + "path_match": "netflow.ntop_gtpv0_rai_mcc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv0_rai_mnc": { + "path_match": "netflow.ntop_gtpv0_rai_mnc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv0_rai_cell_lac": { + "path_match": "netflow.ntop_gtpv0_rai_cell_lac", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv0_rai_cell_rac": { + "path_match": "netflow.ntop_gtpv0_rai_cell_rac", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv0_resp_cause": { + "path_match": "netflow.ntop_gtpv0_resp_cause", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_resp_cause": { + "path_match": "netflow.ntop_gtpv1_resp_cause", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_resp_cause": { + "path_match": "netflow.ntop_gtpv2_resp_cause", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_5_32": { + "path_match": "netflow.ntop_packets_ttl_5_32", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_32_64": { + "path_match": "netflow.ntop_packets_ttl_32_64", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_64_96": { + "path_match": "netflow.ntop_packets_ttl_64_96", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_96_128": { + "path_match": "netflow.ntop_packets_ttl_96_128", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_128_160": { + "path_match": "netflow.ntop_packets_ttl_128_160", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_160_192": { + "path_match": "netflow.ntop_packets_ttl_160_192", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_192_224": { + "path_match": "netflow.ntop_packets_ttl_192_224", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_224_225": { + "path_match": "netflow.ntop_packets_ttl_224_225", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_rai_lac": { + "path_match": "netflow.ntop_gtpv1_rai_lac", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_rai_rac": { + "path_match": "netflow.ntop_gtpv1_rai_rac", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_uli_mcc": { + "path_match": "netflow.ntop_gtpv1_uli_mcc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv1_uli_mnc": { + "path_match": "netflow.ntop_gtpv1_uli_mnc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_2_5": { + "path_match": "netflow.ntop_packets_ttl_2_5", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_packets_ttl_eq_1": { + "path_match": "netflow.ntop_packets_ttl_eq_1", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_sip_call_id": { + "path_match": "netflow.ntop_rtp_sip_call_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_in_src_osi_sap": { + "path_match": "netflow.ntop_in_src_osi_sap", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_out_dst_osi_sap": { + "path_match": "netflow.ntop_out_dst_osi_sap", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_whois_das_domain": { + "path_match": "netflow.ntop_whois_das_domain", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dns_ttl_answer": { + "path_match": "netflow.ntop_dns_ttl_answer", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dhcp_client_mac": { + "path_match": "netflow.ntop_dhcp_client_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dhcp_client_ip": { + "path_match": "netflow.ntop_dhcp_client_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_dhcp_client": { + "path_match": "netflow.ntop_dhcp_client", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ftp_login": { + "path_match": "netflow.ntop_ftp_login", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ftp_password": { + "path_match": "netflow.ntop_ftp_password", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ftp_command": { + "path_match": "netflow.ntop_ftp_command", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ftp_command_ret_code": { + "path_match": "netflow.ntop_ftp_command_ret_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_http_method": { + "path_match": "netflow.ntop_http_method", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_http_site": { + "path_match": "netflow.ntop_http_site", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_sip_c_ip": { + "path_match": "netflow.ntop_sip_c_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_sip_call_state": { + "path_match": "netflow.ntop_sip_call_state", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_rtp_in_mos": { + "path_match": "netflow.ntop_rtp_in_mos", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_in_r_factor": { + "path_match": "netflow.ntop_rtp_in_r_factor", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_proc_user": { + "path_match": "netflow.ntop_src_proc_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_src_father_proc_pid": { + "path_match": "netflow.ntop_src_father_proc_pid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_father_proc": { + "path_match": "netflow.ntop_src_father_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dst_proc_pid": { + "path_match": "netflow.ntop_dst_proc_pid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_proc": { + "path_match": "netflow.ntop_dst_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dst_proc_user": { + "path_match": "netflow.ntop_dst_proc_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dst_father_proc_pid": { + "path_match": "netflow.ntop_dst_father_proc_pid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_father_proc": { + "path_match": "netflow.ntop_dst_father_proc", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_rtp_rtt": { + "path_match": "netflow.ntop_rtp_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_in_transit": { + "path_match": "netflow.ntop_rtp_in_transit", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_out_transit": { + "path_match": "netflow.ntop_rtp_out_transit", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_proc_actual_memory": { + "path_match": "netflow.ntop_src_proc_actual_memory", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_proc_peak_memory": { + "path_match": "netflow.ntop_src_proc_peak_memory", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_proc_avg_cpu_load": { + "path_match": "netflow.ntop_src_proc_avg_cpu_load", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_proc_page_faults": { + "path_match": "netflow.ntop_src_proc_page_faults", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_proc_actual_memory": { + "path_match": "netflow.ntop_dst_proc_actual_memory", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_proc_peak_memory": { + "path_match": "netflow.ntop_dst_proc_peak_memory", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_proc_avg_cpu_load": { + "path_match": "netflow.ntop_dst_proc_avg_cpu_load", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_proc_page_faults": { + "path_match": "netflow.ntop_dst_proc_page_faults", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_duration_in": { + "path_match": "netflow.ntop_duration_in", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_duration_out": { + "path_match": "netflow.ntop_duration_out", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_proc_pctg_iowait": { + "path_match": "netflow.ntop_src_proc_pctg_iowait", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_proc_pctg_iowait": { + "path_match": "netflow.ntop_dst_proc_pctg_iowait", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_dtmf_tones": { + "path_match": "netflow.ntop_rtp_dtmf_tones", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_untunneled_ipv6_src_addr": { + "path_match": "netflow.ntop_untunneled_ipv6_src_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_untunneled_ipv6_dst_addr": { + "path_match": "netflow.ntop_untunneled_ipv6_dst_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_dns_resp": { + "path_match": "netflow.ntop_dns_resp", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_diameter_req_msg_type": { + "path_match": "netflow.ntop_diameter_req_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_diameter_resp_msg_type": { + "path_match": "netflow.ntop_diameter_resp_msg_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_diameter_req_origin_host": { + "path_match": "netflow.ntop_diameter_req_origin_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_diameter_resp_origin_host": { + "path_match": "netflow.ntop_diameter_resp_origin_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_diameter_req_user": { + "path_match": "netflow.ntop_diameter_req_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_diameter_resp_result_code": { + "path_match": "netflow.ntop_diameter_resp_result_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_diameter_exp_res_vendor_id": { + "path_match": "netflow.ntop_diameter_exp_res_vendor_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_diameter_exp_res_result_code": { + "path_match": "netflow.ntop_diameter_exp_res_result_code", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_s1ap_enb_ue_s1ap_id": { + "path_match": "netflow.ntop_s1ap_enb_ue_s1ap_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_s1ap_mme_ue_s1ap_id": { + "path_match": "netflow.ntop_s1ap_mme_ue_s1ap_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_s1ap_msg_emm_type_mme_to_enb": { + "path_match": "netflow.ntop_s1ap_msg_emm_type_mme_to_enb", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_s1ap_msg_esm_type_mme_to_enb": { + "path_match": "netflow.ntop_s1ap_msg_esm_type_mme_to_enb", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_s1ap_msg_emm_type_enb_to_mme": { + "path_match": "netflow.ntop_s1ap_msg_emm_type_enb_to_mme", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_s1ap_msg_esm_type_enb_to_mme": { + "path_match": "netflow.ntop_s1ap_msg_esm_type_enb_to_mme", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_s1ap_cause_enb_to_mme": { + "path_match": "netflow.ntop_s1ap_cause_enb_to_mme", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_s1ap_detailed_cause_enb_to_mme": { + "path_match": "netflow.ntop_s1ap_detailed_cause_enb_to_mme", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tcp_win_min_in": { + "path_match": "netflow.ntop_tcp_win_min_in", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tcp_win_max_in": { + "path_match": "netflow.ntop_tcp_win_max_in", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tcp_win_mss_in": { + "path_match": "netflow.ntop_tcp_win_mss_in", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tcp_win_scale_in": { + "path_match": "netflow.ntop_tcp_win_scale_in", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tcp_win_min_out": { + "path_match": "netflow.ntop_tcp_win_min_out", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tcp_win_max_out": { + "path_match": "netflow.ntop_tcp_win_max_out", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tcp_win_mss_out": { + "path_match": "netflow.ntop_tcp_win_mss_out", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_tcp_win_scale_out": { + "path_match": "netflow.ntop_tcp_win_scale_out", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dhcp_remote_id": { + "path_match": "netflow.ntop_dhcp_remote_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dhcp_subscriber_id": { + "path_match": "netflow.ntop_dhcp_subscriber_id", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_src_proc_uid": { + "path_match": "netflow.ntop_src_proc_uid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_dst_proc_uid": { + "path_match": "netflow.ntop_dst_proc_uid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_application": { + "path_match": "netflow.ntop_application", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_user": { + "path_match": "netflow.ntop_user", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dhcp_message_type": { + "path_match": "netflow.ntop_dhcp_message_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_rtp_in_packets_drop": { + "path_match": "netflow.ntop_rtp_in_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_out_packets_drop": { + "path_match": "netflow.ntop_rtp_out_packets_drop", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_out_mos": { + "path_match": "netflow.ntop_rtp_out_mos", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_out_r_factor": { + "path_match": "netflow.ntop_rtp_out_r_factor", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_mos": { + "path_match": "netflow.ntop_rtp_mos", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gptv2_s5_s8_gtpc_teid": { + "path_match": "netflow.ntop_gptv2_s5_s8_gtpc_teid", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_rtp_r_factor": { + "path_match": "netflow.ntop_rtp_r_factor", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_rtp_ssrc": { + "path_match": "netflow.ntop_rtp_ssrc", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_payload_hash": { + "path_match": "netflow.ntop_payload_hash", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_c2s_s5_s8_gtpu_teid": { + "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_s2c_s5_s8_gtpu_teid": { + "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_c2s_s5_s8_gtpu_ip": { + "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv2_s2c_s5_s8_gtpu_ip": { + "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_src_as_map": { + "path_match": "netflow.ntop_src_as_map", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_dst_as_map": { + "path_match": "netflow.ntop_dst_as_map", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_diameter_hop_by_hop_id": { + "path_match": "netflow.ntop_diameter_hop_by_hop_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_upstream_sess_id": { + "path_match": "netflow.ntop_upstream_sess_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_downstream_sess_id": { + "path_match": "netflow.ntop_downstream_sess_id", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_src_long": { + "path_match": "netflow.ntop_src_long", + "mapping": { + "type": "float" + } + } + }, + { + "netflow.ntop_src_lat": { + "path_match": "netflow.ntop_src_lat", + "mapping": { + "type": "float" + } + } + }, + { + "netflow.ntop_dst_long": { + "path_match": "netflow.ntop_dst_long", + "mapping": { + "type": "float" + } + } + }, + { + "netflow.ntop_dst_lat": { + "path_match": "netflow.ntop_dst_lat", + "mapping": { + "type": "float" + } + } + }, + { + "netflow.ntop_diameter_clr_cancel_type": { + "path_match": "netflow.ntop_diameter_clr_cancel_type", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_diameter_clr_flags": { + "path_match": "netflow.ntop_diameter_clr_flags", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_c2s_s5_s8_gtpc_ip": { + "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_gtpc_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv2_s2c_s5_s8_gtpc_ip": { + "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_gtpc_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid": { + "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid": { + "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip": { + "path_match": "netflow.ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip": { + "path_match": "netflow.ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.ntop_http_x_forwarded_for": { + "path_match": "netflow.ntop_http_x_forwarded_for", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_http_via": { + "path_match": "netflow.ntop_http_via", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ssdp_host": { + "path_match": "netflow.ntop_ssdp_host", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ssdp_usn": { + "path_match": "netflow.ntop_ssdp_usn", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_netbios_query": { + "path_match": "netflow.ntop_netbios_query", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_netbios_query_type": { + "path_match": "netflow.ntop_netbios_query_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_netbios_resp": { + "path_match": "netflow.ntop_netbios_resp", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_netbios_query_os": { + "path_match": "netflow.ntop_netbios_query_os", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ssdp_server": { + "path_match": "netflow.ntop_ssdp_server", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ssdp_type": { + "path_match": "netflow.ntop_ssdp_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_ssdp_method": { + "path_match": "netflow.ntop_ssdp_method", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.ntop_nprobe_ipv4_addr": { + "path_match": "netflow.ntop_nprobe_ipv4_addr", + "mapping": { + "type": "ip" + } + } + }, - { - "netflow.pan_app": { - "path_match": "netflow.pan_app", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.pan_user": { - "path_match": "netflow.pan_user", - "mapping": { - "type": "keyword" - } - } - }, + { + "netflow.pan_app": { + "path_match": "netflow.pan_app", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.pan_user": { + "path_match": "netflow.pan_user", + "mapping": { + "type": "keyword" + } + } + }, - { - "netflow.riverbed_passthru_reason": { - "path_match": "netflow.riverbed_passthru_reason", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.riverbed_wan_visibility": { - "path_match": "netflow.riverbed_wan_visibility", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.riverbed_cfe_inpath_addr": { - "path_match": "netflow.riverbed_cfe_inpath_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.riverbed_sfe_inpath_addr": { - "path_match": "netflow.riverbed_sfe_inpath_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.riverbed_cfe_tcp_port": { - "path_match": "netflow.riverbed_cfe_tcp_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.riverbed_cfe_tcp_port_name": { - "path_match": "netflow.riverbed_cfe_tcp_port_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.riverbed_sfe_tcp_port": { - "path_match": "netflow.riverbed_sfe_tcp_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.riverbed_sfe_tcp_port_name": { - "path_match": "netflow.riverbed_sfe_tcp_port_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.riverbed_outer_inpath_addr": { - "path_match": "netflow.riverbed_outer_inpath_addr", - "mapping": { - "type": "ip" - } - } - }, - { - "netflow.riverbed_outer_tcp_port": { - "path_match": "netflow.riverbed_outer_tcp_port", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.riverbed_outer_tcp_port_name": { - "path_match": "netflow.riverbed_outer_tcp_port_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.riverbed_retrans_packets": { - "path_match": "netflow.riverbed_retrans_packets", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.riverbed_retrans_bytes": { - "path_match": "netflow.riverbed_retrans_bytes", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.riverbed_tcp_conn_rtt": { - "path_match": "netflow.riverbed_tcp_conn_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.riverbed_fe_type": { - "path_match": "netflow.riverbed_fe_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.riverbed_unk_51130": { - "path_match": "netflow.riverbed_unk_51130", - "mapping": { - "type": "long" - } - } - }, + { + "netflow.riverbed_passthru_reason": { + "path_match": "netflow.riverbed_passthru_reason", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.riverbed_wan_visibility": { + "path_match": "netflow.riverbed_wan_visibility", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.riverbed_cfe_inpath_addr": { + "path_match": "netflow.riverbed_cfe_inpath_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.riverbed_sfe_inpath_addr": { + "path_match": "netflow.riverbed_sfe_inpath_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.riverbed_cfe_tcp_port": { + "path_match": "netflow.riverbed_cfe_tcp_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.riverbed_cfe_tcp_port_name": { + "path_match": "netflow.riverbed_cfe_tcp_port_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.riverbed_sfe_tcp_port": { + "path_match": "netflow.riverbed_sfe_tcp_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.riverbed_sfe_tcp_port_name": { + "path_match": "netflow.riverbed_sfe_tcp_port_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.riverbed_outer_inpath_addr": { + "path_match": "netflow.riverbed_outer_inpath_addr", + "mapping": { + "type": "ip" + } + } + }, + { + "netflow.riverbed_outer_tcp_port": { + "path_match": "netflow.riverbed_outer_tcp_port", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.riverbed_outer_tcp_port_name": { + "path_match": "netflow.riverbed_outer_tcp_port_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.riverbed_retrans_packets": { + "path_match": "netflow.riverbed_retrans_packets", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.riverbed_retrans_bytes": { + "path_match": "netflow.riverbed_retrans_bytes", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.riverbed_tcp_conn_rtt": { + "path_match": "netflow.riverbed_tcp_conn_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.riverbed_fe_type": { + "path_match": "netflow.riverbed_fe_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.riverbed_unk_51130": { + "path_match": "netflow.riverbed_unk_51130", + "mapping": { + "type": "long" + } + } + }, - { - "netflow.streamcore_wan_rtt": { - "path_match": "netflow.streamcore_wan_rtt", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_net_app_resp_time": { - "path_match": "netflow.streamcore_net_app_resp_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_total_app_resp_time": { - "path_match": "netflow.streamcore_total_app_resp_time", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_tcp_retrans_rate": { - "path_match": "netflow.streamcore_tcp_retrans_rate", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_call_direction": { - "path_match": "netflow.streamcore_call_direction", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_hostname": { - "path_match": "netflow.streamcore_hostname", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.streamcore_url": { - "path_match": "netflow.streamcore_url", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.streamcore_ssl_cn": { - "path_match": "netflow.streamcore_ssl_cn", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.streamcore_ssl_org": { - "path_match": "netflow.streamcore_ssl_org", - "mapping": { - "type": "keyword" - } - } - }, - { - "netflow.streamcore_mos_lq": { - "path_match": "netflow.streamcore_mos_lq", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_net_delay": { - "path_match": "netflow.streamcore_net_delay", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_net_loss": { - "path_match": "netflow.streamcore_net_loss", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_net_jitter": { - "path_match": "netflow.streamcore_net_jitter", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_net_discard": { - "path_match": "netflow.streamcore_net_discard", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_rtp_clockrate_in": { - "path_match": "netflow.streamcore_rtp_clockrate_in", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_rtp_clockrate_out": { - "path_match": "netflow.streamcore_rtp_clockrate_out", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_codec_in": { - "path_match": "netflow.streamcore_codec_in", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_codec_out": { - "path_match": "netflow.streamcore_codec_out", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_1": { - "path_match": "netflow.streamcore_id_rule_1", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_2": { - "path_match": "netflow.streamcore_id_rule_2", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_3": { - "path_match": "netflow.streamcore_id_rule_3", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_4": { - "path_match": "netflow.streamcore_id_rule_4", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_5": { - "path_match": "netflow.streamcore_id_rule_5", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_6": { - "path_match": "netflow.streamcore_id_rule_6", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_7": { - "path_match": "netflow.streamcore_id_rule_7", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_8": { - "path_match": "netflow.streamcore_id_rule_8", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_9": { - "path_match": "netflow.streamcore_id_rule_9", - "mapping": { - "type": "long" - } - } - }, - { - "netflow.streamcore_id_rule_10": { - "path_match": "netflow.streamcore_id_rule_10", - "mapping": { - "type": "long" - } - } - }, - + { + "netflow.streamcore_wan_rtt": { + "path_match": "netflow.streamcore_wan_rtt", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_net_app_resp_time": { + "path_match": "netflow.streamcore_net_app_resp_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_total_app_resp_time": { + "path_match": "netflow.streamcore_total_app_resp_time", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_tcp_retrans_rate": { + "path_match": "netflow.streamcore_tcp_retrans_rate", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_call_direction": { + "path_match": "netflow.streamcore_call_direction", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_hostname": { + "path_match": "netflow.streamcore_hostname", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.streamcore_url": { + "path_match": "netflow.streamcore_url", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.streamcore_ssl_cn": { + "path_match": "netflow.streamcore_ssl_cn", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.streamcore_ssl_org": { + "path_match": "netflow.streamcore_ssl_org", + "mapping": { + "type": "keyword" + } + } + }, + { + "netflow.streamcore_mos_lq": { + "path_match": "netflow.streamcore_mos_lq", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_net_delay": { + "path_match": "netflow.streamcore_net_delay", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_net_loss": { + "path_match": "netflow.streamcore_net_loss", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_net_jitter": { + "path_match": "netflow.streamcore_net_jitter", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_net_discard": { + "path_match": "netflow.streamcore_net_discard", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_rtp_clockrate_in": { + "path_match": "netflow.streamcore_rtp_clockrate_in", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_rtp_clockrate_out": { + "path_match": "netflow.streamcore_rtp_clockrate_out", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_codec_in": { + "path_match": "netflow.streamcore_codec_in", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_codec_out": { + "path_match": "netflow.streamcore_codec_out", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_1": { + "path_match": "netflow.streamcore_id_rule_1", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_2": { + "path_match": "netflow.streamcore_id_rule_2", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_3": { + "path_match": "netflow.streamcore_id_rule_3", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_4": { + "path_match": "netflow.streamcore_id_rule_4", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_5": { + "path_match": "netflow.streamcore_id_rule_5", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_6": { + "path_match": "netflow.streamcore_id_rule_6", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_7": { + "path_match": "netflow.streamcore_id_rule_7", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_8": { + "path_match": "netflow.streamcore_id_rule_8", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_9": { + "path_match": "netflow.streamcore_id_rule_9", + "mapping": { + "type": "long" + } + } + }, + { + "netflow.streamcore_id_rule_10": { + "path_match": "netflow.streamcore_id_rule_10", + "mapping": { + "type": "long" + } + } + }, + - { - "sflow.agent_ip": { - "path_match": "sflow.agent_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "sflow.drops": { - "path_match": "sflow.drops", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.dst_ip": { - "path_match": "sflow.dst_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "sflow.dst_mac": { - "path_match": "sflow.dst_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.dst_mask_len": { - "path_match": "sflow.dst_mask_len", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.dst_port": { - "path_match": "sflow.dst_port", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.dst_priority": { - "path_match": "sflow.dst_priority", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.dst_vlan": { - "path_match": "sflow.dst_vlan", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.eth_dst": { - "path_match": "sflow.eth_dst", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.eth_src": { - "path_match": "sflow.eth_src", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.eth_type": { - "path_match": "sflow.eth_type", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.flow_sequence_number": { - "path_match": "sflow.flow_sequence_number", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.frame_length": { - "path_match": "sflow.frame_length", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.frame_length_times_sampling_rate": { - "path_match": "sflow.frame_length_times_sampling_rate", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.header_size": { - "path_match": "sflow.header_size", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.input_interface": { - "path_match": "sflow.input_interface", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.input_interface_format": { - "path_match": "sflow.input_interface_format", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.input_interface_value": { - "path_match": "sflow.input_interface_value", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_address_next_hop_router": { - "path_match": "sflow.ip_address_next_hop_router", - "mapping": { - "type": "ip" - } - } - }, - { - "sflow.ip_checksum": { - "path_match": "sflow.ip_checksum", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_dscp": { - "path_match": "sflow.ip_dscp", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_ecn": { - "path_match": "sflow.ip_ecn", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_flags": { - "path_match": "sflow.ip_flags", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_fragment_offset": { - "path_match": "sflow.ip_fragment_offset", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_header_length": { - "path_match": "sflow.ip_header_length", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_identification": { - "path_match": "sflow.ip_identification", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_next_header": { - "path_match": "sflow.ip_next_header", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_options": { - "path_match": "sflow.ip_options", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_packet_length": { - "path_match": "sflow.ip_packet_length", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_priority": { - "path_match": "sflow.ip_priority", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_protocol": { - "path_match": "sflow.ip_protocol", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_total_length": { - "path_match": "sflow.ip_total_length", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_ttl": { - "path_match": "sflow.ip_ttl", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_type": { - "path_match": "sflow.ip_type", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.ip_version": { - "path_match": "sflow.ip_version", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.output_interface": { - "path_match": "sflow.output_interface", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.output_interface_format": { - "path_match": "sflow.output_interface_format", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.output_interface_value": { - "path_match": "sflow.output_interface_value", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.packet_length": { - "path_match": "sflow.packet_length", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.padded": { - "path_match": "sflow.padded", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.protocol": { - "path_match": "sflow.protocol", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.protocol_name": { - "path_match": "sflow.protocol_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.sample_length": { - "path_match": "sflow.sample_length", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.sample_pool": { - "path_match": "sflow.sample_pool", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.sample_seq_number": { - "path_match": "sflow.sample_seq_number", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.sampling_rate": { - "path_match": "sflow.sampling_rate", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.sequence_number": { - "path_match": "sflow.sequence_number", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.sflow_type": { - "path_match": "sflow.sflow_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.sflow_version": { - "path_match": "sflow.sflow_version", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.size_header": { - "path_match": "sflow.size_header", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.source_id_index": { - "path_match": "sflow.source_id_index", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.source_id_index_name": { - "path_match": "sflow.source_id_index_name", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.source_id_type": { - "path_match": "sflow.source_id_type", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.src_ip": { - "path_match": "sflow.src_ip", - "mapping": { - "type": "ip" - } - } - }, - { - "sflow.src_mac": { - "path_match": "sflow.src_mac", - "mapping": { - "type": "keyword" - } - } - }, - { - "sflow.src_mask_len": { - "path_match": "sflow.src_mask_len", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.src_port": { - "path_match": "sflow.src_port", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.src_priority": { - "path_match": "sflow.src_priority", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.src_vlan": { - "path_match": "sflow.src_vlan", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.stripped": { - "path_match": "sflow.stripped", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.sub_agent_id": { - "path_match": "sflow.sub_agent_id", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_ack_number": { - "path_match": "sflow.tcp_ack_number", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_checksum": { - "path_match": "sflow.tcp_checksum", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_flags": { - "path_match": "sflow.tcp_flags", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_header_length": { - "path_match": "sflow.tcp_header_length", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_is_ack": { - "path_match": "sflow.tcp_is_ack", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_is_cwr": { - "path_match": "sflow.tcp_is_cwr", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_is_ecn_echo": { - "path_match": "sflow.tcp_is_ecn_echo", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_is_fin": { - "path_match": "sflow.tcp_is_fin", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_is_nonce": { - "path_match": "sflow.tcp_is_nonce", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_is_push": { - "path_match": "sflow.tcp_is_push", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_is_reset": { - "path_match": "sflow.tcp_is_reset", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_is_syn": { - "path_match": "sflow.tcp_is_syn", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_is_urgent": { - "path_match": "sflow.tcp_is_urgent", - "mapping": { - "type": "integer" - } - } - }, - { - "sflow.tcp_options": { - "path_match": "sflow.tcp_options", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_reserved": { - "path_match": "sflow.tcp_reserved", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_seq_number": { - "path_match": "sflow.tcp_seq_number", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_urgent_pointer": { - "path_match": "sflow.tcp_urgent_pointer", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.tcp_window_size": { - "path_match": "sflow.tcp_window_size", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.udp_checksum": { - "path_match": "sflow.udp_checksum", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.udp_length": { - "path_match": "sflow.udp_length", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.uptime_in_ms": { - "path_match": "sflow.uptime_in_ms", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.vlan_cfi": { - "path_match": "sflow.vlan_cfi", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.vlan_id": { - "path_match": "sflow.vlan_id", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.vlan_priority": { - "path_match": "sflow.vlan_priority", - "mapping": { - "type": "long" - } - } - }, - { - "sflow.vlan_type": { - "path_match": "sflow.vlan_type", - "mapping": { - "type": "long" - } - } - }, + { + "sflow.agent_ip": { + "path_match": "sflow.agent_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "sflow.drops": { + "path_match": "sflow.drops", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.dst_ip": { + "path_match": "sflow.dst_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "sflow.dst_mac": { + "path_match": "sflow.dst_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.dst_mask_len": { + "path_match": "sflow.dst_mask_len", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.dst_port": { + "path_match": "sflow.dst_port", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.dst_priority": { + "path_match": "sflow.dst_priority", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.dst_vlan": { + "path_match": "sflow.dst_vlan", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.eth_dst": { + "path_match": "sflow.eth_dst", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.eth_src": { + "path_match": "sflow.eth_src", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.eth_type": { + "path_match": "sflow.eth_type", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.flow_sequence_number": { + "path_match": "sflow.flow_sequence_number", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.frame_length": { + "path_match": "sflow.frame_length", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.frame_length_times_sampling_rate": { + "path_match": "sflow.frame_length_times_sampling_rate", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.header_size": { + "path_match": "sflow.header_size", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.input_interface": { + "path_match": "sflow.input_interface", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.input_interface_format": { + "path_match": "sflow.input_interface_format", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.input_interface_value": { + "path_match": "sflow.input_interface_value", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_address_next_hop_router": { + "path_match": "sflow.ip_address_next_hop_router", + "mapping": { + "type": "ip" + } + } + }, + { + "sflow.ip_checksum": { + "path_match": "sflow.ip_checksum", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_dscp": { + "path_match": "sflow.ip_dscp", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_ecn": { + "path_match": "sflow.ip_ecn", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_flags": { + "path_match": "sflow.ip_flags", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_fragment_offset": { + "path_match": "sflow.ip_fragment_offset", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_header_length": { + "path_match": "sflow.ip_header_length", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_identification": { + "path_match": "sflow.ip_identification", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_next_header": { + "path_match": "sflow.ip_next_header", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_options": { + "path_match": "sflow.ip_options", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_packet_length": { + "path_match": "sflow.ip_packet_length", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_priority": { + "path_match": "sflow.ip_priority", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_protocol": { + "path_match": "sflow.ip_protocol", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_total_length": { + "path_match": "sflow.ip_total_length", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_ttl": { + "path_match": "sflow.ip_ttl", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_type": { + "path_match": "sflow.ip_type", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.ip_version": { + "path_match": "sflow.ip_version", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.output_interface": { + "path_match": "sflow.output_interface", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.output_interface_format": { + "path_match": "sflow.output_interface_format", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.output_interface_value": { + "path_match": "sflow.output_interface_value", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.packet_length": { + "path_match": "sflow.packet_length", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.padded": { + "path_match": "sflow.padded", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.protocol": { + "path_match": "sflow.protocol", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.protocol_name": { + "path_match": "sflow.protocol_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.sample_length": { + "path_match": "sflow.sample_length", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.sample_pool": { + "path_match": "sflow.sample_pool", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.sample_seq_number": { + "path_match": "sflow.sample_seq_number", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.sampling_rate": { + "path_match": "sflow.sampling_rate", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.sequence_number": { + "path_match": "sflow.sequence_number", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.sflow_type": { + "path_match": "sflow.sflow_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.sflow_version": { + "path_match": "sflow.sflow_version", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.size_header": { + "path_match": "sflow.size_header", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.source_id_index": { + "path_match": "sflow.source_id_index", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.source_id_index_name": { + "path_match": "sflow.source_id_index_name", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.source_id_type": { + "path_match": "sflow.source_id_type", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.src_ip": { + "path_match": "sflow.src_ip", + "mapping": { + "type": "ip" + } + } + }, + { + "sflow.src_mac": { + "path_match": "sflow.src_mac", + "mapping": { + "type": "keyword" + } + } + }, + { + "sflow.src_mask_len": { + "path_match": "sflow.src_mask_len", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.src_port": { + "path_match": "sflow.src_port", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.src_priority": { + "path_match": "sflow.src_priority", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.src_vlan": { + "path_match": "sflow.src_vlan", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.stripped": { + "path_match": "sflow.stripped", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.sub_agent_id": { + "path_match": "sflow.sub_agent_id", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_ack_number": { + "path_match": "sflow.tcp_ack_number", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_checksum": { + "path_match": "sflow.tcp_checksum", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_flags": { + "path_match": "sflow.tcp_flags", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_header_length": { + "path_match": "sflow.tcp_header_length", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_is_ack": { + "path_match": "sflow.tcp_is_ack", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_is_cwr": { + "path_match": "sflow.tcp_is_cwr", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_is_ecn_echo": { + "path_match": "sflow.tcp_is_ecn_echo", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_is_fin": { + "path_match": "sflow.tcp_is_fin", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_is_nonce": { + "path_match": "sflow.tcp_is_nonce", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_is_push": { + "path_match": "sflow.tcp_is_push", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_is_reset": { + "path_match": "sflow.tcp_is_reset", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_is_syn": { + "path_match": "sflow.tcp_is_syn", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_is_urgent": { + "path_match": "sflow.tcp_is_urgent", + "mapping": { + "type": "integer" + } + } + }, + { + "sflow.tcp_options": { + "path_match": "sflow.tcp_options", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_reserved": { + "path_match": "sflow.tcp_reserved", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_seq_number": { + "path_match": "sflow.tcp_seq_number", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_urgent_pointer": { + "path_match": "sflow.tcp_urgent_pointer", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.tcp_window_size": { + "path_match": "sflow.tcp_window_size", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.udp_checksum": { + "path_match": "sflow.udp_checksum", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.udp_length": { + "path_match": "sflow.udp_length", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.uptime_in_ms": { + "path_match": "sflow.uptime_in_ms", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.vlan_cfi": { + "path_match": "sflow.vlan_cfi", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.vlan_id": { + "path_match": "sflow.vlan_id", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.vlan_priority": { + "path_match": "sflow.vlan_priority", + "mapping": { + "type": "long" + } + } + }, + { + "sflow.vlan_type": { + "path_match": "sflow.vlan_type", + "mapping": { + "type": "long" + } + } + }, - { - "string_fields": { - "mapping": { - "type": "keyword" - }, - "match_mapping_type": "string", - "match": "*" - } - } - ], - "properties": { - "@timestamp": { - "type": "date" - }, - "@version": { - "type": "keyword" - }, - "event": { - "dynamic": true, - "type": "object", - "properties": { - "host": { - "type": "keyword" - }, - "type": { - "type": "keyword" - } - } - }, - "flow": { - "dynamic": true, - "type": "object", - "properties": { - "application": { - "type": "keyword" - }, - "autonomous_system": { - "type": "keyword" - }, - "bgp_next_hop": { - "type": "ip" - }, - "bgp_valid_state": { - "type": "long" - }, - "bytes": { - "type": "long" - }, - "city": { - "type": "keyword" - }, - "client_addr": { - "type": "ip" - }, - "client_asn": { - "type": "long" - }, - "client_autonomous_system": { - "type": "keyword" - }, - "client_city": { - "type": "keyword" - }, - "client_country": { - "type": "keyword" - }, - "client_country_code": { - "type": "keyword" - }, - "client_geo_location": { - "type": "geo_point" - }, - "client_hostname": { - "type": "keyword" - }, - "client_rep_tags": { - "type": "keyword" - }, - "country": { - "type": "keyword" - }, - "country_code": { - "type": "keyword" - }, - "direction": { - "type": "keyword" - }, - "dst_addr": { - "type": "ip" - }, - "dst_addr_trans": { - "type": "ip" - }, - "dst_asn": { - "type": "long" - }, - "dst_autonomous_system": { - "type": "keyword" - }, - "dst_city": { - "type": "keyword" - }, - "dst_country": { - "type": "keyword" - }, - "dst_country_code": { - "type": "keyword" - }, - "dst_geo_location": { - "type": "geo_point" - }, - "dst_hostname": { - "type": "keyword" - }, - "dst_mac": { - "type": "keyword" - }, - "dst_mask_len": { - "type": "long" - }, - "dst_port": { - "type": "long" - }, - "dst_port_trans": { - "type": "long" - }, - "dst_port_name": { - "type": "keyword" - }, - "dst_rep_tags": { - "type": "keyword" - }, - "input_ifname": { - "type": "keyword" - }, - "input_snmp": { - "type": "keyword" - }, - "ip_protocol": { - "type": "keyword" - }, - "ip_version": { - "type": "keyword" - }, - "next_hop": { - "type": "ip" - }, - "output_ifname": { - "type": "keyword" - }, - "output_snmp": { - "type": "keyword" - }, - "packets": { - "type": "long" - }, - "rep_tags": { - "type": "keyword" - }, - "sampling_interval": { - "type": "long" - }, - "server_addr": { - "type": "ip" - }, - "server_asn": { - "type": "long" - }, - "server_autonomous_system": { - "type": "keyword" - }, - "server_city": { - "type": "keyword" - }, - "server_country": { - "type": "keyword" - }, - "server_country_code": { - "type": "keyword" - }, - "server_geo_location": { - "type": "geo_point" - }, - "server_hostname": { - "type": "keyword" - }, - "server_rep_tags": { - "type": "keyword" - }, - "service_name": { - "type": "keyword" - }, - "service_port": { - "type": "long" - }, - "src_addr": { - "type": "ip" - }, - "src_addr_trans": { - "type": "ip" - }, - "src_asn": { - "type": "long" - }, - "src_autonomous_system": { - "type": "keyword" - }, - "src_city": { - "type": "keyword" - }, - "src_country": { - "type": "keyword" - }, - "src_country_code": { - "type": "keyword" - }, - "src_geo_location": { - "type": "geo_point" - }, - "src_hostname": { - "type": "keyword" - }, - "src_mac": { - "type": "keyword" - }, - "src_mask_len": { - "type": "long" - }, - "src_port": { - "type": "long" - }, - "src_port_trans": { - "type": "long" - }, - "src_port_name": { - "type": "keyword" - }, - "src_rep_tags": { - "type": "keyword" - }, - "tcp_flags": { - "type": "keyword" - }, - "tos": { - "type": "long" - }, - "traffic_direction": { - "type": "keyword" - }, - "traffic_locality": { - "type": "keyword" - }, - "vlan": { - "type": "long" - } - } - }, - "node": { - "dynamic": true, - "type": "object", - "properties": { - "ipaddr": { - "type": "ip" - }, - "hostname": { - "type": "keyword" - } - } - }, - "tags": { - "type": "keyword" + { + "string_fields": { + "mapping": { + "type": "keyword" + }, + "match_mapping_type": "string", + "match": "*" + } + } + ], + "properties": { + "@timestamp": { + "type": "date" + }, + "@version": { + "type": "keyword" + }, + "event": { + "dynamic": true, + "type": "object", + "properties": { + "host": { + "type": "keyword" + }, + "type": { + "type": "keyword" + } + } + }, + "flow": { + "dynamic": true, + "type": "object", + "properties": { + "application": { + "type": "keyword" + }, + "autonomous_system": { + "type": "keyword" + }, + "bgp_next_hop": { + "type": "ip" + }, + "bgp_valid_state": { + "type": "long" + }, + "bytes": { + "type": "long" + }, + "city": { + "type": "keyword" + }, + "client_addr": { + "type": "ip" + }, + "client_asn": { + "type": "long" + }, + "client_autonomous_system": { + "type": "keyword" + }, + "client_city": { + "type": "keyword" + }, + "client_country": { + "type": "keyword" + }, + "client_country_code": { + "type": "keyword" + }, + "client_geo_location": { + "type": "geo_point" + }, + "client_hostname": { + "type": "keyword" + }, + "client_rep_tags": { + "type": "keyword" + }, + "country": { + "type": "keyword" + }, + "country_code": { + "type": "keyword" + }, + "direction": { + "type": "keyword" + }, + "dst_addr": { + "type": "ip" + }, + "dst_addr_trans": { + "type": "ip" + }, + "dst_asn": { + "type": "long" + }, + "dst_autonomous_system": { + "type": "keyword" + }, + "dst_city": { + "type": "keyword" + }, + "dst_country": { + "type": "keyword" + }, + "dst_country_code": { + "type": "keyword" + }, + "dst_geo_location": { + "type": "geo_point" + }, + "dst_hostname": { + "type": "keyword" + }, + "dst_mac": { + "type": "keyword" + }, + "dst_mask_len": { + "type": "long" + }, + "dst_port": { + "type": "long" + }, + "dst_port_trans": { + "type": "long" + }, + "dst_port_name": { + "type": "keyword" + }, + "dst_rep_tags": { + "type": "keyword" + }, + "input_ifname": { + "type": "keyword" + }, + "input_snmp": { + "type": "keyword" + }, + "ip_protocol": { + "type": "keyword" + }, + "ip_version": { + "type": "keyword" + }, + "next_hop": { + "type": "ip" + }, + "output_ifname": { + "type": "keyword" + }, + "output_snmp": { + "type": "keyword" + }, + "packets": { + "type": "long" + }, + "rep_tags": { + "type": "keyword" + }, + "sampling_interval": { + "type": "long" + }, + "server_addr": { + "type": "ip" + }, + "server_asn": { + "type": "long" + }, + "server_autonomous_system": { + "type": "keyword" + }, + "server_city": { + "type": "keyword" + }, + "server_country": { + "type": "keyword" + }, + "server_country_code": { + "type": "keyword" + }, + "server_geo_location": { + "type": "geo_point" + }, + "server_hostname": { + "type": "keyword" + }, + "server_rep_tags": { + "type": "keyword" + }, + "service_name": { + "type": "keyword" + }, + "service_port": { + "type": "long" + }, + "src_addr": { + "type": "ip" + }, + "src_addr_trans": { + "type": "ip" + }, + "src_asn": { + "type": "long" + }, + "src_autonomous_system": { + "type": "keyword" + }, + "src_city": { + "type": "keyword" + }, + "src_country": { + "type": "keyword" + }, + "src_country_code": { + "type": "keyword" + }, + "src_geo_location": { + "type": "geo_point" + }, + "src_hostname": { + "type": "keyword" + }, + "src_mac": { + "type": "keyword" + }, + "src_mask_len": { + "type": "long" + }, + "src_port": { + "type": "long" + }, + "src_port_trans": { + "type": "long" + }, + "src_port_name": { + "type": "keyword" + }, + "src_rep_tags": { + "type": "keyword" + }, + "tcp_flags": { + "type": "keyword" + }, + "tos": { + "type": "long" + }, + "traffic_direction": { + "type": "keyword" + }, + "traffic_locality": { + "type": "keyword" + }, + "vlan": { + "type": "long" + } + } + }, + "node": { + "dynamic": true, + "type": "object", + "properties": { + "ipaddr": { + "type": "ip" + }, + "hostname": { + "type": "keyword" + } } + }, + "tags": { + "type": "keyword" } } } diff --git a/logstash/elastiflow/templates/elastiflow_static.template.json b/logstash/elastiflow/templates/elastiflow_static.template.json index 961ffae..a7c23f4 100755 --- a/logstash/elastiflow/templates/elastiflow_static.template.json +++ b/logstash/elastiflow/templates/elastiflow_static.template.json @@ -1,7 +1,7 @@ { "order": 0, - "version": 30402, - "index_patterns": "elastiflow-3.4.2-*", + "version": 30500, + "index_patterns": "elastiflow-3.5.0-*", "settings": { "index": { "number_of_shards": 3, @@ -12,10967 +12,11017 @@ "total_fields" : { "limit": 5000 } + }, + "query": { + "default_field": [ + "@timestamp", + "@version", + "event.host", + "event.type", + "flow.application", + "flow.autonomous_system", + "flow.bgp_next_hop", + "flow.bgp_valid_state", + "flow.city", + "flow.country", + "flow.country_code", + "flow.direction", + "flow.dst_addr", + "flow.dst_addr_trans", + "flow.dst_asn", + "flow.dst_hostname", + "flow.dst_mac", + "flow.dst_mask_len", + "flow.dst_port", + "flow.dst_port_trans", + "flow.dst_port_name", + "flow.input_ifname", + "flow.input_snmp", + "flow.ip_protocol", + "flow.ip_version", + "flow.next_hop", + "flow.output_ifname", + "flow.output_snmp", + "flow.rep_tags", + "flow.sampling_interval", + "flow.service_name", + "flow.src_addr", + "flow.src_addr_trans", + "flow.src_asn", + "flow.src_hostname", + "flow.src_mac", + "flow.src_mask_len", + "flow.src_port", + "flow.src_port_trans", + "flow.src_port_name", + "flow.tcp_flags", + "flow.tos", + "flow.traffic_direction", + "flow.traffic_locality", + "flow.vlan", + "node.ipaddr", + "node.hostname", + "tags" + ] } } }, "mappings": { - "doc": { - "numeric_detection": true, + "numeric_detection": true, - "dynamic_templates": [ - { - "string_fields": { - "mapping": { - "type": "keyword" - }, - "match_mapping_type": "string", - "match": "*" - } + "dynamic_templates": [ + { + "string_fields": { + "mapping": { + "type": "keyword" + }, + "match_mapping_type": "string", + "match": "*" } - ], - - "properties": { - "@timestamp": { - "type": "date" - }, - "@version": { - "type": "keyword" - }, + } + ], + + "properties": { + "@timestamp": { + "type": "date" + }, + "@version": { + "type": "keyword" + }, - "event": { - "dynamic": true, - "type": "object", - "properties": { - "host": { - "type": "keyword" - }, - "type": { - "type": "keyword" - } + "event": { + "dynamic": true, + "type": "object", + "properties": { + "host": { + "type": "keyword" + }, + "type": { + "type": "keyword" } - }, + } + }, - "flow": { - "dynamic": true, - "type": "object", - "properties": { - "application": { - "type": "keyword" - }, - "autonomous_system": { - "type": "keyword" - }, - "bgp_next_hop": { - "type": "ip" - }, - "bgp_valid_state": { - "type": "long" - }, - "bytes": { - "type": "long" - }, - "city": { - "type": "keyword" - }, - "client_addr": { - "type": "ip" - }, - "client_asn": { - "type": "long" - }, - "client_autonomous_system": { - "type": "keyword" - }, - "client_city": { - "type": "keyword" - }, - "client_country": { - "type": "keyword" - }, - "client_country_code": { - "type": "keyword" - }, - "client_geo_location": { - "type": "geo_point" - }, - "client_hostname": { - "type": "keyword" - }, - "client_rep_tags": { - "type": "keyword" - }, - "country": { - "type": "keyword" - }, - "country_code": { - "type": "keyword" - }, - "direction": { - "type": "keyword" - }, - "dst_addr": { - "type": "ip" - }, - "dst_addr_trans": { - "type": "ip" - }, - "dst_asn": { - "type": "long" - }, - "dst_autonomous_system": { - "type": "keyword" - }, - "dst_city": { - "type": "keyword" - }, - "dst_country": { - "type": "keyword" - }, - "dst_country_code": { - "type": "keyword" - }, - "dst_geo_location": { - "type": "geo_point" - }, - "dst_hostname": { - "type": "keyword" - }, - "dst_mac": { - "type": "keyword" - }, - "dst_mask_len": { - "type": "long" - }, - "dst_port": { - "type": "long" - }, - "dst_port_trans": { - "type": "long" - }, - "dst_port_name": { - "type": "keyword" - }, - "dst_rep_tags": { - "type": "keyword" - }, - "input_ifname": { - "type": "keyword" - }, - "input_snmp": { - "type": "keyword" - }, - "ip_protocol": { - "type": "keyword" - }, - "ip_version": { - "type": "keyword" - }, - "next_hop": { - "type": "ip" - }, - "output_ifname": { - "type": "keyword" - }, - "output_snmp": { - "type": "keyword" - }, - "packets": { - "type": "long" - }, - "rep_tags": { - "type": "keyword" - }, - "sampling_interval": { - "type": "long" - }, - "server_addr": { - "type": "ip" - }, - "server_asn": { - "type": "long" - }, - "server_autonomous_system": { - "type": "keyword" - }, - "server_city": { - "type": "keyword" - }, - "server_country": { - "type": "keyword" - }, - "server_country_code": { - "type": "keyword" - }, - "server_geo_location": { - "type": "geo_point" - }, - "server_hostname": { - "type": "keyword" - }, - "server_rep_tags": { - "type": "keyword" - }, - "service_name": { - "type": "keyword" - }, - "service_port": { - "type": "long" - }, - "src_addr": { - "type": "ip" - }, - "src_addr_trans": { - "type": "ip" - }, - "src_asn": { - "type": "long" - }, - "src_autonomous_system": { - "type": "keyword" - }, - "src_city": { - "type": "keyword" - }, - "src_country": { - "type": "keyword" - }, - "src_country_code": { - "type": "keyword" - }, - "src_geo_location": { - "type": "geo_point" - }, - "src_hostname": { - "type": "keyword" - }, - "src_mac": { - "type": "keyword" - }, - "src_mask_len": { - "type": "long" - }, - "src_port": { - "type": "long" - }, - "src_port_trans": { - "type": "long" - }, - "src_port_name": { - "type": "keyword" - }, - "src_rep_tags": { - "type": "keyword" - }, - "tcp_flags": { - "type": "keyword" - }, - "tos": { - "type": "long" - }, - "traffic_direction": { - "type": "keyword" - }, - "traffic_locality": { - "type": "keyword" - }, - "vlan": { - "type": "long" - } + "flow": { + "dynamic": true, + "type": "object", + "properties": { + "application": { + "type": "keyword" + }, + "autonomous_system": { + "type": "keyword" + }, + "bgp_next_hop": { + "type": "ip" + }, + "bgp_valid_state": { + "type": "long" + }, + "bytes": { + "type": "long" + }, + "city": { + "type": "keyword" + }, + "client_addr": { + "type": "ip" + }, + "client_asn": { + "type": "long" + }, + "client_autonomous_system": { + "type": "keyword" + }, + "client_city": { + "type": "keyword" + }, + "client_country": { + "type": "keyword" + }, + "client_country_code": { + "type": "keyword" + }, + "client_geo_location": { + "type": "geo_point" + }, + "client_hostname": { + "type": "keyword" + }, + "client_rep_tags": { + "type": "keyword" + }, + "country": { + "type": "keyword" + }, + "country_code": { + "type": "keyword" + }, + "direction": { + "type": "keyword" + }, + "dst_addr": { + "type": "ip" + }, + "dst_addr_trans": { + "type": "ip" + }, + "dst_asn": { + "type": "long" + }, + "dst_autonomous_system": { + "type": "keyword" + }, + "dst_city": { + "type": "keyword" + }, + "dst_country": { + "type": "keyword" + }, + "dst_country_code": { + "type": "keyword" + }, + "dst_geo_location": { + "type": "geo_point" + }, + "dst_hostname": { + "type": "keyword" + }, + "dst_mac": { + "type": "keyword" + }, + "dst_mask_len": { + "type": "long" + }, + "dst_port": { + "type": "long" + }, + "dst_port_trans": { + "type": "long" + }, + "dst_port_name": { + "type": "keyword" + }, + "dst_rep_tags": { + "type": "keyword" + }, + "input_ifname": { + "type": "keyword" + }, + "input_snmp": { + "type": "keyword" + }, + "ip_protocol": { + "type": "keyword" + }, + "ip_version": { + "type": "keyword" + }, + "next_hop": { + "type": "ip" + }, + "output_ifname": { + "type": "keyword" + }, + "output_snmp": { + "type": "keyword" + }, + "packets": { + "type": "long" + }, + "rep_tags": { + "type": "keyword" + }, + "sampling_interval": { + "type": "long" + }, + "server_addr": { + "type": "ip" + }, + "server_asn": { + "type": "long" + }, + "server_autonomous_system": { + "type": "keyword" + }, + "server_city": { + "type": "keyword" + }, + "server_country": { + "type": "keyword" + }, + "server_country_code": { + "type": "keyword" + }, + "server_geo_location": { + "type": "geo_point" + }, + "server_hostname": { + "type": "keyword" + }, + "server_rep_tags": { + "type": "keyword" + }, + "service_name": { + "type": "keyword" + }, + "service_port": { + "type": "long" + }, + "src_addr": { + "type": "ip" + }, + "src_addr_trans": { + "type": "ip" + }, + "src_asn": { + "type": "long" + }, + "src_autonomous_system": { + "type": "keyword" + }, + "src_city": { + "type": "keyword" + }, + "src_country": { + "type": "keyword" + }, + "src_country_code": { + "type": "keyword" + }, + "src_geo_location": { + "type": "geo_point" + }, + "src_hostname": { + "type": "keyword" + }, + "src_mac": { + "type": "keyword" + }, + "src_mask_len": { + "type": "long" + }, + "src_port": { + "type": "long" + }, + "src_port_trans": { + "type": "long" + }, + "src_port_name": { + "type": "keyword" + }, + "src_rep_tags": { + "type": "keyword" + }, + "tcp_flags": { + "type": "keyword" + }, + "tos": { + "type": "long" + }, + "traffic_direction": { + "type": "keyword" + }, + "traffic_locality": { + "type": "keyword" + }, + "vlan": { + "type": "long" } - }, + } + }, - "node": { - "dynamic": true, - "type": "object", - "properties": { - "ipaddr": { - "type": "ip" - }, - "hostname": { - "type": "keyword" - } + "node": { + "dynamic": true, + "type": "object", + "properties": { + "ipaddr": { + "type": "ip" + }, + "hostname": { + "type": "keyword" } - }, + } + }, - "tags": { - "type": "keyword" - }, + "tags": { + "type": "keyword" + }, - "ipfix": { - "dynamic": true, - "type": "object", - "properties": { - "octetDeltaCount": { - "type": "long" - }, - "packetDeltaCount": { - "type": "long" - }, - "deltaFlowCount": { - "type": "long" - }, - "protocolIdentifier": { - "type": "long" - }, - "ipClassOfService": { - "type": "long" - }, - "tcpControlBits": { - "type": "long" - }, - "sourceTransportPort": { - "type": "long" - }, - "sourceIPv4Address": { - "type": "ip" - }, - "sourceIPv4PrefixLength": { - "type": "long" - }, - "ingressInterface": { - "type": "long" - }, - "destinationTransportPort": { - "type": "long" - }, - "destinationIPv4Address": { - "type": "ip" - }, - "destinationIPv4PrefixLength": { - "type": "long" - }, - "egressInterface": { - "type": "long" - }, - "ipNextHopIPv4Address": { - "type": "ip" - }, - "bgpSourceAsNumber": { - "type": "long" - }, - "bgpDestinationAsNumber": { - "type": "long" - }, - "bgpNextHopIPv4Address": { - "type": "ip" - }, - "postMCastPacketDeltaCount": { - "type": "long" - }, - "postMCastOctetDeltaCount": { - "type": "long" - }, - "flowEndSysUpTime": { - "type": "long" - }, - "flowStartSysUpTime": { - "type": "long" - }, - "postOctetDeltaCount": { - "type": "long" - }, - "postPacketDeltaCount": { - "type": "long" - }, - "minimumIpTotalLength": { - "type": "long" - }, - "maximumIpTotalLength": { - "type": "long" - }, - "sourceIPv6Address": { - "type": "ip" - }, - "destinationIPv6Address": { - "type": "ip" - }, - "sourceIPv6PrefixLength": { - "type": "long" - }, - "destinationIPv6PrefixLength": { - "type": "long" - }, - "flowLabelIPv6": { - "type": "long" - }, - "icmpTypeCodeIPv4": { - "type": "long" - }, - "igmpType": { - "type": "long" - }, - "samplingInterval": { - "type": "long" - }, - "samplingAlgorithm": { - "type": "long" - }, - "flowActiveTimeout": { - "type": "long" - }, - "flowIdleTimeout": { - "type": "long" - }, - "engineType": { - "type": "long" - }, - "engineId": { - "type": "long" - }, - "exportedOctetTotalCount": { - "type": "long" - }, - "exportedMessageTotalCount": { - "type": "long" - }, - "exportedFlowRecordTotalCount": { - "type": "long" - }, - "ipv4RouterSc": { - "type": "ip" - }, - "sourceIPv4Prefix": { - "type": "ip" - }, - "destinationIPv4Prefix": { - "type": "ip" - }, - "mplsTopLabelType": { - "type": "long" - }, - "mplsTopLabelIPv4Address": { - "type": "ip" - }, - "samplerId": { - "type": "long" - }, - "samplerMode": { - "type": "long" - }, - "samplerRandomInterval": { - "type": "long" - }, - "classId": { - "type": "long" - }, - "minimumTTL": { - "type": "long" - }, - "maximumTTL": { - "type": "long" - }, - "fragmentIdentification": { - "type": "long" - }, - "postIpClassOfService": { - "type": "long" - }, - "sourceMacAddress": { - "type": "keyword" - }, - "postDestinationMacAddress": { - "type": "keyword" - }, - "vlanId": { - "type": "long" - }, - "postVlanId": { - "type": "long" - }, - "ipVersion": { - "type": "long" - }, - "flowDirection": { - "type": "long" - }, - "ipNextHopIPv6Address": { - "type": "ip" - }, - "bgpNextHopIPv6Address": { - "type": "ip" - }, - "ipv6ExtensionHeaders": { - "type": "long" - }, - "transportPacketLoss": { - "type": "long" - }, - "transportUnreachability": { - "type": "long" - }, - "transportLatency": { - "type": "long" - }, - "mplsTopLabelStackSection": { - "type": "keyword" - }, - "mplsLabelStackSection2": { - "type": "keyword" - }, - "mplsLabelStackSection3": { - "type": "keyword" - }, - "mplsLabelStackSection4": { - "type": "keyword" - }, - "mplsLabelStackSection5": { - "type": "keyword" - }, - "mplsLabelStackSection6": { - "type": "keyword" - }, - "mplsLabelStackSection7": { - "type": "keyword" - }, - "mplsLabelStackSection8": { - "type": "keyword" - }, - "mplsLabelStackSection9": { - "type": "keyword" - }, - "mplsLabelStackSection10": { - "type": "keyword" - }, - "destinationMacAddress": { - "type": "keyword" - }, - "postSourceMacAddress": { - "type": "keyword" - }, - "interfaceName": { - "type": "keyword" - }, - "interfaceDescription": { - "type": "keyword" - }, - "samplerName": { - "type": "keyword" - }, - "octetTotalCount": { - "type": "long" - }, - "packetTotalCount": { - "type": "long" - }, - "flagsAndSamplerId": { - "type": "long" - }, - "fragmentOffset": { - "type": "long" - }, - "forwardingStatus": { - "type": "long" - }, - "mplsVpnRouteDistinguisher": { - "type": "keyword" - }, - "mplsTopLabelPrefixLength": { - "type": "long" - }, - "srcTrafficIndex": { - "type": "long" - }, - "dstTrafficIndex": { - "type": "long" - }, - "applicationDescription": { - "type": "keyword" - }, - "applicationId": { - "type": "keyword" - }, - "applicationName": { - "type": "keyword" - }, - "subApplicationTag": { - "type": "keyword" - }, - "postIpDiffServCodePoint": { - "type": "long" - }, - "multicastReplicationFactor": { - "type": "long" - }, - "className": { - "type": "keyword" - }, - "classificationEngineId": { - "type": "long" - }, - "layer2packetSectionOffset": { - "type": "long" - }, - "layer2packetSectionSize": { - "type": "long" - }, - "layer2packetSectionData": { - "type": "keyword" - }, - "applicationVersion": { - "type": "long" - }, - "applicationVersionName": { - "type": "keyword" - }, - "applicationVendor": { - "type": "keyword" - }, - "subApplicationName": { - "type": "keyword" - }, - "subApplicationDescription": { - "type": "keyword" - }, - "templateParameterRangeEnd": { - "type": "long" - }, - "bgpNextAdjacentAsNumber": { - "type": "long" - }, - "bgpPrevAdjacentAsNumber": { - "type": "long" - }, - "exporterIPv4Address": { - "type": "ip" - }, - "exporterIPv6Address": { - "type": "ip" - }, - "droppedOctetDeltaCount": { - "type": "long" - }, - "droppedPacketDeltaCount": { - "type": "long" - }, - "droppedOctetTotalCount": { - "type": "long" - }, - "droppedPacketTotalCount": { - "type": "long" - }, - "flowEndReason": { - "type": "long" - }, - "commonPropertiesId": { - "type": "long" - }, - "observationPointId": { - "type": "long" - }, - "icmpTypeCodeIPv6": { - "type": "long" - }, - "mplsTopLabelIPv6Address": { - "type": "ip" - }, - "lineCardId": { - "type": "long" - }, - "portId": { - "type": "long" - }, - "meteringProcessId": { - "type": "long" - }, - "exportingProcessId": { - "type": "long" - }, - "templateId": { - "type": "long" - }, - "wlanChannelId": { - "type": "long" - }, - "wlanSSID": { - "type": "keyword" - }, - "flowId": { - "type": "long" - }, - "observationDomainId": { - "type": "long" - }, - "flowStartSeconds": { - "type": "date" - }, - "flowEndSeconds": { - "type": "date" - }, - "flowStartMilliseconds": { - "type": "date" - }, - "flowEndMilliseconds": { - "type": "date" - }, - "flowStartMicroseconds": { - "type": "date" - }, - "flowEndMicroseconds": { - "type": "date" - }, - "flowStartNanoseconds": { - "type": "date" - }, - "flowEndNanoseconds": { - "type": "date" - }, - "flowStartDeltaMicroseconds": { - "type": "long" - }, - "flowEndDeltaMicroseconds": { - "type": "long" - }, - "systemInitTimeMilliseconds": { - "type": "long" - }, - "flowDurationMilliseconds": { - "type": "long" - }, - "flowDurationMicroseconds": { - "type": "long" - }, - "observedFlowTotalCount": { - "type": "long" - }, - "ignoredPacketTotalCount": { - "type": "long" - }, - "ignoredOctetTotalCount": { - "type": "long" - }, - "notSentFlowTotalCount": { - "type": "long" - }, - "notSentPacketTotalCount": { - "type": "long" - }, - "notSentOctetTotalCount": { - "type": "long" - }, - "destinationIPv6Prefix": { - "type": "ip" - }, - "sourceIPv6Prefix": { - "type": "ip" - }, - "postOctetTotalCount": { - "type": "long" - }, - "postPacketTotalCount": { - "type": "long" - }, - "flowKeyIndicator": { - "type": "long" - }, - "postMCastPacketTotalCount": { - "type": "long" - }, - "postMCastOctetTotalCount": { - "type": "long" - }, - "icmpTypeIPv4": { - "type": "long" - }, - "icmpCodeIPv4": { - "type": "long" - }, - "icmpTypeIPv6": { - "type": "long" - }, - "icmpCodeIPv6": { - "type": "long" - }, - "udpSourcePort": { - "type": "long" - }, - "udpDestinationPort": { - "type": "long" - }, - "tcpSourcePort": { - "type": "long" - }, - "tcpDestinationPort": { - "type": "long" - }, - "tcpSequenceNumber": { - "type": "long" - }, - "tcpAcknowledgementNumber": { - "type": "long" - }, - "tcpWindowSize": { - "type": "long" - }, - "tcpUrgentPointer": { - "type": "long" - }, - "tcpHeaderLength": { - "type": "long" - }, - "ipHeaderLength": { - "type": "long" - }, - "totalLengthIPv4": { - "type": "long" - }, - "payloadLengthIPv6": { - "type": "long" - }, - "ipTTL": { - "type": "long" - }, - "nextHeaderIPv6": { - "type": "long" - }, - "mplsPayloadLength": { - "type": "long" - }, - "ipDiffServCodePoint": { - "type": "long" - }, - "ipPrecedence": { - "type": "long" - }, - "fragmentFlags": { - "type": "long" - }, - "octetDeltaSumOfSquares": { - "type": "long" - }, - "octetTotalSumOfSquares": { - "type": "long" - }, - "mplsTopLabelTTL": { - "type": "long" - }, - "mplsLabelStackLength": { - "type": "long" - }, - "mplsLabelStackDepth": { - "type": "long" - }, - "mplsTopLabelExp": { - "type": "long" - }, - "ipPayloadLength": { - "type": "long" - }, - "udpMessageLength": { - "type": "long" - }, - "isMulticast": { - "type": "long" - }, - "ipv4IHL": { - "type": "long" - }, - "ipv4Options": { - "type": "long" - }, - "tcpOptions": { - "type": "long" - }, - "collectorIPv4Address": { - "type": "ip" - }, - "collectorIPv6Address": { - "type": "ip" - }, - "collectorTransportPort": { - "type": "long" - }, - "exportInterface": { - "type": "long" - }, - "exportProtocolVersion": { - "type": "long" - }, - "exportTransportProtocol": { - "type": "long" - }, - "exporterTransportPort": { - "type": "long" - }, - "tcpSynTotalCount": { - "type": "long" - }, - "tcpFinTotalCount": { - "type": "long" - }, - "tcpRstTotalCount": { - "type": "long" - }, - "tcpPshTotalCount": { - "type": "long" - }, - "tcpAckTotalCount": { - "type": "long" - }, - "tcpUrgTotalCount": { - "type": "long" - }, - "ipTotalLength": { - "type": "long" - }, - "postNATSourceIPv4Address": { - "type": "ip" - }, - "postNATDestinationIPv4Address": { - "type": "ip" - }, - "postNAPTSourceTransportPort": { - "type": "long" - }, - "postNAPTDestinationTransportPort": { - "type": "long" - }, - "natOriginatingAddressRealm": { - "type": "long" - }, - "natEvent": { - "type": "long" - }, - "initiatorOctets": { - "type": "long" - }, - "responderOctets": { - "type": "long" - }, - "firewallEvent": { - "type": "long" - }, - "ingressVRFID": { - "type": "long" - }, - "egressVRFID": { - "type": "long" - }, - "VRFname": { - "type": "keyword" - }, - "postMplsTopLabelExp": { - "type": "long" - }, - "tcpWindowScale": { - "type": "long" - }, - "biflowDirection": { - "type": "long" - }, - "ethernetHeaderLength": { - "type": "long" - }, - "ethernetPayloadLength": { - "type": "long" - }, - "ethernetTotalLength": { - "type": "long" - }, - "dot1qVlanId": { - "type": "long" - }, - "dot1qPriority": { - "type": "long" - }, - "dot1qCustomerVlanId": { - "type": "long" - }, - "dot1qCustomerPriority": { - "type": "long" - }, - "metroEvcId": { - "type": "keyword" - }, - "metroEvcType": { - "type": "long" - }, - "pseudoWireId": { - "type": "long" - }, - "pseudoWireType": { - "type": "long" - }, - "pseudoWireControlWord": { - "type": "long" - }, - "ingressPhysicalInterface": { - "type": "long" - }, - "egressPhysicalInterface": { - "type": "long" - }, - "postDot1qVlanId": { - "type": "long" - }, - "postDot1qCustomerVlanId": { - "type": "long" - }, - "ethernetType": { - "type": "long" - }, - "postIpPrecedence": { - "type": "long" - }, - "collectionTimeMilliseconds": { - "type": "long" - }, - "exportSctpStreamId": { - "type": "long" - }, - "maxExportSeconds": { - "type": "long" - }, - "maxFlowEndSeconds": { - "type": "long" - }, - "messageMD5Checksum": { - "type": "keyword" - }, - "messageScope": { - "type": "long" - }, - "minExportSeconds": { - "type": "long" - }, - "minFlowStartSeconds": { - "type": "long" - }, - "opaqueOctets": { - "type": "keyword" - }, - "sessionScope": { - "type": "long" - }, - "maxFlowEndMicroseconds": { - "type": "long" - }, - "maxFlowEndMilliseconds": { - "type": "long" - }, - "maxFlowEndNanoseconds": { - "type": "long" - }, - "minFlowStartMicroseconds": { - "type": "long" - }, - "minFlowStartMilliseconds": { - "type": "long" - }, - "minFlowStartNanoseconds": { - "type": "long" - }, - "collectorCertificate": { - "type": "keyword" - }, - "exporterCertificate": { - "type": "keyword" - }, - "dataRecordsReliability": { - "type": "long" - }, - "observationPointType": { - "type": "long" - }, - "newConnectionDeltaCount": { - "type": "long" - }, - "connectionSumDurationSeconds": { - "type": "long" - }, - "connectionTransactionId": { - "type": "long" - }, - "postNATSourceIPv6Address": { - "type": "ip" - }, - "postNATDestinationIPv6Address": { - "type": "ip" - }, - "natPoolId": { - "type": "long" - }, - "natPoolName": { - "type": "keyword" - }, - "anonymizationFlags": { - "type": "long" - }, - "anonymizationTechnique": { - "type": "long" - }, - "informationElementIndex": { - "type": "long" - }, - "p2pTechnology": { - "type": "keyword" - }, - "tunnelTechnology": { - "type": "keyword" - }, - "encryptedTechnology": { - "type": "keyword" - }, - "bgpValidityState": { - "type": "long" - }, - "IPSecSPI": { - "type": "long" - }, - "greKey": { - "type": "long" - }, - "natType": { - "type": "long" - }, - "initiatorPackets": { - "type": "long" - }, - "responderPackets": { - "type": "long" - }, - "observationDomainName": { - "type": "keyword" - }, - "selectionSequenceId": { - "type": "long" - }, - "selectorId": { - "type": "long" - }, - "informationElementId": { - "type": "long" - }, - "selectorAlgorithm": { - "type": "long" - }, - "samplingPacketInterval": { - "type": "long" - }, - "samplingPacketSpace": { - "type": "long" - }, - "samplingTimeInterval": { - "type": "long" - }, - "samplingTimeSpace": { - "type": "long" - }, - "samplingSize": { - "type": "long" - }, - "samplingPopulation": { - "type": "long" - }, - "samplingProbability": { - "type": "double" - }, - "dataLinkFrameSize": { - "type": "long" - }, - "ipHeaderPacketSection": { - "type": "keyword" - }, - "ipPayloadPacketSection": { - "type": "keyword" - }, - "dataLinkFrameSection": { - "type": "keyword" - }, - "mplsLabelStackSection": { - "type": "keyword" - }, - "mplsPayloadPacketSection": { - "type": "keyword" - }, - "selectorIdTotalPktsObserved": { - "type": "long" - }, - "selectorIdTotalPktsSelected": { - "type": "long" - }, - "absoluteError": { - "type": "double" - }, - "relativeError": { - "type": "double" - }, - "observationTimeSeconds": { - "type": "long" - }, - "observationTimeMilliseconds": { - "type": "long" - }, - "observationTimeMicroseconds": { - "type": "long" - }, - "observationTimeNanoseconds": { - "type": "long" - }, - "digestHashValue": { - "type": "long" - }, - "hashIPPayloadOffset": { - "type": "long" - }, - "hashIPPayloadSize": { - "type": "long" - }, - "hashOutputRangeMin": { - "type": "long" - }, - "hashOutputRangeMax": { - "type": "long" - }, - "hashSelectedRangeMin": { - "type": "long" - }, - "hashSelectedRangeMax": { - "type": "long" - }, - "hashDigestOutput": { - "type": "long" - }, - "hashInitialiserValue": { - "type": "long" - }, - "selectorName": { - "type": "keyword" - }, - "upperCILimit": { - "type": "double" - }, - "lowerCILimit": { - "type": "double" - }, - "confidenceLevel": { - "type": "double" - }, - "informationElementDataType": { - "type": "long" - }, - "informationElementDescription": { - "type": "keyword" - }, - "informationElementName": { - "type": "keyword" - }, - "informationElementRangeBegin": { - "type": "long" - }, - "informationElementRangeEnd": { - "type": "long" - }, - "informationElementSemantics": { - "type": "long" - }, - "informationElementUnits": { - "type": "long" - }, - "privateEnterpriseNumber": { - "type": "long" - }, - "virtualStationInterfaceId": { - "type": "keyword" - }, - "virtualStationInterfaceName": { - "type": "keyword" - }, - "virtualStationUUID": { - "type": "keyword" - }, - "virtualStationName": { - "type": "keyword" - }, - "layer2SegmentId": { - "type": "long" - }, - "layer2OctetDeltaCount": { - "type": "long" - }, - "layer2OctetTotalCount": { - "type": "long" - }, - "ingressUnicastPacketTotalCount": { - "type": "long" - }, - "ingressMulticastPacketTotalCount": { - "type": "long" - }, - "ingressBroadcastPacketTotalCount": { - "type": "long" - }, - "egressUnicastPacketTotalCount": { - "type": "long" - }, - "egressBroadcastPacketTotalCount": { - "type": "long" - }, - "monitoringIntervalStartMilliSeconds": { - "type": "long" - }, - "monitoringIntervalEndMilliSeconds": { - "type": "long" - }, - "portRangeStart": { - "type": "long" - }, - "portRangeEnd": { - "type": "long" - }, - "portRangeStepSize": { - "type": "long" - }, - "portRangeNumPorts": { - "type": "long" - }, - "staMacAddress": { - "type": "keyword" - }, - "staIPv4Address": { - "type": "ip" - }, - "wtpMacAddress": { - "type": "keyword" - }, - "ingressInterfaceType": { - "type": "long" - }, - "egressInterfaceType": { - "type": "long" - }, - "rtpSequenceNumber": { - "type": "long" - }, - "userName": { - "type": "keyword" - }, - "applicationCategoryName": { - "type": "keyword" - }, - "applicationSubCategoryName": { - "type": "keyword" - }, - "applicationGroupName": { - "type": "keyword" - }, - "originalFlowsPresent": { - "type": "long" - }, - "originalFlowsInitiated": { - "type": "long" - }, - "originalFlowsCompleted": { - "type": "long" - }, - "distinctCountOfSourceIPAddress": { - "type": "long" - }, - "distinctCountOfDestinationIPAddress": { - "type": "long" - }, - "distinctCountOfSourceIPv4Address": { - "type": "long" - }, - "distinctCountOfDestinationIPv4Address": { - "type": "long" - }, - "distinctCountOfSourceIPv6Address": { - "type": "long" - }, - "distinctCountOfDestinationIPv6Address": { - "type": "long" - }, - "valueDistributionMethod": { - "type": "long" - }, - "rfc3550JitterMilliseconds": { - "type": "long" - }, - "rfc3550JitterMicroseconds": { - "type": "long" - }, - "rfc3550JitterNanoseconds": { - "type": "long" - }, - "dot1qDEI": { - "type": "long" - }, - "dot1qCustomerDEI": { - "type": "long" - }, - "flowSelectorAlgorithm": { - "type": "long" - }, - "flowSelectedOctetDeltaCount": { - "type": "long" - }, - "flowSelectedPacketDeltaCount": { - "type": "long" - }, - "flowSelectedFlowDeltaCount": { - "type": "long" - }, - "selectorIDTotalFlowsObserved": { - "type": "long" - }, - "selectorIDTotalFlowsSelected": { - "type": "long" - }, - "samplingFlowInterval": { - "type": "long" - }, - "samplingFlowSpacing": { - "type": "long" - }, - "flowSamplingTimeInterval": { - "type": "long" - }, - "flowSamplingTimeSpacing": { - "type": "long" - }, - "hashFlowDomain": { - "type": "long" - }, - "transportOctetDeltaCount": { - "type": "long" - }, - "transportPacketDeltaCount": { - "type": "long" - }, - "originalExporterIPv4Address": { - "type": "ip" - }, - "originalExporterIPv6Address": { - "type": "ip" - }, - "originalObservationDomainId": { - "type": "long" - }, - "intermediateProcessId": { - "type": "long" - }, - "ignoredDataRecordTotalCount": { - "type": "long" - }, - "dataLinkFrameType": { - "type": "long" - }, - "sectionOffset": { - "type": "long" - }, - "sectionExportedOctets": { - "type": "long" - }, - "dot1qServiceInstanceTag": { - "type": "keyword" - }, - "dot1qServiceInstanceId": { - "type": "long" - }, - "dot1qServiceInstancePriority": { - "type": "long" - }, - "dot1qCustomerSourceMacAddress": { - "type": "keyword" - }, - "dot1qCustomerDestinationMacAddress": { - "type": "keyword" - }, - "postLayer2OctetDeltaCount": { - "type": "long" - }, - "postMCastLayer2OctetDeltaCount": { - "type": "long" - }, - "postLayer2OctetTotalCount": { - "type": "long" - }, - "postMCastLayer2OctetTotalCount": { - "type": "long" - }, - "minimumLayer2TotalLength": { - "type": "long" - }, - "maximumLayer2TotalLength": { - "type": "long" - }, - "droppedLayer2OctetDeltaCount": { - "type": "long" - }, - "droppedLayer2OctetTotalCount": { - "type": "long" - }, - "ignoredLayer2OctetTotalCount": { - "type": "long" - }, - "notSentLayer2OctetTotalCount": { - "type": "long" - }, - "layer2OctetDeltaSumOfSquares": { - "type": "long" - }, - "layer2OctetTotalSumOfSquares": { - "type": "long" - }, - "layer2FrameDeltaCount": { - "type": "long" - }, - "layer2FrameTotalCount": { - "type": "long" - }, - "pseudoWireDestinationIPv4Address": { - "type": "ip" - }, - "ignoredLayer2FrameTotalCount": { - "type": "long" - }, - "mibObjectValueInteger": { - "type": "long" - }, - "mibObjectValueOctetString": { - "type": "keyword" - }, - "mibObjectValueOID": { - "type": "keyword" - }, - "mibObjectValueBits": { - "type": "keyword" - }, - "mibObjectValueIPAddress": { - "type": "ip" - }, - "mibObjectValueCounter": { - "type": "long" - }, - "mibObjectValueGauge": { - "type": "long" - }, - "mibObjectValueTimeTicks": { - "type": "long" - }, - "mibObjectValueUnsigned": { - "type": "long" - }, - "mibObjectValueTable": { - "type": "keyword" - }, - "mibObjectValueRow": { - "type": "keyword" - }, - "mibObjectIdentifier": { - "type": "keyword" - }, - "mibSubIdentifier": { - "type": "long" - }, - "mibIndexIndicator": { - "type": "long" - }, - "mibCaptureTimeSemantics": { - "type": "long" - }, - "mibContextEngineID": { - "type": "keyword" - }, - "mibContextName": { - "type": "keyword" - }, - "mibObjectName": { - "type": "keyword" - }, - "mibObjectDescription": { - "type": "keyword" - }, - "mibObjectSyntax": { - "type": "keyword" - }, - "mibModuleName": { - "type": "keyword" - }, - "mobileIMSI": { - "type": "keyword" - }, - "mobileMSISDN": { - "type": "keyword" - }, - "httpStatusCode": { - "type": "long" - }, - "sourceTransportPortsLimit": { - "type": "long" - }, - "httpRequestMethod": { - "type": "keyword" - }, - "httpRequestHost": { - "type": "keyword" - }, - "httpRequestTarget": { - "type": "keyword" - }, - "httpMessageVersion": { - "type": "keyword" - }, - "natInstanceID": { - "type": "long" - }, - "internalAddressRealm": { - "type": "keyword" - }, - "externalAddressRealm": { - "type": "keyword" - }, - "natQuotaExceededEvent": { - "type": "long" - }, - "natThresholdEvent": { - "type": "long" - }, - "httpUserAgent": { - "type": "keyword" - }, - "httpContentType": { - "type": "keyword" - }, - "httpReasonPhrase": { - "type": "keyword" - }, - "maxSessionEntries": { - "type": "long" - }, - "maxBIBEntries": { - "type": "long" - }, - "maxEntriesPerUser": { - "type": "long" - }, - "maxSubscribers": { - "type": "long" - }, - "maxFragmentsPendingReassembly": { - "type": "long" - }, - "addressPoolHighThreshold": { - "type": "long" - }, - "addressPoolLowThreshold": { - "type": "long" - }, - "addressPortMappingHighThreshold": { - "type": "long" - }, - "addressPortMappingLowThreshold": { - "type": "long" - }, - "addressPortMappingPerUserHighThreshold": { - "type": "long" - }, - "globalAddressMappingHighThreshold": { - "type": "long" - }, - "vpnIdentifier": { - "type": "keyword" - }, + "ipfix": { + "dynamic": true, + "type": "object", + "properties": { + "octetDeltaCount": { + "type": "long" + }, + "packetDeltaCount": { + "type": "long" + }, + "deltaFlowCount": { + "type": "long" + }, + "protocolIdentifier": { + "type": "long" + }, + "ipClassOfService": { + "type": "long" + }, + "tcpControlBits": { + "type": "long" + }, + "sourceTransportPort": { + "type": "long" + }, + "sourceIPv4Address": { + "type": "ip" + }, + "sourceIPv4PrefixLength": { + "type": "long" + }, + "ingressInterface": { + "type": "long" + }, + "destinationTransportPort": { + "type": "long" + }, + "destinationIPv4Address": { + "type": "ip" + }, + "destinationIPv4PrefixLength": { + "type": "long" + }, + "egressInterface": { + "type": "long" + }, + "ipNextHopIPv4Address": { + "type": "ip" + }, + "bgpSourceAsNumber": { + "type": "long" + }, + "bgpDestinationAsNumber": { + "type": "long" + }, + "bgpNextHopIPv4Address": { + "type": "ip" + }, + "postMCastPacketDeltaCount": { + "type": "long" + }, + "postMCastOctetDeltaCount": { + "type": "long" + }, + "flowEndSysUpTime": { + "type": "long" + }, + "flowStartSysUpTime": { + "type": "long" + }, + "postOctetDeltaCount": { + "type": "long" + }, + "postPacketDeltaCount": { + "type": "long" + }, + "minimumIpTotalLength": { + "type": "long" + }, + "maximumIpTotalLength": { + "type": "long" + }, + "sourceIPv6Address": { + "type": "ip" + }, + "destinationIPv6Address": { + "type": "ip" + }, + "sourceIPv6PrefixLength": { + "type": "long" + }, + "destinationIPv6PrefixLength": { + "type": "long" + }, + "flowLabelIPv6": { + "type": "long" + }, + "icmpTypeCodeIPv4": { + "type": "long" + }, + "igmpType": { + "type": "long" + }, + "samplingInterval": { + "type": "long" + }, + "samplingAlgorithm": { + "type": "long" + }, + "flowActiveTimeout": { + "type": "long" + }, + "flowIdleTimeout": { + "type": "long" + }, + "engineType": { + "type": "long" + }, + "engineId": { + "type": "long" + }, + "exportedOctetTotalCount": { + "type": "long" + }, + "exportedMessageTotalCount": { + "type": "long" + }, + "exportedFlowRecordTotalCount": { + "type": "long" + }, + "ipv4RouterSc": { + "type": "ip" + }, + "sourceIPv4Prefix": { + "type": "ip" + }, + "destinationIPv4Prefix": { + "type": "ip" + }, + "mplsTopLabelType": { + "type": "long" + }, + "mplsTopLabelIPv4Address": { + "type": "ip" + }, + "samplerId": { + "type": "long" + }, + "samplerMode": { + "type": "long" + }, + "samplerRandomInterval": { + "type": "long" + }, + "classId": { + "type": "long" + }, + "minimumTTL": { + "type": "long" + }, + "maximumTTL": { + "type": "long" + }, + "fragmentIdentification": { + "type": "long" + }, + "postIpClassOfService": { + "type": "long" + }, + "sourceMacAddress": { + "type": "keyword" + }, + "postDestinationMacAddress": { + "type": "keyword" + }, + "vlanId": { + "type": "long" + }, + "postVlanId": { + "type": "long" + }, + "ipVersion": { + "type": "long" + }, + "flowDirection": { + "type": "long" + }, + "ipNextHopIPv6Address": { + "type": "ip" + }, + "bgpNextHopIPv6Address": { + "type": "ip" + }, + "ipv6ExtensionHeaders": { + "type": "long" + }, + "transportPacketLoss": { + "type": "long" + }, + "transportUnreachability": { + "type": "long" + }, + "transportLatency": { + "type": "long" + }, + "mplsTopLabelStackSection": { + "type": "keyword" + }, + "mplsLabelStackSection2": { + "type": "keyword" + }, + "mplsLabelStackSection3": { + "type": "keyword" + }, + "mplsLabelStackSection4": { + "type": "keyword" + }, + "mplsLabelStackSection5": { + "type": "keyword" + }, + "mplsLabelStackSection6": { + "type": "keyword" + }, + "mplsLabelStackSection7": { + "type": "keyword" + }, + "mplsLabelStackSection8": { + "type": "keyword" + }, + "mplsLabelStackSection9": { + "type": "keyword" + }, + "mplsLabelStackSection10": { + "type": "keyword" + }, + "destinationMacAddress": { + "type": "keyword" + }, + "postSourceMacAddress": { + "type": "keyword" + }, + "interfaceName": { + "type": "keyword" + }, + "interfaceDescription": { + "type": "keyword" + }, + "samplerName": { + "type": "keyword" + }, + "octetTotalCount": { + "type": "long" + }, + "packetTotalCount": { + "type": "long" + }, + "flagsAndSamplerId": { + "type": "long" + }, + "fragmentOffset": { + "type": "long" + }, + "forwardingStatus": { + "type": "long" + }, + "mplsVpnRouteDistinguisher": { + "type": "keyword" + }, + "mplsTopLabelPrefixLength": { + "type": "long" + }, + "srcTrafficIndex": { + "type": "long" + }, + "dstTrafficIndex": { + "type": "long" + }, + "applicationDescription": { + "type": "keyword" + }, + "applicationId": { + "type": "keyword" + }, + "applicationName": { + "type": "keyword" + }, + "subApplicationTag": { + "type": "keyword" + }, + "postIpDiffServCodePoint": { + "type": "long" + }, + "multicastReplicationFactor": { + "type": "long" + }, + "className": { + "type": "keyword" + }, + "classificationEngineId": { + "type": "long" + }, + "layer2packetSectionOffset": { + "type": "long" + }, + "layer2packetSectionSize": { + "type": "long" + }, + "layer2packetSectionData": { + "type": "keyword" + }, + "applicationVersion": { + "type": "long" + }, + "applicationVersionName": { + "type": "keyword" + }, + "applicationVendor": { + "type": "keyword" + }, + "subApplicationName": { + "type": "keyword" + }, + "subApplicationDescription": { + "type": "keyword" + }, + "templateParameterRangeEnd": { + "type": "long" + }, + "bgpNextAdjacentAsNumber": { + "type": "long" + }, + "bgpPrevAdjacentAsNumber": { + "type": "long" + }, + "exporterIPv4Address": { + "type": "ip" + }, + "exporterIPv6Address": { + "type": "ip" + }, + "droppedOctetDeltaCount": { + "type": "long" + }, + "droppedPacketDeltaCount": { + "type": "long" + }, + "droppedOctetTotalCount": { + "type": "long" + }, + "droppedPacketTotalCount": { + "type": "long" + }, + "flowEndReason": { + "type": "long" + }, + "commonPropertiesId": { + "type": "long" + }, + "observationPointId": { + "type": "long" + }, + "icmpTypeCodeIPv6": { + "type": "long" + }, + "mplsTopLabelIPv6Address": { + "type": "ip" + }, + "lineCardId": { + "type": "long" + }, + "portId": { + "type": "long" + }, + "meteringProcessId": { + "type": "long" + }, + "exportingProcessId": { + "type": "long" + }, + "templateId": { + "type": "long" + }, + "wlanChannelId": { + "type": "long" + }, + "wlanSSID": { + "type": "keyword" + }, + "flowId": { + "type": "long" + }, + "observationDomainId": { + "type": "long" + }, + "flowStartSeconds": { + "type": "date" + }, + "flowEndSeconds": { + "type": "date" + }, + "flowStartMilliseconds": { + "type": "date" + }, + "flowEndMilliseconds": { + "type": "date" + }, + "flowStartMicroseconds": { + "type": "date" + }, + "flowEndMicroseconds": { + "type": "date" + }, + "flowStartNanoseconds": { + "type": "date" + }, + "flowEndNanoseconds": { + "type": "date" + }, + "flowStartDeltaMicroseconds": { + "type": "long" + }, + "flowEndDeltaMicroseconds": { + "type": "long" + }, + "systemInitTimeMilliseconds": { + "type": "long" + }, + "flowDurationMilliseconds": { + "type": "long" + }, + "flowDurationMicroseconds": { + "type": "long" + }, + "observedFlowTotalCount": { + "type": "long" + }, + "ignoredPacketTotalCount": { + "type": "long" + }, + "ignoredOctetTotalCount": { + "type": "long" + }, + "notSentFlowTotalCount": { + "type": "long" + }, + "notSentPacketTotalCount": { + "type": "long" + }, + "notSentOctetTotalCount": { + "type": "long" + }, + "destinationIPv6Prefix": { + "type": "ip" + }, + "sourceIPv6Prefix": { + "type": "ip" + }, + "postOctetTotalCount": { + "type": "long" + }, + "postPacketTotalCount": { + "type": "long" + }, + "flowKeyIndicator": { + "type": "long" + }, + "postMCastPacketTotalCount": { + "type": "long" + }, + "postMCastOctetTotalCount": { + "type": "long" + }, + "icmpTypeIPv4": { + "type": "long" + }, + "icmpCodeIPv4": { + "type": "long" + }, + "icmpTypeIPv6": { + "type": "long" + }, + "icmpCodeIPv6": { + "type": "long" + }, + "udpSourcePort": { + "type": "long" + }, + "udpDestinationPort": { + "type": "long" + }, + "tcpSourcePort": { + "type": "long" + }, + "tcpDestinationPort": { + "type": "long" + }, + "tcpSequenceNumber": { + "type": "long" + }, + "tcpAcknowledgementNumber": { + "type": "long" + }, + "tcpWindowSize": { + "type": "long" + }, + "tcpUrgentPointer": { + "type": "long" + }, + "tcpHeaderLength": { + "type": "long" + }, + "ipHeaderLength": { + "type": "long" + }, + "totalLengthIPv4": { + "type": "long" + }, + "payloadLengthIPv6": { + "type": "long" + }, + "ipTTL": { + "type": "long" + }, + "nextHeaderIPv6": { + "type": "long" + }, + "mplsPayloadLength": { + "type": "long" + }, + "ipDiffServCodePoint": { + "type": "long" + }, + "ipPrecedence": { + "type": "long" + }, + "fragmentFlags": { + "type": "long" + }, + "octetDeltaSumOfSquares": { + "type": "long" + }, + "octetTotalSumOfSquares": { + "type": "long" + }, + "mplsTopLabelTTL": { + "type": "long" + }, + "mplsLabelStackLength": { + "type": "long" + }, + "mplsLabelStackDepth": { + "type": "long" + }, + "mplsTopLabelExp": { + "type": "long" + }, + "ipPayloadLength": { + "type": "long" + }, + "udpMessageLength": { + "type": "long" + }, + "isMulticast": { + "type": "long" + }, + "ipv4IHL": { + "type": "long" + }, + "ipv4Options": { + "type": "long" + }, + "tcpOptions": { + "type": "long" + }, + "collectorIPv4Address": { + "type": "ip" + }, + "collectorIPv6Address": { + "type": "ip" + }, + "collectorTransportPort": { + "type": "long" + }, + "exportInterface": { + "type": "long" + }, + "exportProtocolVersion": { + "type": "long" + }, + "exportTransportProtocol": { + "type": "long" + }, + "exporterTransportPort": { + "type": "long" + }, + "tcpSynTotalCount": { + "type": "long" + }, + "tcpFinTotalCount": { + "type": "long" + }, + "tcpRstTotalCount": { + "type": "long" + }, + "tcpPshTotalCount": { + "type": "long" + }, + "tcpAckTotalCount": { + "type": "long" + }, + "tcpUrgTotalCount": { + "type": "long" + }, + "ipTotalLength": { + "type": "long" + }, + "postNATSourceIPv4Address": { + "type": "ip" + }, + "postNATDestinationIPv4Address": { + "type": "ip" + }, + "postNAPTSourceTransportPort": { + "type": "long" + }, + "postNAPTDestinationTransportPort": { + "type": "long" + }, + "natOriginatingAddressRealm": { + "type": "long" + }, + "natEvent": { + "type": "long" + }, + "initiatorOctets": { + "type": "long" + }, + "responderOctets": { + "type": "long" + }, + "firewallEvent": { + "type": "long" + }, + "ingressVRFID": { + "type": "long" + }, + "egressVRFID": { + "type": "long" + }, + "VRFname": { + "type": "keyword" + }, + "postMplsTopLabelExp": { + "type": "long" + }, + "tcpWindowScale": { + "type": "long" + }, + "biflowDirection": { + "type": "long" + }, + "ethernetHeaderLength": { + "type": "long" + }, + "ethernetPayloadLength": { + "type": "long" + }, + "ethernetTotalLength": { + "type": "long" + }, + "dot1qVlanId": { + "type": "long" + }, + "dot1qPriority": { + "type": "long" + }, + "dot1qCustomerVlanId": { + "type": "long" + }, + "dot1qCustomerPriority": { + "type": "long" + }, + "metroEvcId": { + "type": "keyword" + }, + "metroEvcType": { + "type": "long" + }, + "pseudoWireId": { + "type": "long" + }, + "pseudoWireType": { + "type": "long" + }, + "pseudoWireControlWord": { + "type": "long" + }, + "ingressPhysicalInterface": { + "type": "long" + }, + "egressPhysicalInterface": { + "type": "long" + }, + "postDot1qVlanId": { + "type": "long" + }, + "postDot1qCustomerVlanId": { + "type": "long" + }, + "ethernetType": { + "type": "long" + }, + "postIpPrecedence": { + "type": "long" + }, + "collectionTimeMilliseconds": { + "type": "long" + }, + "exportSctpStreamId": { + "type": "long" + }, + "maxExportSeconds": { + "type": "long" + }, + "maxFlowEndSeconds": { + "type": "long" + }, + "messageMD5Checksum": { + "type": "keyword" + }, + "messageScope": { + "type": "long" + }, + "minExportSeconds": { + "type": "long" + }, + "minFlowStartSeconds": { + "type": "long" + }, + "opaqueOctets": { + "type": "keyword" + }, + "sessionScope": { + "type": "long" + }, + "maxFlowEndMicroseconds": { + "type": "long" + }, + "maxFlowEndMilliseconds": { + "type": "long" + }, + "maxFlowEndNanoseconds": { + "type": "long" + }, + "minFlowStartMicroseconds": { + "type": "long" + }, + "minFlowStartMilliseconds": { + "type": "long" + }, + "minFlowStartNanoseconds": { + "type": "long" + }, + "collectorCertificate": { + "type": "keyword" + }, + "exporterCertificate": { + "type": "keyword" + }, + "dataRecordsReliability": { + "type": "long" + }, + "observationPointType": { + "type": "long" + }, + "newConnectionDeltaCount": { + "type": "long" + }, + "connectionSumDurationSeconds": { + "type": "long" + }, + "connectionTransactionId": { + "type": "long" + }, + "postNATSourceIPv6Address": { + "type": "ip" + }, + "postNATDestinationIPv6Address": { + "type": "ip" + }, + "natPoolId": { + "type": "long" + }, + "natPoolName": { + "type": "keyword" + }, + "anonymizationFlags": { + "type": "long" + }, + "anonymizationTechnique": { + "type": "long" + }, + "informationElementIndex": { + "type": "long" + }, + "p2pTechnology": { + "type": "keyword" + }, + "tunnelTechnology": { + "type": "keyword" + }, + "encryptedTechnology": { + "type": "keyword" + }, + "bgpValidityState": { + "type": "long" + }, + "IPSecSPI": { + "type": "long" + }, + "greKey": { + "type": "long" + }, + "natType": { + "type": "long" + }, + "initiatorPackets": { + "type": "long" + }, + "responderPackets": { + "type": "long" + }, + "observationDomainName": { + "type": "keyword" + }, + "selectionSequenceId": { + "type": "long" + }, + "selectorId": { + "type": "long" + }, + "informationElementId": { + "type": "long" + }, + "selectorAlgorithm": { + "type": "long" + }, + "samplingPacketInterval": { + "type": "long" + }, + "samplingPacketSpace": { + "type": "long" + }, + "samplingTimeInterval": { + "type": "long" + }, + "samplingTimeSpace": { + "type": "long" + }, + "samplingSize": { + "type": "long" + }, + "samplingPopulation": { + "type": "long" + }, + "samplingProbability": { + "type": "double" + }, + "dataLinkFrameSize": { + "type": "long" + }, + "ipHeaderPacketSection": { + "type": "keyword" + }, + "ipPayloadPacketSection": { + "type": "keyword" + }, + "dataLinkFrameSection": { + "type": "keyword" + }, + "mplsLabelStackSection": { + "type": "keyword" + }, + "mplsPayloadPacketSection": { + "type": "keyword" + }, + "selectorIdTotalPktsObserved": { + "type": "long" + }, + "selectorIdTotalPktsSelected": { + "type": "long" + }, + "absoluteError": { + "type": "double" + }, + "relativeError": { + "type": "double" + }, + "observationTimeSeconds": { + "type": "long" + }, + "observationTimeMilliseconds": { + "type": "long" + }, + "observationTimeMicroseconds": { + "type": "long" + }, + "observationTimeNanoseconds": { + "type": "long" + }, + "digestHashValue": { + "type": "long" + }, + "hashIPPayloadOffset": { + "type": "long" + }, + "hashIPPayloadSize": { + "type": "long" + }, + "hashOutputRangeMin": { + "type": "long" + }, + "hashOutputRangeMax": { + "type": "long" + }, + "hashSelectedRangeMin": { + "type": "long" + }, + "hashSelectedRangeMax": { + "type": "long" + }, + "hashDigestOutput": { + "type": "long" + }, + "hashInitialiserValue": { + "type": "long" + }, + "selectorName": { + "type": "keyword" + }, + "upperCILimit": { + "type": "double" + }, + "lowerCILimit": { + "type": "double" + }, + "confidenceLevel": { + "type": "double" + }, + "informationElementDataType": { + "type": "long" + }, + "informationElementDescription": { + "type": "keyword" + }, + "informationElementName": { + "type": "keyword" + }, + "informationElementRangeBegin": { + "type": "long" + }, + "informationElementRangeEnd": { + "type": "long" + }, + "informationElementSemantics": { + "type": "long" + }, + "informationElementUnits": { + "type": "long" + }, + "privateEnterpriseNumber": { + "type": "long" + }, + "virtualStationInterfaceId": { + "type": "keyword" + }, + "virtualStationInterfaceName": { + "type": "keyword" + }, + "virtualStationUUID": { + "type": "keyword" + }, + "virtualStationName": { + "type": "keyword" + }, + "layer2SegmentId": { + "type": "long" + }, + "layer2OctetDeltaCount": { + "type": "long" + }, + "layer2OctetTotalCount": { + "type": "long" + }, + "ingressUnicastPacketTotalCount": { + "type": "long" + }, + "ingressMulticastPacketTotalCount": { + "type": "long" + }, + "ingressBroadcastPacketTotalCount": { + "type": "long" + }, + "egressUnicastPacketTotalCount": { + "type": "long" + }, + "egressBroadcastPacketTotalCount": { + "type": "long" + }, + "monitoringIntervalStartMilliSeconds": { + "type": "long" + }, + "monitoringIntervalEndMilliSeconds": { + "type": "long" + }, + "portRangeStart": { + "type": "long" + }, + "portRangeEnd": { + "type": "long" + }, + "portRangeStepSize": { + "type": "long" + }, + "portRangeNumPorts": { + "type": "long" + }, + "staMacAddress": { + "type": "keyword" + }, + "staIPv4Address": { + "type": "ip" + }, + "wtpMacAddress": { + "type": "keyword" + }, + "ingressInterfaceType": { + "type": "long" + }, + "egressInterfaceType": { + "type": "long" + }, + "rtpSequenceNumber": { + "type": "long" + }, + "userName": { + "type": "keyword" + }, + "applicationCategoryName": { + "type": "keyword" + }, + "applicationSubCategoryName": { + "type": "keyword" + }, + "applicationGroupName": { + "type": "keyword" + }, + "originalFlowsPresent": { + "type": "long" + }, + "originalFlowsInitiated": { + "type": "long" + }, + "originalFlowsCompleted": { + "type": "long" + }, + "distinctCountOfSourceIPAddress": { + "type": "long" + }, + "distinctCountOfDestinationIPAddress": { + "type": "long" + }, + "distinctCountOfSourceIPv4Address": { + "type": "long" + }, + "distinctCountOfDestinationIPv4Address": { + "type": "long" + }, + "distinctCountOfSourceIPv6Address": { + "type": "long" + }, + "distinctCountOfDestinationIPv6Address": { + "type": "long" + }, + "valueDistributionMethod": { + "type": "long" + }, + "rfc3550JitterMilliseconds": { + "type": "long" + }, + "rfc3550JitterMicroseconds": { + "type": "long" + }, + "rfc3550JitterNanoseconds": { + "type": "long" + }, + "dot1qDEI": { + "type": "long" + }, + "dot1qCustomerDEI": { + "type": "long" + }, + "flowSelectorAlgorithm": { + "type": "long" + }, + "flowSelectedOctetDeltaCount": { + "type": "long" + }, + "flowSelectedPacketDeltaCount": { + "type": "long" + }, + "flowSelectedFlowDeltaCount": { + "type": "long" + }, + "selectorIDTotalFlowsObserved": { + "type": "long" + }, + "selectorIDTotalFlowsSelected": { + "type": "long" + }, + "samplingFlowInterval": { + "type": "long" + }, + "samplingFlowSpacing": { + "type": "long" + }, + "flowSamplingTimeInterval": { + "type": "long" + }, + "flowSamplingTimeSpacing": { + "type": "long" + }, + "hashFlowDomain": { + "type": "long" + }, + "transportOctetDeltaCount": { + "type": "long" + }, + "transportPacketDeltaCount": { + "type": "long" + }, + "originalExporterIPv4Address": { + "type": "ip" + }, + "originalExporterIPv6Address": { + "type": "ip" + }, + "originalObservationDomainId": { + "type": "long" + }, + "intermediateProcessId": { + "type": "long" + }, + "ignoredDataRecordTotalCount": { + "type": "long" + }, + "dataLinkFrameType": { + "type": "long" + }, + "sectionOffset": { + "type": "long" + }, + "sectionExportedOctets": { + "type": "long" + }, + "dot1qServiceInstanceTag": { + "type": "keyword" + }, + "dot1qServiceInstanceId": { + "type": "long" + }, + "dot1qServiceInstancePriority": { + "type": "long" + }, + "dot1qCustomerSourceMacAddress": { + "type": "keyword" + }, + "dot1qCustomerDestinationMacAddress": { + "type": "keyword" + }, + "postLayer2OctetDeltaCount": { + "type": "long" + }, + "postMCastLayer2OctetDeltaCount": { + "type": "long" + }, + "postLayer2OctetTotalCount": { + "type": "long" + }, + "postMCastLayer2OctetTotalCount": { + "type": "long" + }, + "minimumLayer2TotalLength": { + "type": "long" + }, + "maximumLayer2TotalLength": { + "type": "long" + }, + "droppedLayer2OctetDeltaCount": { + "type": "long" + }, + "droppedLayer2OctetTotalCount": { + "type": "long" + }, + "ignoredLayer2OctetTotalCount": { + "type": "long" + }, + "notSentLayer2OctetTotalCount": { + "type": "long" + }, + "layer2OctetDeltaSumOfSquares": { + "type": "long" + }, + "layer2OctetTotalSumOfSquares": { + "type": "long" + }, + "layer2FrameDeltaCount": { + "type": "long" + }, + "layer2FrameTotalCount": { + "type": "long" + }, + "pseudoWireDestinationIPv4Address": { + "type": "ip" + }, + "ignoredLayer2FrameTotalCount": { + "type": "long" + }, + "mibObjectValueInteger": { + "type": "long" + }, + "mibObjectValueOctetString": { + "type": "keyword" + }, + "mibObjectValueOID": { + "type": "keyword" + }, + "mibObjectValueBits": { + "type": "keyword" + }, + "mibObjectValueIPAddress": { + "type": "ip" + }, + "mibObjectValueCounter": { + "type": "long" + }, + "mibObjectValueGauge": { + "type": "long" + }, + "mibObjectValueTimeTicks": { + "type": "long" + }, + "mibObjectValueUnsigned": { + "type": "long" + }, + "mibObjectValueTable": { + "type": "keyword" + }, + "mibObjectValueRow": { + "type": "keyword" + }, + "mibObjectIdentifier": { + "type": "keyword" + }, + "mibSubIdentifier": { + "type": "long" + }, + "mibIndexIndicator": { + "type": "long" + }, + "mibCaptureTimeSemantics": { + "type": "long" + }, + "mibContextEngineID": { + "type": "keyword" + }, + "mibContextName": { + "type": "keyword" + }, + "mibObjectName": { + "type": "keyword" + }, + "mibObjectDescription": { + "type": "keyword" + }, + "mibObjectSyntax": { + "type": "keyword" + }, + "mibModuleName": { + "type": "keyword" + }, + "mobileIMSI": { + "type": "keyword" + }, + "mobileMSISDN": { + "type": "keyword" + }, + "httpStatusCode": { + "type": "long" + }, + "sourceTransportPortsLimit": { + "type": "long" + }, + "httpRequestMethod": { + "type": "keyword" + }, + "httpRequestHost": { + "type": "keyword" + }, + "httpRequestTarget": { + "type": "keyword" + }, + "httpMessageVersion": { + "type": "keyword" + }, + "natInstanceID": { + "type": "long" + }, + "internalAddressRealm": { + "type": "keyword" + }, + "externalAddressRealm": { + "type": "keyword" + }, + "natQuotaExceededEvent": { + "type": "long" + }, + "natThresholdEvent": { + "type": "long" + }, + "httpUserAgent": { + "type": "keyword" + }, + "httpContentType": { + "type": "keyword" + }, + "httpReasonPhrase": { + "type": "keyword" + }, + "maxSessionEntries": { + "type": "long" + }, + "maxBIBEntries": { + "type": "long" + }, + "maxEntriesPerUser": { + "type": "long" + }, + "maxSubscribers": { + "type": "long" + }, + "maxFragmentsPendingReassembly": { + "type": "long" + }, + "addressPoolHighThreshold": { + "type": "long" + }, + "addressPoolLowThreshold": { + "type": "long" + }, + "addressPortMappingHighThreshold": { + "type": "long" + }, + "addressPortMappingLowThreshold": { + "type": "long" + }, + "addressPortMappingPerUserHighThreshold": { + "type": "long" + }, + "globalAddressMappingHighThreshold": { + "type": "long" + }, + "vpnIdentifier": { + "type": "keyword" + }, - "reverseOctetDeltaCount": { - "type": "long" - }, - "reversePacketDeltaCount": { - "type": "long" - }, - "reverseDeltaFlowCount": { - "type": "long" - }, - "reverseProtocolIdentifier": { - "type": "long" - }, - "reverseIpClassOfService": { - "type": "long" - }, - "reverseTcpControlBits": { - "type": "long" - }, - "reverseSourceTransportPort": { - "type": "long" - }, - "reverseSourceIPv4Address": { - "type": "ip" - }, - "reverseSourceIPv4PrefixLength": { - "type": "long" - }, - "reverseIngressInterface": { - "type": "long" - }, - "reverseDestinationTransportPort": { - "type": "long" - }, - "reverseDestinationIPv4Address": { - "type": "ip" - }, - "reverseDestinationIPv4PrefixLength": { - "type": "long" - }, - "reverseEgressInterface": { - "type": "long" - }, - "reverseIpNextHopIPv4Address": { - "type": "ip" - }, - "reverseBgpSourceAsNumber": { - "type": "long" - }, - "reverseBgpDestinationAsNumber": { - "type": "long" - }, - "reverseBgpNextHopIPv4Address": { - "type": "ip" - }, - "reversePostMCastPacketDeltaCount": { - "type": "long" - }, - "reversePostMCastOctetDeltaCount": { - "type": "long" - }, - "reverseFlowEndSysUpTime": { - "type": "long" - }, - "reverseFlowStartSysUpTime": { - "type": "long" - }, - "reversePostOctetDeltaCount": { - "type": "long" - }, - "reversePostPacketDeltaCount": { - "type": "long" - }, - "reverseMinimumIpTotalLength": { - "type": "long" - }, - "reverseMaximumIpTotalLength": { - "type": "long" - }, - "reverseSourceIPv6Address": { - "type": "ip" - }, - "reverseDestinationIPv6Address": { - "type": "ip" - }, - "reverseSourceIPv6PrefixLength": { - "type": "long" - }, - "reverseDestinationIPv6PrefixLength": { - "type": "long" - }, - "reverseFlowLabelIPv6": { - "type": "long" - }, - "reverseIcmpTypeCodeIPv4": { - "type": "long" - }, - "reverseIgmpType": { - "type": "long" - }, - "reverseSamplingInterval": { - "type": "long" - }, - "reverseSamplingAlgorithm": { - "type": "long" - }, - "reverseFlowActiveTimeout": { - "type": "long" - }, - "reverseFlowIdleTimeout": { - "type": "long" - }, - "reverseEngineType": { - "type": "long" - }, - "reverseEngineId": { - "type": "long" - }, - "reverseIpv4RouterSc": { - "type": "ip" - }, - "reverseSourceIPv4Prefix": { - "type": "ip" - }, - "reverseDestinationIPv4Prefix": { - "type": "ip" - }, - "reverseMplsTopLabelType": { - "type": "long" - }, - "reverseMplsTopLabelIPv4Address": { - "type": "ip" - }, - "reverseSamplerId": { - "type": "long" - }, - "reverseSamplerMode": { - "type": "long" - }, - "reverseSamplerRandomInterval": { - "type": "long" - }, - "reverseClassId": { - "type": "long" - }, - "reverseMinimumTTL": { - "type": "long" - }, - "reverseMaximumTTL": { - "type": "long" - }, - "reverseFragmentIdentification": { - "type": "long" - }, - "reversePostIpClassOfService": { - "type": "long" - }, - "reverseSourceMacAddress": { - "type": "keyword" - }, - "reversePostDestinationMacAddress": { - "type": "keyword" - }, - "reverseVlanId": { - "type": "long" - }, - "reversePostVlanId": { - "type": "long" - }, - "reverseIpVersion": { - "type": "long" - }, - "reverseFlowDirection": { - "type": "long" - }, - "reverseIpNextHopIPv6Address": { - "type": "ip" - }, - "reverseBgpNextHopIPv6Address": { - "type": "ip" - }, - "reverseIpv6ExtensionHeaders": { - "type": "long" - }, - "reverseMplsTopLabelStackSection": { - "type": "keyword" - }, - "reverseMplsLabelStackSection2": { - "type": "keyword" - }, - "reverseMplsLabelStackSection3": { - "type": "keyword" - }, - "reverseMplsLabelStackSection4": { - "type": "keyword" - }, - "reverseMplsLabelStackSection5": { - "type": "keyword" - }, - "reverseMplsLabelStackSection6": { - "type": "keyword" - }, - "reverseMplsLabelStackSection7": { - "type": "keyword" - }, - "reverseMplsLabelStackSection8": { - "type": "keyword" - }, - "reverseMplsLabelStackSection9": { - "type": "keyword" - }, - "reverseMplsLabelStackSection10": { - "type": "keyword" - }, - "reverseDestinationMacAddress": { - "type": "keyword" - }, - "reversePostSourceMacAddress": { - "type": "keyword" - }, - "reverseInterfaceName": { - "type": "keyword" - }, - "reverseInterfaceDescription": { - "type": "keyword" - }, - "reverseSamplerName": { - "type": "keyword" - }, - "reverseOctetTotalCount": { - "type": "long" - }, - "reversePacketTotalCount": { - "type": "long" - }, - "reverseFlagsAndSamplerId": { - "type": "long" - }, - "reverseFragmentOffset": { - "type": "long" - }, - "reverseForwardingStatus": { - "type": "long" - }, - "reverseMplsVpnRouteDistinguisher": { - "type": "keyword" - }, - "reverseMplsTopLabelPrefixLength": { - "type": "long" - }, - "reverseSrcTrafficIndex": { - "type": "long" - }, - "reverseDstTrafficIndex": { - "type": "long" - }, - "reverseApplicationDescription": { - "type": "keyword" - }, - "reverseApplicationId": { - "type": "keyword" - }, - "reverseApplicationName": { - "type": "keyword" - }, - "reversePostIpDiffServCodePoint": { - "type": "long" - }, - "reverseMulticastReplicationFactor": { - "type": "long" - }, - "reverseClassName": { - "type": "keyword" - }, - "reverseClassificationEngineId": { - "type": "long" - }, - "reverseLayer2packetSectionOffset": { - "type": "long" - }, - "reverseLayer2packetSectionSize": { - "type": "long" - }, - "reverseLayer2packetSectionData": { - "type": "keyword" - }, - "reverseBgpNextAdjacentAsNumber": { - "type": "long" - }, - "reverseBgpPrevAdjacentAsNumber": { - "type": "long" - }, - "reverseDroppedOctetDeltaCount": { - "type": "long" - }, - "reverseDroppedPacketDeltaCount": { - "type": "long" - }, - "reverseDroppedPacketTotalCount": { - "type": "long" - }, - "reverseDroppedOctetTotalCount": { - "type": "long" - }, - "reverseFlowEndReason": { - "type": "long" - }, - "reverseObservationPointId": { - "type": "long" - }, - "reverseIcmpTypeCodeIPv6": { - "type": "long" - }, - "reverseMplsTopLabelIPv6Address": { - "type": "ip" - }, - "reverseLineCardId": { - "type": "long" - }, - "reversePortId": { - "type": "long" - }, - "reverseMeteringProcessId": { - "type": "long" - }, - "reverseExportingProcessId": { - "type": "long" - }, - "reverseWlanChannelId": { - "type": "long" - }, - "reverseWlanSSID": { - "type": "keyword" - }, - "reverseFlowStartSeconds": { - "type": "long" - }, - "reverseFlowEndSeconds": { - "type": "long" - }, - "reverseFlowStartMilliseconds": { - "type": "long" - }, - "reverseFlowEndMilliseconds": { - "type": "long" - }, - "reverseFlowStartMicroseconds": { - "type": "long" - }, - "reverseFlowEndMicroseconds": { - "type": "long" - }, - "reverseFlowStartNanoseconds": { - "type": "long" - }, - "reverseFlowEndNanoseconds": { - "type": "long" - }, - "reverseFlowStartDeltaMicroseconds": { - "type": "long" - }, - "reverseFlowEndDeltaMicroseconds": { - "type": "long" - }, - "reverseSystemInitTimeMilliseconds": { - "type": "long" - }, - "reverseFlowDurationMilliseconds": { - "type": "long" - }, - "reverseFlowDurationMicroseconds": { - "type": "long" - }, - "reverseDestinationIPv6Prefix": { - "type": "ip" - }, - "reverseSourceIPv6Prefix": { - "type": "ip" - }, - "reversePostOctetTotalCount": { - "type": "long" - }, - "reversePostPacketTotalCount": { - "type": "long" - }, - "reversePostMCastPacketTotalCount": { - "type": "long" - }, - "reversePostMCastOctetTotalCount": { - "type": "long" - }, - "reverseIcmpTypeIPv4": { - "type": "long" - }, - "reverseIcmpCodeIPv4": { - "type": "long" - }, - "reverseIcmpTypeIPv6": { - "type": "long" - }, - "reverseIcmpCodeIPv6": { - "type": "long" - }, - "reverseUdpSourcePort": { - "type": "long" - }, - "reverseUdpDestinationPort": { - "type": "long" - }, - "reverseTcpSourcePort": { - "type": "long" - }, - "reverseTcpDestinationPort": { - "type": "long" - }, - "reverseTcpSequenceNumber": { - "type": "long" - }, - "reverseTcpAcknowledgementNumber": { - "type": "long" - }, - "reverseTcpWindowSize": { - "type": "long" - }, - "reverseTcpUrgentPointer": { - "type": "long" - }, - "reverseTcpHeaderLength": { - "type": "long" - }, - "reverseIpHeaderLength": { - "type": "long" - }, - "reverseTotalLengthIPv4": { - "type": "long" - }, - "reversePayloadLengthIPv6": { - "type": "long" - }, - "reverseIpTTL": { - "type": "long" - }, - "reverseNextHeaderIPv6": { - "type": "long" - }, - "reverseMplsPayloadLength": { - "type": "long" - }, - "reverseIpDiffServCodePoint": { - "type": "long" - }, - "reverseIpPrecedence": { - "type": "long" - }, - "reverseFragmentFlags": { - "type": "long" - }, - "reverseOctetDeltaSumOfSquares": { - "type": "long" - }, - "reverseOctetTotalSumOfSquares": { - "type": "long" - }, - "reverseMplsTopLabelTTL": { - "type": "long" - }, - "reverseMplsLabelStackLength": { - "type": "long" - }, - "reverseMplsLabelStackDepth": { - "type": "long" - }, - "reverseMplsTopLabelExp": { - "type": "long" - }, - "reverseIpPayloadLength": { - "type": "long" - }, - "reverseUdpMessageLength": { - "type": "long" - }, - "reverseIsMulticast": { - "type": "long" - }, - "reverseIpv4IHL": { - "type": "long" - }, - "reverseIpv4Options": { - "type": "long" - }, - "reverseTcpOptions": { - "type": "long" - }, - "reverseTcpSynTotalCount": { - "type": "long" - }, - "reverseTcpFinTotalCount": { - "type": "long" - }, - "reverseTcpRstTotalCount": { - "type": "long" - }, - "reverseTcpPshTotalCount": { - "type": "long" - }, - "reverseTcpAckTotalCount": { - "type": "long" - }, - "reverseTcpUrgTotalCount": { - "type": "long" - }, - "reverseIpTotalLength": { - "type": "long" - }, - "reversePostNATSourceIPv4Address": { - "type": "ip" - }, - "reversePostNATDestinationIPv4Address": { - "type": "ip" - }, - "reversePostNAPTSourceTransportPort": { - "type": "long" - }, - "reversePostNAPTDestinationTransportPort": { - "type": "long" - }, - "reverseNatOriginatingAddressRealm": { - "type": "long" - }, - "reverseNatEvent": { - "type": "long" - }, - "reverseInitiatorOctets": { - "type": "long" - }, - "reverseResponderOctets": { - "type": "long" - }, - "reverseFirewallEvent": { - "type": "long" - }, - "reverseIngressVRFID": { - "type": "long" - }, - "reverseEgressVRFID": { - "type": "long" - }, - "reverseVRFname": { - "type": "keyword" - }, - "reversePostMplsTopLabelExp": { - "type": "long" - }, - "reverseTcpWindowScale": { - "type": "long" - }, - "reverseEthernetHeaderLength": { - "type": "long" - }, - "reverseEthernetPayloadLength": { - "type": "long" - }, - "reverseEthernetTotalLength": { - "type": "long" - }, - "reverseDot1qVlanId": { - "type": "long" - }, - "reverseDot1qPriority": { - "type": "long" - }, - "reverseDot1qCustomerVlanId": { - "type": "long" - }, - "reverseDot1qCustomerPriority": { - "type": "long" - }, - "reverseMetroEvcId": { - "type": "keyword" - }, - "reverseMetroEvcType": { - "type": "long" - }, - "reversePseudoWireId": { - "type": "long" - }, - "reversePseudoWireType": { - "type": "long" - }, - "reversePseudoWireControlWord": { - "type": "long" - }, - "reverseIngressPhysicalInterface": { - "type": "long" - }, - "reverseEgressPhysicalInterface": { - "type": "long" - }, - "reversePostDot1qVlanId": { - "type": "long" - }, - "reversePostDot1qCustomerVlanId": { - "type": "long" - }, - "reverseEthernetType": { - "type": "long" - }, - "reversePostIpPrecedence": { - "type": "long" - }, - "reverseCollectionTimeMilliseconds": { - "type": "long" - }, - "reverseExportSctpStreamId": { - "type": "long" - }, - "reverseMaxExportSeconds": { - "type": "long" - }, - "reverseMaxFlowEndSeconds": { - "type": "long" - }, - "reverseMessageMD5Checksum": { - "type": "keyword" - }, - "reverseMessageScope": { - "type": "long" - }, - "reverseMinExportSeconds": { - "type": "long" - }, - "reverseMinFlowStartSeconds": { - "type": "long" - }, - "reverseOpaqueOctets": { - "type": "keyword" - }, - "reverseSessionScope": { - "type": "long" - }, - "reverseMaxFlowEndMicroseconds": { - "type": "long" - }, - "reverseMaxFlowEndMilliseconds": { - "type": "long" - }, - "reverseMaxFlowEndNanoseconds": { - "type": "long" - }, - "reverseMinFlowStartMicroseconds": { - "type": "long" - }, - "reverseMinFlowStartMilliseconds": { - "type": "long" - }, - "reverseMinFlowStartNanoseconds": { - "type": "long" - }, - "reverseCollectorCertificate": { - "type": "keyword" - }, - "reverseExporterCertificate": { - "type": "keyword" - }, - "reverseDataRecordsReliability": { - "type": "long" - }, - "reverseObservationPointType": { - "type": "long" - }, - "reverseNewConnectionDeltaCount": { - "type": "long" - }, - "reverseConnectionSumDurationSeconds": { - "type": "long" - }, - "reverseConnectionTransactionId": { - "type": "long" - }, - "reversePostNATSourceIPv6Address": { - "type": "ip" - }, - "reversePostNATDestinationIPv6Address": { - "type": "ip" - }, - "reverseNatPoolId": { - "type": "long" - }, - "reverseNatPoolName": { - "type": "keyword" - }, - "reverseAnonymizationFlags": { - "type": "long" - }, - "reverseAnonymizationTechnique": { - "type": "long" - }, - "reverseInformationElementIndex": { - "type": "long" - }, - "reverseP2pTechnology": { - "type": "keyword" - }, - "reverseTunnelTechnology": { - "type": "keyword" - }, - "reverseEncryptedTechnology": { - "type": "keyword" - }, - "reverseBgpValidityState": { - "type": "long" - }, - "reverseIPSecSPI": { - "type": "long" - }, - "reverseGreKey": { - "type": "long" - }, - "reverseNatType": { - "type": "long" - }, - "reverseInitiatorPackets": { - "type": "long" - }, - "reverseResponderPackets": { - "type": "long" - }, - "reverseObservationDomainName": { - "type": "keyword" - }, - "reverseSelectionSequenceId": { - "type": "long" - }, - "reverseSelectorId": { - "type": "long" - }, - "reverseInformationElementId": { - "type": "long" - }, - "reverseSelectorAlgorithm": { - "type": "long" - }, - "reverseSamplingPacketInterval": { - "type": "long" - }, - "reverseSamplingPacketSpace": { - "type": "long" - }, - "reverseSamplingTimeInterval": { - "type": "long" - }, - "reverseSamplingTimeSpace": { - "type": "long" - }, - "reverseSamplingSize": { - "type": "long" - }, - "reverseSamplingPopulation": { - "type": "long" - }, - "reverseSamplingProbability": { - "type": "long" - }, - "reverseDataLinkFrameSize": { - "type": "long" - }, - "reverseIpHeaderPacketSection": { - "type": "keyword" - }, - "reverseIpPayloadPacketSection": { - "type": "keyword" - }, - "reverseDataLinkFrameSection": { - "type": "keyword" - }, - "reverseMplsLabelStackSection": { - "type": "keyword" - }, - "reverseMplsPayloadPacketSection": { - "type": "keyword" - }, - "reverseSelectorIdTotalPktsObserved": { - "type": "long" - }, - "reverseSelectorIdTotalPktsSelected": { - "type": "long" - }, - "reverseAbsoluteError": { - "type": "double" - }, - "reverseRelativeError": { - "type": "double" - }, - "reverseObservationTimeSeconds": { - "type": "long" - }, - "reverseObservationTimeMilliseconds": { - "type": "long" - }, - "reverseObservationTimeMicroseconds": { - "type": "long" - }, - "reverseObservationTimeNanoseconds": { - "type": "long" - }, - "reverseDigestHashValue": { - "type": "long" - }, - "reverseHashIPPayloadOffset": { - "type": "long" - }, - "reverseHashIPPayloadSize": { - "type": "long" - }, - "reverseHashOutputRangeMin": { - "type": "long" - }, - "reverseHashOutputRangeMax": { - "type": "long" - }, - "reverseHashSelectedRangeMin": { - "type": "long" - }, - "reverseHashSelectedRangeMax": { - "type": "long" - }, - "reverseHashDigestOutput": { - "type": "long" - }, - "reverseHashInitialiserValue": { - "type": "long" - }, - "reverseSelectorName": { - "type": "keyword" - }, - "reverseUpperCILimit": { - "type": "double" - }, - "reverseLowerCILimit": { - "type": "double" - }, - "reverseConfidenceLevel": { - "type": "double" - }, - "reverseInformationElementDataType": { - "type": "long" - }, - "reverseInformationElementDescription": { - "type": "keyword" - }, - "reverseInformationElementName": { - "type": "keyword" - }, - "reverseInformationElementRangeBegin": { - "type": "long" - }, - "reverseInformationElementRangeEnd": { - "type": "long" - }, - "reverseInformationElementSemantics": { - "type": "long" - }, - "reverseInformationElementUnits": { - "type": "long" - }, - "reversePrivateEnterpriseNumber": { - "type": "long" - }, - "reverseVirtualStationInterfaceId": { - "type": "long" - }, - "reverseVirtualStationInterfaceName": { - "type": "keyword" - }, - "reverseVirtualStationUUID": { - "type": "keyword" - }, - "reverseVirtualStationName": { - "type": "keyword" - }, - "reverseLayer2SegmentId": { - "type": "long" - }, - "reverseLayer2OctetDeltaCount": { - "type": "long" - }, - "reverseLayer2OctetTotalCount": { - "type": "long" - }, - "reverseIngressUnicastPacketTotalCount": { - "type": "long" - }, - "reverseIngressMulticastPacketTotalCount": { - "type": "long" - }, - "reverseIngressBroadcastPacketTotalCount": { - "type": "long" - }, - "reverseEgressUnicastPacketTotalCount": { - "type": "long" - }, - "reverseEgressBroadcastPacketTotalCount": { - "type": "long" - }, - "reverseMonitoringIntervalStartMilliSeconds": { - "type": "long" - }, - "reverseMonitoringIntervalEndMilliSeconds": { - "type": "long" - }, - "reversePortRangeStart": { - "type": "long" - }, - "reversePortRangeEnd": { - "type": "long" - }, - "reversePortRangeStepSize": { - "type": "long" - }, - "reversePortRangeNumPorts": { - "type": "long" - }, - "reverseStaMacAddress": { - "type": "keyword" - }, - "reverseStaIPv4Address": { - "type": "ip" - }, - "reverseWtpMacAddress": { - "type": "keyword" - }, - "reverseIngressInterfaceType": { - "type": "long" - }, - "reverseEgressInterfaceType": { - "type": "long" - }, - "reverseRtpSequenceNumber": { - "type": "long" - }, - "reverseUserName": { - "type": "keyword" - }, - "reverseApplicationCategoryName": { - "type": "keyword" - }, - "reverseApplicationSubCategoryName": { - "type": "keyword" - }, - "reverseApplicationGroupName": { - "type": "keyword" - }, - "reverseOriginalFlowsPresent": { - "type": "long" - }, - "reverseOriginalFlowsInitiated": { - "type": "long" - }, - "reverseOriginalFlowsCompleted": { - "type": "long" - }, - "reverseDistinctCountOfSourceIPAddress": { - "type": "long" - }, - "reverseDistinctCountOfDestinationIPAddress": { - "type": "long" - }, - "reverseDistinctCountOfSourceIPv4Address": { - "type": "long" - }, - "reverseDistinctCountOfDestinationIPv4Address": { - "type": "long" - }, - "reverseDistinctCountOfSourceIPv6Address": { - "type": "long" - }, - "reverseDistinctCountOfDestinationIPv6Address": { - "type": "long" - }, - "reverseValueDistributionMethod": { - "type": "long" - }, - "reverseRfc3550JitterMilliseconds": { - "type": "long" - }, - "reverseRfc3550JitterMicroseconds": { - "type": "long" - }, - "reverseRfc3550JitterNanoseconds": { - "type": "long" - }, - "reverseDot1qDEI": { - "type": "long" - }, - "reverseDot1qCustomerDEI": { - "type": "long" - }, - "reverseFlowSelectorAlgorithm": { - "type": "long" - }, - "reverseFlowSelectedOctetDeltaCount": { - "type": "long" - }, - "reverseFlowSelectedPacketDeltaCount": { - "type": "long" - }, - "reverseFlowSelectedFlowDeltaCount": { - "type": "long" - }, - "reverseSelectorIDTotalFlowsObserved": { - "type": "long" - }, - "reverseSelectorIDTotalFlowsSelected": { - "type": "long" - }, - "reverseSamplingFlowInterval": { - "type": "long" - }, - "reverseSamplingFlowSpacing": { - "type": "long" - }, - "reverseFlowSamplingTimeInterval": { - "type": "long" - }, - "reverseFlowSamplingTimeSpacing": { - "type": "long" - }, - "reverseHashFlowDomain": { - "type": "long" - }, - "reverseTransportOctetDeltaCount": { - "type": "long" - }, - "reverseTransportPacketDeltaCount": { - "type": "long" - }, - "reverseOriginalExporterIPv4Address": { - "type": "ip" - }, - "reverseOriginalExporterIPv6Address": { - "type": "ip" - }, - "reverseOriginalObservationDomainId": { - "type": "long" - }, - "reverseIntermediateProcessId": { - "type": "long" - }, - "reverseIgnoredDataRecordTotalCount": { - "type": "long" - }, - "reverseDataLinkFrameType": { - "type": "long" - }, - "reverseSectionOffset": { - "type": "long" - }, - "reverseSectionExportedOctets": { - "type": "long" - }, - "reverseDot1qServiceInstanceTag": { - "type": "keyword" - }, - "reverseDot1qServiceInstanceId": { - "type": "long" - }, - "reverseDot1qServiceInstancePriority": { - "type": "long" - }, - "reverseDot1qCustomerSourceMacAddress": { - "type": "keyword" - }, - "reverseDot1qCustomerDestinationMacAddress": { - "type": "keyword" - }, - "reversePostLayer2OctetDeltaCount": { - "type": "long" - }, - "reversePostMCastLayer2OctetDeltaCount": { - "type": "long" - }, - "reversePostLayer2OctetTotalCount": { - "type": "long" - }, - "reversePostMCastLayer2OctetTotalCount": { - "type": "long" - }, - "reverseMinimumLayer2TotalLength": { - "type": "long" - }, - "reverseMaximumLayer2TotalLength": { - "type": "long" - }, - "reverseDroppedLayer2OctetDeltaCount": { - "type": "long" - }, - "reverseDroppedLayer2OctetTotalCount": { - "type": "long" - }, - "reverseIgnoredLayer2OctetTotalCount": { - "type": "long" - }, - "reverseNotSentLayer2OctetTotalCount": { - "type": "long" - }, - "reverseLayer2OctetDeltaSumOfSquares": { - "type": "long" - }, - "reverseLayer2OctetTotalSumOfSquares": { - "type": "long" - }, - "reverseLayer2FrameDeltaCount": { - "type": "long" - }, - "reverseLayer2FrameTotalCount": { - "type": "long" - }, - "reversePseudoWireDestinationIPv4Address": { - "type": "ip" - }, - "reverseIgnoredLayer2FrameTotalCount": { - "type": "long" - }, + "reverseOctetDeltaCount": { + "type": "long" + }, + "reversePacketDeltaCount": { + "type": "long" + }, + "reverseDeltaFlowCount": { + "type": "long" + }, + "reverseProtocolIdentifier": { + "type": "long" + }, + "reverseIpClassOfService": { + "type": "long" + }, + "reverseTcpControlBits": { + "type": "long" + }, + "reverseSourceTransportPort": { + "type": "long" + }, + "reverseSourceIPv4Address": { + "type": "ip" + }, + "reverseSourceIPv4PrefixLength": { + "type": "long" + }, + "reverseIngressInterface": { + "type": "long" + }, + "reverseDestinationTransportPort": { + "type": "long" + }, + "reverseDestinationIPv4Address": { + "type": "ip" + }, + "reverseDestinationIPv4PrefixLength": { + "type": "long" + }, + "reverseEgressInterface": { + "type": "long" + }, + "reverseIpNextHopIPv4Address": { + "type": "ip" + }, + "reverseBgpSourceAsNumber": { + "type": "long" + }, + "reverseBgpDestinationAsNumber": { + "type": "long" + }, + "reverseBgpNextHopIPv4Address": { + "type": "ip" + }, + "reversePostMCastPacketDeltaCount": { + "type": "long" + }, + "reversePostMCastOctetDeltaCount": { + "type": "long" + }, + "reverseFlowEndSysUpTime": { + "type": "long" + }, + "reverseFlowStartSysUpTime": { + "type": "long" + }, + "reversePostOctetDeltaCount": { + "type": "long" + }, + "reversePostPacketDeltaCount": { + "type": "long" + }, + "reverseMinimumIpTotalLength": { + "type": "long" + }, + "reverseMaximumIpTotalLength": { + "type": "long" + }, + "reverseSourceIPv6Address": { + "type": "ip" + }, + "reverseDestinationIPv6Address": { + "type": "ip" + }, + "reverseSourceIPv6PrefixLength": { + "type": "long" + }, + "reverseDestinationIPv6PrefixLength": { + "type": "long" + }, + "reverseFlowLabelIPv6": { + "type": "long" + }, + "reverseIcmpTypeCodeIPv4": { + "type": "long" + }, + "reverseIgmpType": { + "type": "long" + }, + "reverseSamplingInterval": { + "type": "long" + }, + "reverseSamplingAlgorithm": { + "type": "long" + }, + "reverseFlowActiveTimeout": { + "type": "long" + }, + "reverseFlowIdleTimeout": { + "type": "long" + }, + "reverseEngineType": { + "type": "long" + }, + "reverseEngineId": { + "type": "long" + }, + "reverseIpv4RouterSc": { + "type": "ip" + }, + "reverseSourceIPv4Prefix": { + "type": "ip" + }, + "reverseDestinationIPv4Prefix": { + "type": "ip" + }, + "reverseMplsTopLabelType": { + "type": "long" + }, + "reverseMplsTopLabelIPv4Address": { + "type": "ip" + }, + "reverseSamplerId": { + "type": "long" + }, + "reverseSamplerMode": { + "type": "long" + }, + "reverseSamplerRandomInterval": { + "type": "long" + }, + "reverseClassId": { + "type": "long" + }, + "reverseMinimumTTL": { + "type": "long" + }, + "reverseMaximumTTL": { + "type": "long" + }, + "reverseFragmentIdentification": { + "type": "long" + }, + "reversePostIpClassOfService": { + "type": "long" + }, + "reverseSourceMacAddress": { + "type": "keyword" + }, + "reversePostDestinationMacAddress": { + "type": "keyword" + }, + "reverseVlanId": { + "type": "long" + }, + "reversePostVlanId": { + "type": "long" + }, + "reverseIpVersion": { + "type": "long" + }, + "reverseFlowDirection": { + "type": "long" + }, + "reverseIpNextHopIPv6Address": { + "type": "ip" + }, + "reverseBgpNextHopIPv6Address": { + "type": "ip" + }, + "reverseIpv6ExtensionHeaders": { + "type": "long" + }, + "reverseMplsTopLabelStackSection": { + "type": "keyword" + }, + "reverseMplsLabelStackSection2": { + "type": "keyword" + }, + "reverseMplsLabelStackSection3": { + "type": "keyword" + }, + "reverseMplsLabelStackSection4": { + "type": "keyword" + }, + "reverseMplsLabelStackSection5": { + "type": "keyword" + }, + "reverseMplsLabelStackSection6": { + "type": "keyword" + }, + "reverseMplsLabelStackSection7": { + "type": "keyword" + }, + "reverseMplsLabelStackSection8": { + "type": "keyword" + }, + "reverseMplsLabelStackSection9": { + "type": "keyword" + }, + "reverseMplsLabelStackSection10": { + "type": "keyword" + }, + "reverseDestinationMacAddress": { + "type": "keyword" + }, + "reversePostSourceMacAddress": { + "type": "keyword" + }, + "reverseInterfaceName": { + "type": "keyword" + }, + "reverseInterfaceDescription": { + "type": "keyword" + }, + "reverseSamplerName": { + "type": "keyword" + }, + "reverseOctetTotalCount": { + "type": "long" + }, + "reversePacketTotalCount": { + "type": "long" + }, + "reverseFlagsAndSamplerId": { + "type": "long" + }, + "reverseFragmentOffset": { + "type": "long" + }, + "reverseForwardingStatus": { + "type": "long" + }, + "reverseMplsVpnRouteDistinguisher": { + "type": "keyword" + }, + "reverseMplsTopLabelPrefixLength": { + "type": "long" + }, + "reverseSrcTrafficIndex": { + "type": "long" + }, + "reverseDstTrafficIndex": { + "type": "long" + }, + "reverseApplicationDescription": { + "type": "keyword" + }, + "reverseApplicationId": { + "type": "keyword" + }, + "reverseApplicationName": { + "type": "keyword" + }, + "reversePostIpDiffServCodePoint": { + "type": "long" + }, + "reverseMulticastReplicationFactor": { + "type": "long" + }, + "reverseClassName": { + "type": "keyword" + }, + "reverseClassificationEngineId": { + "type": "long" + }, + "reverseLayer2packetSectionOffset": { + "type": "long" + }, + "reverseLayer2packetSectionSize": { + "type": "long" + }, + "reverseLayer2packetSectionData": { + "type": "keyword" + }, + "reverseBgpNextAdjacentAsNumber": { + "type": "long" + }, + "reverseBgpPrevAdjacentAsNumber": { + "type": "long" + }, + "reverseDroppedOctetDeltaCount": { + "type": "long" + }, + "reverseDroppedPacketDeltaCount": { + "type": "long" + }, + "reverseDroppedPacketTotalCount": { + "type": "long" + }, + "reverseDroppedOctetTotalCount": { + "type": "long" + }, + "reverseFlowEndReason": { + "type": "long" + }, + "reverseObservationPointId": { + "type": "long" + }, + "reverseIcmpTypeCodeIPv6": { + "type": "long" + }, + "reverseMplsTopLabelIPv6Address": { + "type": "ip" + }, + "reverseLineCardId": { + "type": "long" + }, + "reversePortId": { + "type": "long" + }, + "reverseMeteringProcessId": { + "type": "long" + }, + "reverseExportingProcessId": { + "type": "long" + }, + "reverseWlanChannelId": { + "type": "long" + }, + "reverseWlanSSID": { + "type": "keyword" + }, + "reverseFlowStartSeconds": { + "type": "long" + }, + "reverseFlowEndSeconds": { + "type": "long" + }, + "reverseFlowStartMilliseconds": { + "type": "long" + }, + "reverseFlowEndMilliseconds": { + "type": "long" + }, + "reverseFlowStartMicroseconds": { + "type": "long" + }, + "reverseFlowEndMicroseconds": { + "type": "long" + }, + "reverseFlowStartNanoseconds": { + "type": "long" + }, + "reverseFlowEndNanoseconds": { + "type": "long" + }, + "reverseFlowStartDeltaMicroseconds": { + "type": "long" + }, + "reverseFlowEndDeltaMicroseconds": { + "type": "long" + }, + "reverseSystemInitTimeMilliseconds": { + "type": "long" + }, + "reverseFlowDurationMilliseconds": { + "type": "long" + }, + "reverseFlowDurationMicroseconds": { + "type": "long" + }, + "reverseDestinationIPv6Prefix": { + "type": "ip" + }, + "reverseSourceIPv6Prefix": { + "type": "ip" + }, + "reversePostOctetTotalCount": { + "type": "long" + }, + "reversePostPacketTotalCount": { + "type": "long" + }, + "reversePostMCastPacketTotalCount": { + "type": "long" + }, + "reversePostMCastOctetTotalCount": { + "type": "long" + }, + "reverseIcmpTypeIPv4": { + "type": "long" + }, + "reverseIcmpCodeIPv4": { + "type": "long" + }, + "reverseIcmpTypeIPv6": { + "type": "long" + }, + "reverseIcmpCodeIPv6": { + "type": "long" + }, + "reverseUdpSourcePort": { + "type": "long" + }, + "reverseUdpDestinationPort": { + "type": "long" + }, + "reverseTcpSourcePort": { + "type": "long" + }, + "reverseTcpDestinationPort": { + "type": "long" + }, + "reverseTcpSequenceNumber": { + "type": "long" + }, + "reverseTcpAcknowledgementNumber": { + "type": "long" + }, + "reverseTcpWindowSize": { + "type": "long" + }, + "reverseTcpUrgentPointer": { + "type": "long" + }, + "reverseTcpHeaderLength": { + "type": "long" + }, + "reverseIpHeaderLength": { + "type": "long" + }, + "reverseTotalLengthIPv4": { + "type": "long" + }, + "reversePayloadLengthIPv6": { + "type": "long" + }, + "reverseIpTTL": { + "type": "long" + }, + "reverseNextHeaderIPv6": { + "type": "long" + }, + "reverseMplsPayloadLength": { + "type": "long" + }, + "reverseIpDiffServCodePoint": { + "type": "long" + }, + "reverseIpPrecedence": { + "type": "long" + }, + "reverseFragmentFlags": { + "type": "long" + }, + "reverseOctetDeltaSumOfSquares": { + "type": "long" + }, + "reverseOctetTotalSumOfSquares": { + "type": "long" + }, + "reverseMplsTopLabelTTL": { + "type": "long" + }, + "reverseMplsLabelStackLength": { + "type": "long" + }, + "reverseMplsLabelStackDepth": { + "type": "long" + }, + "reverseMplsTopLabelExp": { + "type": "long" + }, + "reverseIpPayloadLength": { + "type": "long" + }, + "reverseUdpMessageLength": { + "type": "long" + }, + "reverseIsMulticast": { + "type": "long" + }, + "reverseIpv4IHL": { + "type": "long" + }, + "reverseIpv4Options": { + "type": "long" + }, + "reverseTcpOptions": { + "type": "long" + }, + "reverseTcpSynTotalCount": { + "type": "long" + }, + "reverseTcpFinTotalCount": { + "type": "long" + }, + "reverseTcpRstTotalCount": { + "type": "long" + }, + "reverseTcpPshTotalCount": { + "type": "long" + }, + "reverseTcpAckTotalCount": { + "type": "long" + }, + "reverseTcpUrgTotalCount": { + "type": "long" + }, + "reverseIpTotalLength": { + "type": "long" + }, + "reversePostNATSourceIPv4Address": { + "type": "ip" + }, + "reversePostNATDestinationIPv4Address": { + "type": "ip" + }, + "reversePostNAPTSourceTransportPort": { + "type": "long" + }, + "reversePostNAPTDestinationTransportPort": { + "type": "long" + }, + "reverseNatOriginatingAddressRealm": { + "type": "long" + }, + "reverseNatEvent": { + "type": "long" + }, + "reverseInitiatorOctets": { + "type": "long" + }, + "reverseResponderOctets": { + "type": "long" + }, + "reverseFirewallEvent": { + "type": "long" + }, + "reverseIngressVRFID": { + "type": "long" + }, + "reverseEgressVRFID": { + "type": "long" + }, + "reverseVRFname": { + "type": "keyword" + }, + "reversePostMplsTopLabelExp": { + "type": "long" + }, + "reverseTcpWindowScale": { + "type": "long" + }, + "reverseEthernetHeaderLength": { + "type": "long" + }, + "reverseEthernetPayloadLength": { + "type": "long" + }, + "reverseEthernetTotalLength": { + "type": "long" + }, + "reverseDot1qVlanId": { + "type": "long" + }, + "reverseDot1qPriority": { + "type": "long" + }, + "reverseDot1qCustomerVlanId": { + "type": "long" + }, + "reverseDot1qCustomerPriority": { + "type": "long" + }, + "reverseMetroEvcId": { + "type": "keyword" + }, + "reverseMetroEvcType": { + "type": "long" + }, + "reversePseudoWireId": { + "type": "long" + }, + "reversePseudoWireType": { + "type": "long" + }, + "reversePseudoWireControlWord": { + "type": "long" + }, + "reverseIngressPhysicalInterface": { + "type": "long" + }, + "reverseEgressPhysicalInterface": { + "type": "long" + }, + "reversePostDot1qVlanId": { + "type": "long" + }, + "reversePostDot1qCustomerVlanId": { + "type": "long" + }, + "reverseEthernetType": { + "type": "long" + }, + "reversePostIpPrecedence": { + "type": "long" + }, + "reverseCollectionTimeMilliseconds": { + "type": "long" + }, + "reverseExportSctpStreamId": { + "type": "long" + }, + "reverseMaxExportSeconds": { + "type": "long" + }, + "reverseMaxFlowEndSeconds": { + "type": "long" + }, + "reverseMessageMD5Checksum": { + "type": "keyword" + }, + "reverseMessageScope": { + "type": "long" + }, + "reverseMinExportSeconds": { + "type": "long" + }, + "reverseMinFlowStartSeconds": { + "type": "long" + }, + "reverseOpaqueOctets": { + "type": "keyword" + }, + "reverseSessionScope": { + "type": "long" + }, + "reverseMaxFlowEndMicroseconds": { + "type": "long" + }, + "reverseMaxFlowEndMilliseconds": { + "type": "long" + }, + "reverseMaxFlowEndNanoseconds": { + "type": "long" + }, + "reverseMinFlowStartMicroseconds": { + "type": "long" + }, + "reverseMinFlowStartMilliseconds": { + "type": "long" + }, + "reverseMinFlowStartNanoseconds": { + "type": "long" + }, + "reverseCollectorCertificate": { + "type": "keyword" + }, + "reverseExporterCertificate": { + "type": "keyword" + }, + "reverseDataRecordsReliability": { + "type": "long" + }, + "reverseObservationPointType": { + "type": "long" + }, + "reverseNewConnectionDeltaCount": { + "type": "long" + }, + "reverseConnectionSumDurationSeconds": { + "type": "long" + }, + "reverseConnectionTransactionId": { + "type": "long" + }, + "reversePostNATSourceIPv6Address": { + "type": "ip" + }, + "reversePostNATDestinationIPv6Address": { + "type": "ip" + }, + "reverseNatPoolId": { + "type": "long" + }, + "reverseNatPoolName": { + "type": "keyword" + }, + "reverseAnonymizationFlags": { + "type": "long" + }, + "reverseAnonymizationTechnique": { + "type": "long" + }, + "reverseInformationElementIndex": { + "type": "long" + }, + "reverseP2pTechnology": { + "type": "keyword" + }, + "reverseTunnelTechnology": { + "type": "keyword" + }, + "reverseEncryptedTechnology": { + "type": "keyword" + }, + "reverseBgpValidityState": { + "type": "long" + }, + "reverseIPSecSPI": { + "type": "long" + }, + "reverseGreKey": { + "type": "long" + }, + "reverseNatType": { + "type": "long" + }, + "reverseInitiatorPackets": { + "type": "long" + }, + "reverseResponderPackets": { + "type": "long" + }, + "reverseObservationDomainName": { + "type": "keyword" + }, + "reverseSelectionSequenceId": { + "type": "long" + }, + "reverseSelectorId": { + "type": "long" + }, + "reverseInformationElementId": { + "type": "long" + }, + "reverseSelectorAlgorithm": { + "type": "long" + }, + "reverseSamplingPacketInterval": { + "type": "long" + }, + "reverseSamplingPacketSpace": { + "type": "long" + }, + "reverseSamplingTimeInterval": { + "type": "long" + }, + "reverseSamplingTimeSpace": { + "type": "long" + }, + "reverseSamplingSize": { + "type": "long" + }, + "reverseSamplingPopulation": { + "type": "long" + }, + "reverseSamplingProbability": { + "type": "long" + }, + "reverseDataLinkFrameSize": { + "type": "long" + }, + "reverseIpHeaderPacketSection": { + "type": "keyword" + }, + "reverseIpPayloadPacketSection": { + "type": "keyword" + }, + "reverseDataLinkFrameSection": { + "type": "keyword" + }, + "reverseMplsLabelStackSection": { + "type": "keyword" + }, + "reverseMplsPayloadPacketSection": { + "type": "keyword" + }, + "reverseSelectorIdTotalPktsObserved": { + "type": "long" + }, + "reverseSelectorIdTotalPktsSelected": { + "type": "long" + }, + "reverseAbsoluteError": { + "type": "double" + }, + "reverseRelativeError": { + "type": "double" + }, + "reverseObservationTimeSeconds": { + "type": "long" + }, + "reverseObservationTimeMilliseconds": { + "type": "long" + }, + "reverseObservationTimeMicroseconds": { + "type": "long" + }, + "reverseObservationTimeNanoseconds": { + "type": "long" + }, + "reverseDigestHashValue": { + "type": "long" + }, + "reverseHashIPPayloadOffset": { + "type": "long" + }, + "reverseHashIPPayloadSize": { + "type": "long" + }, + "reverseHashOutputRangeMin": { + "type": "long" + }, + "reverseHashOutputRangeMax": { + "type": "long" + }, + "reverseHashSelectedRangeMin": { + "type": "long" + }, + "reverseHashSelectedRangeMax": { + "type": "long" + }, + "reverseHashDigestOutput": { + "type": "long" + }, + "reverseHashInitialiserValue": { + "type": "long" + }, + "reverseSelectorName": { + "type": "keyword" + }, + "reverseUpperCILimit": { + "type": "double" + }, + "reverseLowerCILimit": { + "type": "double" + }, + "reverseConfidenceLevel": { + "type": "double" + }, + "reverseInformationElementDataType": { + "type": "long" + }, + "reverseInformationElementDescription": { + "type": "keyword" + }, + "reverseInformationElementName": { + "type": "keyword" + }, + "reverseInformationElementRangeBegin": { + "type": "long" + }, + "reverseInformationElementRangeEnd": { + "type": "long" + }, + "reverseInformationElementSemantics": { + "type": "long" + }, + "reverseInformationElementUnits": { + "type": "long" + }, + "reversePrivateEnterpriseNumber": { + "type": "long" + }, + "reverseVirtualStationInterfaceId": { + "type": "long" + }, + "reverseVirtualStationInterfaceName": { + "type": "keyword" + }, + "reverseVirtualStationUUID": { + "type": "keyword" + }, + "reverseVirtualStationName": { + "type": "keyword" + }, + "reverseLayer2SegmentId": { + "type": "long" + }, + "reverseLayer2OctetDeltaCount": { + "type": "long" + }, + "reverseLayer2OctetTotalCount": { + "type": "long" + }, + "reverseIngressUnicastPacketTotalCount": { + "type": "long" + }, + "reverseIngressMulticastPacketTotalCount": { + "type": "long" + }, + "reverseIngressBroadcastPacketTotalCount": { + "type": "long" + }, + "reverseEgressUnicastPacketTotalCount": { + "type": "long" + }, + "reverseEgressBroadcastPacketTotalCount": { + "type": "long" + }, + "reverseMonitoringIntervalStartMilliSeconds": { + "type": "long" + }, + "reverseMonitoringIntervalEndMilliSeconds": { + "type": "long" + }, + "reversePortRangeStart": { + "type": "long" + }, + "reversePortRangeEnd": { + "type": "long" + }, + "reversePortRangeStepSize": { + "type": "long" + }, + "reversePortRangeNumPorts": { + "type": "long" + }, + "reverseStaMacAddress": { + "type": "keyword" + }, + "reverseStaIPv4Address": { + "type": "ip" + }, + "reverseWtpMacAddress": { + "type": "keyword" + }, + "reverseIngressInterfaceType": { + "type": "long" + }, + "reverseEgressInterfaceType": { + "type": "long" + }, + "reverseRtpSequenceNumber": { + "type": "long" + }, + "reverseUserName": { + "type": "keyword" + }, + "reverseApplicationCategoryName": { + "type": "keyword" + }, + "reverseApplicationSubCategoryName": { + "type": "keyword" + }, + "reverseApplicationGroupName": { + "type": "keyword" + }, + "reverseOriginalFlowsPresent": { + "type": "long" + }, + "reverseOriginalFlowsInitiated": { + "type": "long" + }, + "reverseOriginalFlowsCompleted": { + "type": "long" + }, + "reverseDistinctCountOfSourceIPAddress": { + "type": "long" + }, + "reverseDistinctCountOfDestinationIPAddress": { + "type": "long" + }, + "reverseDistinctCountOfSourceIPv4Address": { + "type": "long" + }, + "reverseDistinctCountOfDestinationIPv4Address": { + "type": "long" + }, + "reverseDistinctCountOfSourceIPv6Address": { + "type": "long" + }, + "reverseDistinctCountOfDestinationIPv6Address": { + "type": "long" + }, + "reverseValueDistributionMethod": { + "type": "long" + }, + "reverseRfc3550JitterMilliseconds": { + "type": "long" + }, + "reverseRfc3550JitterMicroseconds": { + "type": "long" + }, + "reverseRfc3550JitterNanoseconds": { + "type": "long" + }, + "reverseDot1qDEI": { + "type": "long" + }, + "reverseDot1qCustomerDEI": { + "type": "long" + }, + "reverseFlowSelectorAlgorithm": { + "type": "long" + }, + "reverseFlowSelectedOctetDeltaCount": { + "type": "long" + }, + "reverseFlowSelectedPacketDeltaCount": { + "type": "long" + }, + "reverseFlowSelectedFlowDeltaCount": { + "type": "long" + }, + "reverseSelectorIDTotalFlowsObserved": { + "type": "long" + }, + "reverseSelectorIDTotalFlowsSelected": { + "type": "long" + }, + "reverseSamplingFlowInterval": { + "type": "long" + }, + "reverseSamplingFlowSpacing": { + "type": "long" + }, + "reverseFlowSamplingTimeInterval": { + "type": "long" + }, + "reverseFlowSamplingTimeSpacing": { + "type": "long" + }, + "reverseHashFlowDomain": { + "type": "long" + }, + "reverseTransportOctetDeltaCount": { + "type": "long" + }, + "reverseTransportPacketDeltaCount": { + "type": "long" + }, + "reverseOriginalExporterIPv4Address": { + "type": "ip" + }, + "reverseOriginalExporterIPv6Address": { + "type": "ip" + }, + "reverseOriginalObservationDomainId": { + "type": "long" + }, + "reverseIntermediateProcessId": { + "type": "long" + }, + "reverseIgnoredDataRecordTotalCount": { + "type": "long" + }, + "reverseDataLinkFrameType": { + "type": "long" + }, + "reverseSectionOffset": { + "type": "long" + }, + "reverseSectionExportedOctets": { + "type": "long" + }, + "reverseDot1qServiceInstanceTag": { + "type": "keyword" + }, + "reverseDot1qServiceInstanceId": { + "type": "long" + }, + "reverseDot1qServiceInstancePriority": { + "type": "long" + }, + "reverseDot1qCustomerSourceMacAddress": { + "type": "keyword" + }, + "reverseDot1qCustomerDestinationMacAddress": { + "type": "keyword" + }, + "reversePostLayer2OctetDeltaCount": { + "type": "long" + }, + "reversePostMCastLayer2OctetDeltaCount": { + "type": "long" + }, + "reversePostLayer2OctetTotalCount": { + "type": "long" + }, + "reversePostMCastLayer2OctetTotalCount": { + "type": "long" + }, + "reverseMinimumLayer2TotalLength": { + "type": "long" + }, + "reverseMaximumLayer2TotalLength": { + "type": "long" + }, + "reverseDroppedLayer2OctetDeltaCount": { + "type": "long" + }, + "reverseDroppedLayer2OctetTotalCount": { + "type": "long" + }, + "reverseIgnoredLayer2OctetTotalCount": { + "type": "long" + }, + "reverseNotSentLayer2OctetTotalCount": { + "type": "long" + }, + "reverseLayer2OctetDeltaSumOfSquares": { + "type": "long" + }, + "reverseLayer2OctetTotalSumOfSquares": { + "type": "long" + }, + "reverseLayer2FrameDeltaCount": { + "type": "long" + }, + "reverseLayer2FrameTotalCount": { + "type": "long" + }, + "reversePseudoWireDestinationIPv4Address": { + "type": "ip" + }, + "reverseIgnoredLayer2FrameTotalCount": { + "type": "long" + }, - "alu_nat_inside_svcid": { - "type": "long" - }, - "alu_nat_outside_svcid": { - "type": "long" - }, - "alu_nat_sub_string": { - "type": "keyword" - }, + "alu_nat_inside_svcid": { + "type": "long" + }, + "alu_nat_outside_svcid": { + "type": "long" + }, + "alu_nat_sub_string": { + "type": "keyword" + }, - "barracuda_timestamp": { - "type": "long" - }, - "barracuda_log_op": { - "type": "long" - }, - "barracuda_traffic_type": { - "type": "long" - }, - "barracuda_fw_rule": { - "type": "keyword" - }, - "barracuda_service": { - "type": "keyword" - }, - "barracuda_reason": { - "type": "long" - }, - "barracuda_reason_text": { - "type": "keyword" - }, - "barracuda_bind_ipv4_addr": { - "type": "ip" - }, - "barracuda_bind_l4_port": { - "type": "long" - }, - "barracuda_conn_ipv4_addr": { - "type": "ip" - }, - "barracuda_conn_l4_port": { - "type": "long" - }, - "barracuda_audit_counter": { - "type": "long" - }, + "barracuda_timestamp": { + "type": "long" + }, + "barracuda_log_op": { + "type": "long" + }, + "barracuda_traffic_type": { + "type": "long" + }, + "barracuda_fw_rule": { + "type": "keyword" + }, + "barracuda_service": { + "type": "keyword" + }, + "barracuda_reason": { + "type": "long" + }, + "barracuda_reason_text": { + "type": "keyword" + }, + "barracuda_bind_ipv4_addr": { + "type": "ip" + }, + "barracuda_bind_l4_port": { + "type": "long" + }, + "barracuda_conn_ipv4_addr": { + "type": "ip" + }, + "barracuda_conn_l4_port": { + "type": "long" + }, + "barracuda_audit_counter": { + "type": "long" + }, - "cace_local_ipv4_addr": { - "type": "ip" - }, - "cace_remote_ipv4_addr": { - "type": "ip" - }, - "cace_local_ipv6_addr": { - "type": "ip" - }, - "cace_remote_ipv6_addr": { - "type": "ip" - }, - "cace_local_l4_port": { - "type": "long" - }, - "cace_remote_l4_port": { - "type": "long" - }, - "cace_local_ipv4_id": { - "type": "long" - }, - "cace_local_icmp_id": { - "type": "long" - }, - "cace_local_proc_user_id": { - "type": "long" - }, - "cace_local_proc_id": { - "type": "long" - }, - "cace_local_proc_user": { - "type": "keyword" - }, - "cace_local_proc_command": { - "type": "keyword" - }, + "cace_local_ipv4_addr": { + "type": "ip" + }, + "cace_remote_ipv4_addr": { + "type": "ip" + }, + "cace_local_ipv6_addr": { + "type": "ip" + }, + "cace_remote_ipv6_addr": { + "type": "ip" + }, + "cace_local_l4_port": { + "type": "long" + }, + "cace_remote_l4_port": { + "type": "long" + }, + "cace_local_ipv4_id": { + "type": "long" + }, + "cace_local_icmp_id": { + "type": "long" + }, + "cace_local_proc_user_id": { + "type": "long" + }, + "cace_local_proc_id": { + "type": "long" + }, + "cace_local_proc_user": { + "type": "keyword" + }, + "cace_local_proc_command": { + "type": "keyword" + }, - "cert_obsolete_rev_bytes_total": { - "type": "long" - }, - "cert_obsolete_rev_packets_total": { - "type": "long" - }, - "cert_init_tcp_flags": { - "type": "long" - }, - "cert_union_tcp_flags": { - "type": "long" - }, - "cert_obsolete_rev_init_tcp_flags": { - "type": "long" - }, - "cert_obsolete_rev_union_tcp_flags": { - "type": "long" - }, - "cert_payload": { - "type": "keyword" - }, - "cert_obsolete_rev_payload": { - "type": "keyword" - }, - "cert_obsolete_rev_tcp_seq_num": { - "type": "long" - }, - "cert_rev_flow_delta_millis": { - "type": "long" - }, - "cert_obsolete_rev_vlan_id": { - "type": "long" - }, - "cert_silk_flow_type": { - "type": "long" - }, - "cert_silk_flow_sensor": { - "type": "long" - }, - "cert_silk_tcp_state": { - "type": "long" - }, - "cert_silk_app_label": { - "type": "long" - }, - "cert_payload_entropy": { - "type": "long" - }, - "cert_os": { - "type": "keyword" - }, - "cert_os_ver": { - "type": "keyword" - }, - "cert_first_packet_banner": { - "type": "keyword" - }, - "cert_second_packet_banner": { - "type": "keyword" - }, - "cert_flow_attr": { - "type": "long" - }, - "cert_expired_frags": { - "type": "long" - }, - "cert_assembled_frags": { - "type": "long" - }, - "cert_mean_flow_rate": { - "type": "long" - }, - "cert_mean_packet_rate": { - "type": "long" - }, - "cert_flow_table_flushes": { - "type": "long" - }, - "cert_flow_table_peak": { - "type": "long" - }, - "cert_yaf_flow_keyhash": { - "type": "long" - }, - "cert_os_fingerprint": { - "type": "keyword" - }, - "cert_http_server_string": { - "type": "keyword" - }, - "cert_http_user_agent": { - "type": "keyword" - }, - "cert_http_get": { - "type": "keyword" - }, - "cert_http_conn": { - "type": "keyword" - }, - "cert_http_ver": { - "type": "keyword" - }, - "cert_http_referrer": { - "type": "keyword" - }, - "cert_http_location": { - "type": "keyword" - }, - "cert_http_host": { - "type": "keyword" - }, - "cert_http_content_len": { - "type": "keyword" - }, - "cert_http_age": { - "type": "keyword" - }, - "cert_http_accept": { - "type": "keyword" - }, - "cert_http_accept_lang": { - "type": "keyword" - }, - "cert_http_content_type": { - "type": "keyword" - }, - "cert_http_resp": { - "type": "keyword" - }, - "cert_pop3_text_msg": { - "type": "keyword" - }, - "cert_irc_text_msg": { - "type": "keyword" - }, - "cert_tftp_filename": { - "type": "keyword" - }, - "cert_tftp_mode": { - "type": "keyword" - }, - "cert_slp_ver": { - "type": "long" - }, - "cert_slp_msg_type": { - "type": "long" - }, - "cert_slp_string": { - "type": "keyword" - }, - "cert_ftp_return": { - "type": "keyword" - }, - "cert_ftp_user": { - "type": "keyword" - }, - "cert_ftp_pass": { - "type": "keyword" - }, - "cert_ftp_type": { - "type": "keyword" - }, - "cert_ftp_resp_code": { - "type": "keyword" - }, - "cert_imap_capability": { - "type": "keyword" - }, - "cert_imap_login": { - "type": "keyword" - }, - "cert_imap_start_tls": { - "type": "keyword" - }, - "cert_imap_auth": { - "type": "keyword" - }, - "cert_imap_command": { - "type": "keyword" - }, - "cert_imap_exists": { - "type": "keyword" - }, - "cert_imap_recent": { - "type": "keyword" - }, - "cert_rtsp_url": { - "type": "keyword" - }, - "cert_rtsp_ver": { - "type": "keyword" - }, - "cert_rtsp_return_code": { - "type": "keyword" - }, - "cert_rtsp_content_len": { - "type": "keyword" - }, - "cert_rtsp_command": { - "type": "keyword" - }, - "cert_rtsp_content_type": { - "type": "keyword" - }, - "cert_rtsp_transport": { - "type": "keyword" - }, - "cert_rtsp_cseq": { - "type": "keyword" - }, - "cert_rtsp_location": { - "type": "keyword" - }, - "cert_rtsp_packets_rcv": { - "type": "long" - }, - "cert_rtsp_user_agent": { - "type": "keyword" - }, - "cert_rtsp_jitter": { - "type": "long" - }, - "cert_sip_invite": { - "type": "keyword" - }, - "cert_sip_command": { - "type": "keyword" - }, - "cert_sip_via": { - "type": "keyword" - }, - "cert_sip_max_forwards": { - "type": "long" - }, - "cert_sip_address": { - "type": "keyword" - }, - "cert_sip_content_len": { - "type": "long" - }, - "cert_sip_user_agent": { - "type": "keyword" - }, - "cert_smtp_hello": { - "type": "keyword" - }, - "cert_smtp_from": { - "type": "keyword" - }, - "cert_smtp_to": { - "type": "keyword" - }, - "cert_smtp_content_type": { - "type": "keyword" - }, - "cert_smtp_subject": { - "type": "keyword" - }, - "cert_smtp_filename": { - "type": "keyword" - }, - "cert_smtp_content_disposition": { - "type": "keyword" - }, - "cert_smtp_resp": { - "type": "keyword" - }, - "cert_smtp_enhanced": { - "type": "keyword" - }, - "cert_ssh_ver": { - "type": "keyword" - }, - "cert_nntp_resp": { - "type": "keyword" - }, - "cert_nntp_command": { - "type": "keyword" - }, - "cert_dns_query_resp": { - "type": "long" - }, - "cert_dns_qrtype": { - "type": "long" - }, - "cert_dns_authoritative": { - "type": "long" - }, - "cert_dns_nxdomain": { - "type": "long" - }, - "cert_dns_rrsection": { - "type": "long" - }, - "cert_dns_qname": { - "type": "keyword" - }, - "cert_dns_cname": { - "type": "keyword" - }, - "cert_dns_mxpref": { - "type": "long" - }, - "cert_dns_mxexch": { - "type": "keyword" - }, - "cert_dns_ns_dname": { - "type": "keyword" - }, - "cert_dns_ptr_dname": { - "type": "keyword" - }, - "cert_ssl_cipher": { - "type": "long" - }, - "cert_ssl_client_ver": { - "type": "long" - }, - "cert_ssl_server_cipher": { - "type": "long" - }, - "cert_ssl_compress_method": { - "type": "long" - }, - "cert_ssl_cert_ver": { - "type": "long" - }, - "cert_ssl_cert_sig": { - "type": "keyword" - }, - "cert_ssl_cert_issuer_country": { - "type": "keyword" - }, - "cert_ssl_cert_issuer_org": { - "type": "keyword" - }, - "cert_ssl_cert_issuer_org_unit": { - "type": "keyword" - }, - "cert_ssl_cert_issuer_zipcode": { - "type": "keyword" - }, - "cert_ssl_cert_issuer_state": { - "type": "keyword" - }, - "cert_ssl_cert_issuer_common": { - "type": "keyword" - }, - "cert_ssl_cert_issuer_locality": { - "type": "keyword" - }, - "cert_ssl_cert_issuer_street": { - "type": "keyword" - }, - "cert_dns_ttl": { - "type": "long" - }, - "cert_ssl_cert_sub_country": { - "type": "keyword" - }, - "cert_ssl_cert_sub_org": { - "type": "keyword" - }, - "cert_ssl_cert_sub_org_unit": { - "type": "keyword" - }, - "cert_ssl_cert_sub_zipcode": { - "type": "keyword" - }, - "cert_ssl_cert_sub_state": { - "type": "keyword" - }, - "cert_ssl_cert_sub_common": { - "type": "keyword" - }, - "cert_ssl_cert_sub_locality": { - "type": "keyword" - }, - "cert_ssl_cert_sub_street": { - "type": "keyword" - }, - "cert_dns_txtdata": { - "type": "keyword" - }, - "cert_dns_soa_serial": { - "type": "long" - }, - "cert_dns_soa_refresh": { - "type": "long" - }, - "cert_dns_soa_retry": { - "type": "long" - }, - "cert_dns_soa_expire": { - "type": "long" - }, - "cert_dns_soa_min": { - "type": "long" - }, - "cert_dns_soa_mname": { - "type": "keyword" - }, - "cert_dns_soa_rname": { - "type": "keyword" - }, - "cert_dns_srv_pri": { - "type": "long" - }, - "cert_dns_srv_weight": { - "type": "long" - }, - "cert_dns_srv_port": { - "type": "long" - }, - "cert_dns_srv_target": { - "type": "keyword" - }, - "cert_http_cookie": { - "type": "keyword" - }, - "cert_http_set_cookie": { - "type": "keyword" - }, - "cert_smtp_size": { - "type": "long" - }, - "cert_mysql_user": { - "type": "keyword" - }, - "cert_mysql_command_code": { - "type": "long" - }, - "cert_mysql_command_text": { - "type": "keyword" - }, - "cert_dns_id": { - "type": "long" - }, - "cert_dns_algorithm": { - "type": "long" - }, - "cert_dns_key_tag": { - "type": "long" - }, - "cert_dns_signer": { - "type": "keyword" - }, - "cert_dns_sig": { - "type": "keyword" - }, - "cert_dns_digest": { - "type": "keyword" - }, - "cert_dns_public_key": { - "type": "keyword" - }, - "cert_dns_salt": { - "type": "keyword" - }, - "cert_dns_hash_data": { - "type": "keyword" - }, - "cert_dns_iterations": { - "type": "long" - }, - "cert_dns_sig_expire": { - "type": "long" - }, - "cert_dns_sig_inception": { - "type": "long" - }, - "cert_dns_digest_type": { - "type": "long" - }, - "cert_dns_labels": { - "type": "long" - }, - "cert_dns_type_covered": { - "type": "long" - }, - "cert_dns_flags": { - "type": "long" - }, - "cert_dhcp_fingerprint": { - "type": "keyword" - }, - "cert_dhcp_vendor_code": { - "type": "keyword" - }, - "cert_ssl_cert_serial_num": { - "type": "keyword" - }, - "cert_ssl_object_type": { - "type": "long" - }, - "cert_ssl_object_value": { - "type": "keyword" - }, - "cert_ssl_cert_valid_not_before": { - "type": "keyword" - }, - "cert_ssl_cert_valid_not_after": { - "type": "keyword" - }, - "cert_ssl_public_key_alg": { - "type": "keyword" - }, - "cert_ssl_public_key_len": { - "type": "long" - }, - "cert_smtp_date": { - "type": "keyword" - }, - "cert_http_auth": { - "type": "keyword" - }, - "cert_http_via": { - "type": "keyword" - }, - "cert_http_x_forwarded_for": { - "type": "keyword" - }, - "cert_http_expires": { - "type": "keyword" - }, - "cert_http_refresh": { - "type": "keyword" - }, - "cert_http_imei": { - "type": "keyword" - }, - "cert_http_imsi": { - "type": "keyword" - }, - "cert_http_msisdn": { - "type": "keyword" - }, - "cert_http_subscriber": { - "type": "keyword" - }, - "cert_http_accept_charset": { - "type": "keyword" - }, - "cert_http_accept_encoding": { - "type": "keyword" - }, - "cert_http_allow": { - "type": "keyword" - }, - "cert_http_date": { - "type": "keyword" - }, - "cert_http_expect": { - "type": "keyword" - }, - "cert_http_from": { - "type": "keyword" - }, - "cert_http_proxy_auth": { - "type": "keyword" - }, - "cert_http_upgrade": { - "type": "keyword" - }, - "cert_http_warning": { - "type": "keyword" - }, - "cert_http_dnt": { - "type": "keyword" - }, - "cert_http_x_forwarded_proto": { - "type": "keyword" - }, - "cert_http_x_forwarded_host": { - "type": "keyword" - }, - "cert_http_x_forwarded_server": { - "type": "keyword" - }, - "cert_http_x_device_id": { - "type": "keyword" - }, - "cert_http_x_profile": { - "type": "keyword" - }, - "cert_http_last_modified": { - "type": "keyword" - }, - "cert_http_content_encoding": { - "type": "keyword" - }, - "cert_http_content_language": { - "type": "keyword" - }, - "cert_http_content_location": { - "type": "keyword" - }, - "cert_http_xua_compatible": { - "type": "keyword" - }, - "cert_dnp3_src_addr": { - "type": "long" - }, - "cert_dnp3_dst_addr": { - "type": "long" - }, - "cert_dnp3_func": { - "type": "long" - }, - "cert_dnp3_object_data": { - "type": "keyword" - }, - "cert_modbus_data": { - "type": "keyword" - }, - "cert_ethernet_ip_data": { - "type": "keyword" - }, - "cert_rtp_payload_type": { - "type": "long" - }, - "cert_ssl_record_ver": { - "type": "long" - }, - "cert_mptcp_init_data_seq_num": { - "type": "long" - }, - "cert_mptcp_rcvr_token": { - "type": "long" - }, - "cert_mptcp_max_seg_size": { - "type": "long" - }, - "cert_mptcp_addr_id": { - "type": "long" - }, - "cert_mptcp_flags": { - "type": "long" - }, - "cert_ssl_server": { - "type": "keyword" - }, - "cert_ssl_cert_hash": { - "type": "keyword" - }, - "cert_ssl_cert": { - "type": "keyword" - }, - "cert_dhcp_option": { - "type": "long" - }, - "cert_ssl_cert_sha1": { - "type": "keyword" - }, - "cert_ssl_cert_md5": { - "type": "keyword" - }, - "cert_ndpi_l7_proto": { - "type": "long" - }, - "cert_ndpi_l7_sub_proto": { - "type": "keyword" - }, - "cert_rr_ipv4": { - "type": "ip" - }, - "cert_rr_ipv6": { - "type": "ip" - }, - "cert_dns_key_proto_id": { - "type": "long" - }, - "cert_dns_a_record": { - "type": "keyword" - }, - "cert_dns_aaaa_record": { - "type": "keyword" - }, - "cert_small_packets": { - "type": "long" - }, - "cert_nonempty_packets": { - "type": "long" - }, - "cert_data_bytes": { - "type": "long" - }, - "cert_avg_interarrival_time": { - "type": "long" - }, - "cert_std_dev_interarrival_time": { - "type": "long" - }, - "cert_first_nonempty_packet_size": { - "type": "long" - }, - "cert_max_packet_size": { - "type": "long" - }, - "cert_first_eight_nonempty_packet_dir": { - "type": "long" - }, - "cert_std_dev_payload_len": { - "type": "long" - }, - "cert_tcp_urgent_count": { - "type": "long" - }, - "cert_large_packets": { - "type": "long" - }, - "cert_tombstone_id": { - "type": "long" - }, - "cert_exporter_config_id": { - "type": "long" - }, - "cert_exporter_unique_id": { - "type": "long" - }, - "cert_dns_rname": { - "type": "keyword" - }, - "cert_dns_hits": { - "type": "long" - }, - "cert_observed_data_total": { - "type": "long" - }, - "cert_observed_data": { - "type": "keyword" - }, - "cert_template": { - "type": "keyword" - }, - "cert_template_descr": { - "type": "keyword" - }, - "cert_rev_init_tcp_flags": { - "type": "long" - }, - "cert_rev_union_tcp_flags": { - "type": "long" - }, - "cert_rev_payload": { - "type": "keyword" - }, - "cert_rev_payload_entropy": { - "type": "long" - }, - "cert_rev_os": { - "type": "keyword" - }, - "cert_rev_os_ver": { - "type": "keyword" - }, - "cert_rev_first_packet_banner": { - "type": "keyword" - }, - "cert_rev_second_packet_banner": { - "type": "keyword" - }, - "cert_rev_flow_attr": { - "type": "long" - }, - "cert_rev_os_fingerprint": { - "type": "keyword" - }, - "cert_rev_dhcp_fingerprint": { - "type": "keyword" - }, - "cert_rev_dhcp_vendor_code": { - "type": "keyword" - }, - "cert_rev_rtp_payload_type": { - "type": "long" - }, - "cert_rev_small_packets": { - "type": "long" - }, - "cert_rev_nonempty_packets": { - "type": "long" - }, - "cert_rev_data_bytes": { - "type": "long" - }, - "cert_rev_avg_interarrival_time": { - "type": "long" - }, - "cert_rev_std_dev_interarrival_time": { - "type": "long" - }, - "cert_rev_first_nonempty_packet_size": { - "type": "long" - }, - "cert_rev_max_packet_size": { - "type": "long" - }, - "cert_rev_first_eight_nonempty_packet_dir": { - "type": "long" - }, - "cert_rev_std_dev_payload_len": { - "type": "long" - }, - "cert_rev_tcp_urgent_count": { - "type": "long" - }, - "cert_rev_large_packets": { - "type": "long" - }, + "cert_obsolete_rev_bytes_total": { + "type": "long" + }, + "cert_obsolete_rev_packets_total": { + "type": "long" + }, + "cert_init_tcp_flags": { + "type": "long" + }, + "cert_union_tcp_flags": { + "type": "long" + }, + "cert_obsolete_rev_init_tcp_flags": { + "type": "long" + }, + "cert_obsolete_rev_union_tcp_flags": { + "type": "long" + }, + "cert_payload": { + "type": "keyword" + }, + "cert_obsolete_rev_payload": { + "type": "keyword" + }, + "cert_obsolete_rev_tcp_seq_num": { + "type": "long" + }, + "cert_rev_flow_delta_millis": { + "type": "long" + }, + "cert_obsolete_rev_vlan_id": { + "type": "long" + }, + "cert_silk_flow_type": { + "type": "long" + }, + "cert_silk_flow_sensor": { + "type": "long" + }, + "cert_silk_tcp_state": { + "type": "long" + }, + "cert_silk_app_label": { + "type": "long" + }, + "cert_payload_entropy": { + "type": "long" + }, + "cert_os": { + "type": "keyword" + }, + "cert_os_ver": { + "type": "keyword" + }, + "cert_first_packet_banner": { + "type": "keyword" + }, + "cert_second_packet_banner": { + "type": "keyword" + }, + "cert_flow_attr": { + "type": "long" + }, + "cert_expired_frags": { + "type": "long" + }, + "cert_assembled_frags": { + "type": "long" + }, + "cert_mean_flow_rate": { + "type": "long" + }, + "cert_mean_packet_rate": { + "type": "long" + }, + "cert_flow_table_flushes": { + "type": "long" + }, + "cert_flow_table_peak": { + "type": "long" + }, + "cert_yaf_flow_keyhash": { + "type": "long" + }, + "cert_os_fingerprint": { + "type": "keyword" + }, + "cert_http_server_string": { + "type": "keyword" + }, + "cert_http_user_agent": { + "type": "keyword" + }, + "cert_http_get": { + "type": "keyword" + }, + "cert_http_conn": { + "type": "keyword" + }, + "cert_http_ver": { + "type": "keyword" + }, + "cert_http_referrer": { + "type": "keyword" + }, + "cert_http_location": { + "type": "keyword" + }, + "cert_http_host": { + "type": "keyword" + }, + "cert_http_content_len": { + "type": "keyword" + }, + "cert_http_age": { + "type": "keyword" + }, + "cert_http_accept": { + "type": "keyword" + }, + "cert_http_accept_lang": { + "type": "keyword" + }, + "cert_http_content_type": { + "type": "keyword" + }, + "cert_http_resp": { + "type": "keyword" + }, + "cert_pop3_text_msg": { + "type": "keyword" + }, + "cert_irc_text_msg": { + "type": "keyword" + }, + "cert_tftp_filename": { + "type": "keyword" + }, + "cert_tftp_mode": { + "type": "keyword" + }, + "cert_slp_ver": { + "type": "long" + }, + "cert_slp_msg_type": { + "type": "long" + }, + "cert_slp_string": { + "type": "keyword" + }, + "cert_ftp_return": { + "type": "keyword" + }, + "cert_ftp_user": { + "type": "keyword" + }, + "cert_ftp_pass": { + "type": "keyword" + }, + "cert_ftp_type": { + "type": "keyword" + }, + "cert_ftp_resp_code": { + "type": "keyword" + }, + "cert_imap_capability": { + "type": "keyword" + }, + "cert_imap_login": { + "type": "keyword" + }, + "cert_imap_start_tls": { + "type": "keyword" + }, + "cert_imap_auth": { + "type": "keyword" + }, + "cert_imap_command": { + "type": "keyword" + }, + "cert_imap_exists": { + "type": "keyword" + }, + "cert_imap_recent": { + "type": "keyword" + }, + "cert_rtsp_url": { + "type": "keyword" + }, + "cert_rtsp_ver": { + "type": "keyword" + }, + "cert_rtsp_return_code": { + "type": "keyword" + }, + "cert_rtsp_content_len": { + "type": "keyword" + }, + "cert_rtsp_command": { + "type": "keyword" + }, + "cert_rtsp_content_type": { + "type": "keyword" + }, + "cert_rtsp_transport": { + "type": "keyword" + }, + "cert_rtsp_cseq": { + "type": "keyword" + }, + "cert_rtsp_location": { + "type": "keyword" + }, + "cert_rtsp_packets_rcv": { + "type": "long" + }, + "cert_rtsp_user_agent": { + "type": "keyword" + }, + "cert_rtsp_jitter": { + "type": "long" + }, + "cert_sip_invite": { + "type": "keyword" + }, + "cert_sip_command": { + "type": "keyword" + }, + "cert_sip_via": { + "type": "keyword" + }, + "cert_sip_max_forwards": { + "type": "long" + }, + "cert_sip_address": { + "type": "keyword" + }, + "cert_sip_content_len": { + "type": "long" + }, + "cert_sip_user_agent": { + "type": "keyword" + }, + "cert_smtp_hello": { + "type": "keyword" + }, + "cert_smtp_from": { + "type": "keyword" + }, + "cert_smtp_to": { + "type": "keyword" + }, + "cert_smtp_content_type": { + "type": "keyword" + }, + "cert_smtp_subject": { + "type": "keyword" + }, + "cert_smtp_filename": { + "type": "keyword" + }, + "cert_smtp_content_disposition": { + "type": "keyword" + }, + "cert_smtp_resp": { + "type": "keyword" + }, + "cert_smtp_enhanced": { + "type": "keyword" + }, + "cert_ssh_ver": { + "type": "keyword" + }, + "cert_nntp_resp": { + "type": "keyword" + }, + "cert_nntp_command": { + "type": "keyword" + }, + "cert_dns_query_resp": { + "type": "long" + }, + "cert_dns_qrtype": { + "type": "long" + }, + "cert_dns_authoritative": { + "type": "long" + }, + "cert_dns_nxdomain": { + "type": "long" + }, + "cert_dns_rrsection": { + "type": "long" + }, + "cert_dns_qname": { + "type": "keyword" + }, + "cert_dns_cname": { + "type": "keyword" + }, + "cert_dns_mxpref": { + "type": "long" + }, + "cert_dns_mxexch": { + "type": "keyword" + }, + "cert_dns_ns_dname": { + "type": "keyword" + }, + "cert_dns_ptr_dname": { + "type": "keyword" + }, + "cert_ssl_cipher": { + "type": "long" + }, + "cert_ssl_client_ver": { + "type": "long" + }, + "cert_ssl_server_cipher": { + "type": "long" + }, + "cert_ssl_compress_method": { + "type": "long" + }, + "cert_ssl_cert_ver": { + "type": "long" + }, + "cert_ssl_cert_sig": { + "type": "keyword" + }, + "cert_ssl_cert_issuer_country": { + "type": "keyword" + }, + "cert_ssl_cert_issuer_org": { + "type": "keyword" + }, + "cert_ssl_cert_issuer_org_unit": { + "type": "keyword" + }, + "cert_ssl_cert_issuer_zipcode": { + "type": "keyword" + }, + "cert_ssl_cert_issuer_state": { + "type": "keyword" + }, + "cert_ssl_cert_issuer_common": { + "type": "keyword" + }, + "cert_ssl_cert_issuer_locality": { + "type": "keyword" + }, + "cert_ssl_cert_issuer_street": { + "type": "keyword" + }, + "cert_dns_ttl": { + "type": "long" + }, + "cert_ssl_cert_sub_country": { + "type": "keyword" + }, + "cert_ssl_cert_sub_org": { + "type": "keyword" + }, + "cert_ssl_cert_sub_org_unit": { + "type": "keyword" + }, + "cert_ssl_cert_sub_zipcode": { + "type": "keyword" + }, + "cert_ssl_cert_sub_state": { + "type": "keyword" + }, + "cert_ssl_cert_sub_common": { + "type": "keyword" + }, + "cert_ssl_cert_sub_locality": { + "type": "keyword" + }, + "cert_ssl_cert_sub_street": { + "type": "keyword" + }, + "cert_dns_txtdata": { + "type": "keyword" + }, + "cert_dns_soa_serial": { + "type": "long" + }, + "cert_dns_soa_refresh": { + "type": "long" + }, + "cert_dns_soa_retry": { + "type": "long" + }, + "cert_dns_soa_expire": { + "type": "long" + }, + "cert_dns_soa_min": { + "type": "long" + }, + "cert_dns_soa_mname": { + "type": "keyword" + }, + "cert_dns_soa_rname": { + "type": "keyword" + }, + "cert_dns_srv_pri": { + "type": "long" + }, + "cert_dns_srv_weight": { + "type": "long" + }, + "cert_dns_srv_port": { + "type": "long" + }, + "cert_dns_srv_target": { + "type": "keyword" + }, + "cert_http_cookie": { + "type": "keyword" + }, + "cert_http_set_cookie": { + "type": "keyword" + }, + "cert_smtp_size": { + "type": "long" + }, + "cert_mysql_user": { + "type": "keyword" + }, + "cert_mysql_command_code": { + "type": "long" + }, + "cert_mysql_command_text": { + "type": "keyword" + }, + "cert_dns_id": { + "type": "long" + }, + "cert_dns_algorithm": { + "type": "long" + }, + "cert_dns_key_tag": { + "type": "long" + }, + "cert_dns_signer": { + "type": "keyword" + }, + "cert_dns_sig": { + "type": "keyword" + }, + "cert_dns_digest": { + "type": "keyword" + }, + "cert_dns_public_key": { + "type": "keyword" + }, + "cert_dns_salt": { + "type": "keyword" + }, + "cert_dns_hash_data": { + "type": "keyword" + }, + "cert_dns_iterations": { + "type": "long" + }, + "cert_dns_sig_expire": { + "type": "long" + }, + "cert_dns_sig_inception": { + "type": "long" + }, + "cert_dns_digest_type": { + "type": "long" + }, + "cert_dns_labels": { + "type": "long" + }, + "cert_dns_type_covered": { + "type": "long" + }, + "cert_dns_flags": { + "type": "long" + }, + "cert_dhcp_fingerprint": { + "type": "keyword" + }, + "cert_dhcp_vendor_code": { + "type": "keyword" + }, + "cert_ssl_cert_serial_num": { + "type": "keyword" + }, + "cert_ssl_object_type": { + "type": "long" + }, + "cert_ssl_object_value": { + "type": "keyword" + }, + "cert_ssl_cert_valid_not_before": { + "type": "keyword" + }, + "cert_ssl_cert_valid_not_after": { + "type": "keyword" + }, + "cert_ssl_public_key_alg": { + "type": "keyword" + }, + "cert_ssl_public_key_len": { + "type": "long" + }, + "cert_smtp_date": { + "type": "keyword" + }, + "cert_http_auth": { + "type": "keyword" + }, + "cert_http_via": { + "type": "keyword" + }, + "cert_http_x_forwarded_for": { + "type": "keyword" + }, + "cert_http_expires": { + "type": "keyword" + }, + "cert_http_refresh": { + "type": "keyword" + }, + "cert_http_imei": { + "type": "keyword" + }, + "cert_http_imsi": { + "type": "keyword" + }, + "cert_http_msisdn": { + "type": "keyword" + }, + "cert_http_subscriber": { + "type": "keyword" + }, + "cert_http_accept_charset": { + "type": "keyword" + }, + "cert_http_accept_encoding": { + "type": "keyword" + }, + "cert_http_allow": { + "type": "keyword" + }, + "cert_http_date": { + "type": "keyword" + }, + "cert_http_expect": { + "type": "keyword" + }, + "cert_http_from": { + "type": "keyword" + }, + "cert_http_proxy_auth": { + "type": "keyword" + }, + "cert_http_upgrade": { + "type": "keyword" + }, + "cert_http_warning": { + "type": "keyword" + }, + "cert_http_dnt": { + "type": "keyword" + }, + "cert_http_x_forwarded_proto": { + "type": "keyword" + }, + "cert_http_x_forwarded_host": { + "type": "keyword" + }, + "cert_http_x_forwarded_server": { + "type": "keyword" + }, + "cert_http_x_device_id": { + "type": "keyword" + }, + "cert_http_x_profile": { + "type": "keyword" + }, + "cert_http_last_modified": { + "type": "keyword" + }, + "cert_http_content_encoding": { + "type": "keyword" + }, + "cert_http_content_language": { + "type": "keyword" + }, + "cert_http_content_location": { + "type": "keyword" + }, + "cert_http_xua_compatible": { + "type": "keyword" + }, + "cert_dnp3_src_addr": { + "type": "long" + }, + "cert_dnp3_dst_addr": { + "type": "long" + }, + "cert_dnp3_func": { + "type": "long" + }, + "cert_dnp3_object_data": { + "type": "keyword" + }, + "cert_modbus_data": { + "type": "keyword" + }, + "cert_ethernet_ip_data": { + "type": "keyword" + }, + "cert_rtp_payload_type": { + "type": "long" + }, + "cert_ssl_record_ver": { + "type": "long" + }, + "cert_mptcp_init_data_seq_num": { + "type": "long" + }, + "cert_mptcp_rcvr_token": { + "type": "long" + }, + "cert_mptcp_max_seg_size": { + "type": "long" + }, + "cert_mptcp_addr_id": { + "type": "long" + }, + "cert_mptcp_flags": { + "type": "long" + }, + "cert_ssl_server": { + "type": "keyword" + }, + "cert_ssl_cert_hash": { + "type": "keyword" + }, + "cert_ssl_cert": { + "type": "keyword" + }, + "cert_dhcp_option": { + "type": "long" + }, + "cert_ssl_cert_sha1": { + "type": "keyword" + }, + "cert_ssl_cert_md5": { + "type": "keyword" + }, + "cert_ndpi_l7_proto": { + "type": "long" + }, + "cert_ndpi_l7_sub_proto": { + "type": "keyword" + }, + "cert_rr_ipv4": { + "type": "ip" + }, + "cert_rr_ipv6": { + "type": "ip" + }, + "cert_dns_key_proto_id": { + "type": "long" + }, + "cert_dns_a_record": { + "type": "keyword" + }, + "cert_dns_aaaa_record": { + "type": "keyword" + }, + "cert_small_packets": { + "type": "long" + }, + "cert_nonempty_packets": { + "type": "long" + }, + "cert_data_bytes": { + "type": "long" + }, + "cert_avg_interarrival_time": { + "type": "long" + }, + "cert_std_dev_interarrival_time": { + "type": "long" + }, + "cert_first_nonempty_packet_size": { + "type": "long" + }, + "cert_max_packet_size": { + "type": "long" + }, + "cert_first_eight_nonempty_packet_dir": { + "type": "long" + }, + "cert_std_dev_payload_len": { + "type": "long" + }, + "cert_tcp_urgent_count": { + "type": "long" + }, + "cert_large_packets": { + "type": "long" + }, + "cert_tombstone_id": { + "type": "long" + }, + "cert_exporter_config_id": { + "type": "long" + }, + "cert_exporter_unique_id": { + "type": "long" + }, + "cert_dns_rname": { + "type": "keyword" + }, + "cert_dns_hits": { + "type": "long" + }, + "cert_observed_data_total": { + "type": "long" + }, + "cert_observed_data": { + "type": "keyword" + }, + "cert_template": { + "type": "keyword" + }, + "cert_template_descr": { + "type": "keyword" + }, + "cert_rev_init_tcp_flags": { + "type": "long" + }, + "cert_rev_union_tcp_flags": { + "type": "long" + }, + "cert_rev_payload": { + "type": "keyword" + }, + "cert_rev_payload_entropy": { + "type": "long" + }, + "cert_rev_os": { + "type": "keyword" + }, + "cert_rev_os_ver": { + "type": "keyword" + }, + "cert_rev_first_packet_banner": { + "type": "keyword" + }, + "cert_rev_second_packet_banner": { + "type": "keyword" + }, + "cert_rev_flow_attr": { + "type": "long" + }, + "cert_rev_os_fingerprint": { + "type": "keyword" + }, + "cert_rev_dhcp_fingerprint": { + "type": "keyword" + }, + "cert_rev_dhcp_vendor_code": { + "type": "keyword" + }, + "cert_rev_rtp_payload_type": { + "type": "long" + }, + "cert_rev_small_packets": { + "type": "long" + }, + "cert_rev_nonempty_packets": { + "type": "long" + }, + "cert_rev_data_bytes": { + "type": "long" + }, + "cert_rev_avg_interarrival_time": { + "type": "long" + }, + "cert_rev_std_dev_interarrival_time": { + "type": "long" + }, + "cert_rev_first_nonempty_packet_size": { + "type": "long" + }, + "cert_rev_max_packet_size": { + "type": "long" + }, + "cert_rev_first_eight_nonempty_packet_dir": { + "type": "long" + }, + "cert_rev_std_dev_payload_len": { + "type": "long" + }, + "cert_rev_tcp_urgent_count": { + "type": "long" + }, + "cert_rev_large_packets": { + "type": "long" + }, - "cisco_avc_p2p_tech": { - "type": "keyword" - }, - "cisco_avc_tunnel_tech": { - "type": "keyword" - }, - "cisco_avc_encrypt_tech": { - "type": "keyword" - }, - "cisco_ipt_dialing_phone": { - "type": "ip" - }, - "cisco_ipt_dialing_user": { - "type": "keyword" - }, - "cisco_ipt_dialed_phone": { - "type": "ip" - }, - "cisco_ipt_dialed_user": { - "type": "keyword" - }, - "cisco_ipt_call_duration": { - "type": "long" - }, - "cisco_ipt_call_end_reason": { - "type": "long" - }, - "cisco_ipt_calls_dialed": { - "type": "long" - }, - "cisco_ipt_calls_connected": { - "type": "long" - }, - "cisco_ipt_calls_failed": { - "type": "long" - }, - "cisco_nexus_fastpath_src_addr": { - "type": "ip" - }, - "cisco_nexus_fastpath_src_port": { - "type": "long" - }, - "cisco_nexus_fastpath_dst_addr": { - "type": "ip" - }, - "cisco_nexus_fastpath_dst_port": { - "type": "long" - }, - "cisco_endpoint_process_user": { - "type": "keyword" - }, - "cisco_endpoint_process_name": { - "type": "keyword" - }, - "cisco_endpoint_process_hash": { - "type": "keyword" - }, - "cisco_endpoint_process_parent_user": { - "type": "keyword" - }, - "cisco_endpoint_process_parent_name": { - "type": "keyword" - }, - "cisco_endpoint_process_parent_hash": { - "type": "keyword" - }, - "cisco_pfr_policy_id": { - "type": "long" - }, - "cisco_pfr_map_name": { - "type": "keyword" - }, - "cisco_pfr_reason": { - "type": "keyword" - }, - "cisco_fw_ingress_acl_id": { - "type": "keyword" - }, - "cisco_fw_egress_acl_id": { - "type": "keyword" - }, - "cisco_fw_ext_event": { - "type": "keyword" - }, - "cisco_fw_event_level": { - "type": "long" - }, - "cisco_fw_event_level_id": { - "type": "long" - }, - "cisco_fw_config_value": { - "type": "long" - }, - "cisco_fw_erm_code": { - "type": "long" - }, - "cisco_fw_erm_descr": { - "type": "keyword" - }, - "cisco_trustsec_src_id": { - "type": "keyword" - }, - "cisco_trustsec_dst_id": { - "type": "keyword" - }, - "cisco_trustsec_src_name": { - "type": "keyword" - }, - "cisco_trustsec_dst_name": { - "type": "keyword" - }, - "cisco_trustsec_switch_derived_sgt": { - "type": "keyword" - }, - "cisco_fw_blackout_secs": { - "type": "long" - }, - "cisco_fw_half_open_sessions_rate_1min_max": { - "type": "long" - }, - "cisco_fw_half_open_sessions_rate_1min": { - "type": "long" - }, - "cisco_fw_zonepair_id": { - "type": "long" - }, - "cisco_fw_sessions_max": { - "type": "long" - }, - "cisco_fw_zonepair": { - "type": "keyword" - }, - "cisco_fw_ext_event_descr": { - "type": "keyword" - }, - "cisco_fw_drop_pass_summary_packets": { - "type": "long" - }, - "cisco_fw_half_open_sessions": { - "type": "long" - }, - "cisco_waas_dre_input": { - "type": "long" - }, - "cisco_waas_dre_output": { - "type": "long" - }, - "cisco_waas_lz_input": { - "type": "long" - }, - "cisco_waas_lz_output": { - "type": "long" - }, - "cisco_waas_conn_mode": { - "type": "long" - }, - "cisco_waas_input_bytes": { - "type": "long" - }, - "cisco_waas_output_bytes": { - "type": "long" - }, - "cisco_avc_transport_short_term_packets_drop": { - "type": "long" - }, - "cisco_avc_transport_long_term_packets_drop": { - "type": "long" - }, - "cisco_avc_app_media_bytes": { - "type": "long" - }, - "cisco_avc_app_media_byte_rate": { - "type": "long" - }, - "cisco_avc_app_media_packets": { - "type": "long" - }, - "cisco_avc_app_media_packet_rate": { - "type": "long" - }, - "cisco_avc_app_media_packet_rate_variation": { - "type": "long" - }, - "cisco_avc_app_media_event": { - "type": "long" - }, - "cisco_avc_app_monitor_event": { - "type": "long" - }, - "cisco_avc_transport_packets_expected": { - "type": "long" - }, - "cisco_avc_transport_rtt": { - "type": "long" - }, - "cisco_avc_transport_packet_sets_lost": { - "type": "long" - }, - "cisco_avc_transport_short_term_packets_lost": { - "type": "long" - }, - "cisco_avc_transport_long_term_packets_lost": { - "type": "long" - }, - "cisco_avc_transport_packet_loss_rate": { - "type": "long" - }, - "cisco_avc_transport_rtp_ssrc": { - "type": "long" - }, - "cisco_avc_transport_rtp_jitter_mean": { - "type": "long" - }, - "cisco_avc_transport_rtp_jitter_min": { - "type": "long" - }, - "cisco_avc_transport_rtp_jitter_max": { - "type": "long" - }, - "cisco_avc_controlled_tc": { - "type": "long" - }, - "cisco_avc_in_policy_tc": { - "type": "long" - }, - "cisco_avc_app_media_packet_rate_variation_min": { - "type": "long" - }, - "cisco_avc_app_media_packet_rate_variation_max": { - "type": "long" - }, - "cisco_avc_transport_rtp_flows": { - "type": "long" - }, - "cisco_avc_transport_rtp_payload_type": { - "type": "long" - }, - "cisco_avc_transport_packet_loss_rate_min": { - "type": "long" - }, - "cisco_avc_transport_packet_loss_rate_max": { - "type": "long" - }, - "cisco_avc_transport_rtt_sum": { - "type": "long" - }, - "cisco_avc_transport_rtt_min": { - "type": "long" - }, - "cisco_avc_transport_rtt_max": { - "type": "long" - }, - "cisco_avc_metadata_global_session_id": { - "type": "long" - }, - "cisco_avc_metadata_multi_party_session_id": { - "type": "long" - }, - "cisco_avc_metadata_clock_rate": { - "type": "long" - }, - "cisco_avc_network_delay_avg": { - "type": "long" - }, - "cisco_avc_one_way_delay": { - "type": "long" - }, - "cisco_avc_tcp_window_size_min": { - "type": "long" - }, - "cisco_avc_tcp_window_size_max": { - "type": "long" - }, - "cisco_avc_tcp_max_segment_size": { - "type": "long" - }, - "cisco_avc_tcp_window_size_sum": { - "type": "long" - }, - "cisco_avc_rtp_jitter_interarrival_avg": { - "type": "long" - }, - "cisco_pfr_src_site_id": { - "type": "ip" - }, - "cisco_pfr_dst_site_id": { - "type": "ip" - }, - "cisco_avc_transport_byte_loss_rate": { - "type": "long" - }, - "cisco_pfr_event_tc_nomitigation_err_bw_count": { - "type": "long" - }, - "cisco_pfr_event_tc_nomitigation_err_perf_count": { - "type": "long" - }, - "cisco_pfr_dst_site_prefix": { - "type": "ip" - }, - "cisco_pfr_dst_site_prefix_mask": { - "type": "long" - }, - "cisco_pfr_label_id": { - "type": "long" - }, - "cisco_pfr_br_addr": { - "type": "ip" - }, - "cisco_pfr_state": { - "type": "long" - }, - "cisco_pfr_reason_id": { - "type": "long" - }, - "cisco_pfr_threshold": { - "type": "long" - }, - "cisco_pfr_priority": { - "type": "long" - }, - "cisco_avc_long_term_rtt": { - "type": "long" - }, - "cisco_avc_mos_below_counts": { - "type": "long" - }, - "cisco_avc_rsvp_bandwidth_pool": { - "type": "long" - }, - "cisco_avc_rollup_counter": { - "type": "long" - }, - "cisco_avc_kth_tier_percent": { - "type": "long" - }, - "cisco_avc_kth_bw_fee": { - "type": "long" - }, - "cisco_avc_src_port_min": { - "type": "long" - }, - "cisco_avc_src_port_max": { - "type": "long" - }, - "cisco_avc_dst_port_min": { - "type": "long" - }, - "cisco_avc_dst_port_max": { - "type": "long" - }, - "cisco_avc_link_capacity": { - "type": "long" - }, - "cisco_avc_ingress_bw": { - "type": "long" - }, - "cisco_avc_ingress_bw_max": { - "type": "long" - }, - "cisco_avc_egress_bw": { - "type": "long" - }, - "cisco_avc_egress_bw_max": { - "type": "long" - }, - "cisco_avc_ingress_rollup_bw": { - "type": "long" - }, - "cisco_avc_egress_rollup_bw": { - "type": "long" - }, - "cisco_avc_kth_rollup_bw": { - "type": "long" - }, - "cisco_avc_link_group_name": { - "type": "keyword" - }, - "cisco_avc_bgp_community": { - "type": "ip" - }, - "cisco_avc_bgp_prepend": { - "type": "long" - }, - "cisco_avc_cost_discard_rollup_count": { - "type": "long" - }, - "cisco_fw_user": { - "type": "keyword" - }, - "cisco_fw_xlate_src_addr_ipv4": { - "type": "ip" - }, - "cisco_fw_xlate_dst_addr_ipv4": { - "type": "ip" - }, - "cisco_fw_xlate_src_port": { - "type": "long" - }, - "cisco_fw_xlate_dst_port": { - "type": "long" - }, - "cisco_fw_event": { - "type": "keyword" - }, - "cisco_avc_client_long_lived_network_delay_max": { - "type": "long" - }, - "cisco_avc_client_long_lived_network_delay_min": { - "type": "long" - }, - "cisco_avc_server_long_lived_network_delay_max": { - "type": "long" - }, - "cisco_avc_server_long_lived_network_delay_min": { - "type": "long" - }, - "cisco_policy_qos_class_hierarchy": { - "type": "keyword" - }, - "cisco_avc_server_bytes": { - "type": "long" - }, - "cisco_avc_client_bytes": { - "type": "long" - }, - "cisco_avc_concurrent_sessions": { - "type": "long" - }, - "cisco_waas_segment": { - "type": "long" - }, - "cisco_waas_passthru_reason": { - "type": "long" - }, - "cisco_avc_server_long_lived_network_delay_sum": { - "type": "long" - }, - "cisco_avc_client_long_lived_network_delay_sum": { - "type": "long" - }, - "cisco_avc_total_long_lived_network_delay_sum": { - "type": "long" - }, - "cisco_avc_total_long_lived_network_delay_samples": { - "type": "long" - }, - "cisco_avc_server_long_lived_network_delay_samples": { - "type": "long" - }, - "cisco_avc_client_long_lived_network_delay_samples": { - "type": "long" - }, - "cisco_avc_client_packets": { - "type": "long" - }, - "cisco_avc_server_packets": { - "type": "long" - }, - "cisco_avc_client_retrans_bytes": { - "type": "long" - }, - "cisco_avc_client_retrans_packets": { - "type": "long" - }, - "cisco_avc_server_retrans_bytes": { - "type": "long" - }, - "cisco_avc_server_retrans_packets": { - "type": "long" - }, - "cisco_avc_transact_time_delta": { - "type": "long" - }, - "cisco_avc_transact_time_total": { - "type": "long" - }, - "cisco_avc_transact_time_max": { - "type": "long" - }, - "cisco_avc_transact_time_min": { - "type": "long" - }, - "cisco_avc_server_resps": { - "type": "long" - }, - "cisco_avc_resp_histogram1": { - "type": "long" - }, - "cisco_avc_resp_histogram2": { - "type": "long" - }, - "cisco_avc_resp_histogram3": { - "type": "long" - }, - "cisco_avc_resp_histogram4": { - "type": "long" - }, - "cisco_avc_resp_histogram5": { - "type": "long" - }, - "cisco_avc_resp_histogram6": { - "type": "long" - }, - "cisco_avc_resp_histogram7": { - "type": "long" - }, - "cisco_avc_server_late_resps": { - "type": "long" - }, - "cisco_avc_server_resp_time_sum": { - "type": "long" - }, - "cisco_avc_server_resp_time_max": { - "type": "long" - }, - "cisco_avc_server_resp_time_min": { - "type": "long" - }, - "cisco_avc_app_delay_sum": { - "type": "long" - }, - "cisco_avc_app_delay_max": { - "type": "long" - }, - "cisco_avc_app_delay_min": { - "type": "long" - }, - "cisco_avc_total_delay_sum": { - "type": "long" - }, - "cisco_avc_total_delay_max": { - "type": "long" - }, - "cisco_avc_total_delay_min": { - "type": "long" - }, - "cisco_avc_total_network_delay_sum": { - "type": "long" - }, - "cisco_avc_total_network_delay_max": { - "type": "long" - }, - "cisco_avc_total_network_delay_min": { - "type": "long" - }, - "cisco_avc_client_network_delay_sum": { - "type": "long" - }, - "cisco_avc_client_network_delay_max": { - "type": "long" - }, - "cisco_avc_client_network_delay_min": { - "type": "long" - }, - "cisco_avc_server_network_delay_sum": { - "type": "long" - }, - "cisco_avc_server_network_delay_max": { - "type": "long" - }, - "cisco_avc_server_network_delay_min": { - "type": "long" - }, - "cisco_avc_rtp_short_term_mos": { - "type": "long" - }, - "cisco_avc_rtp_mos": { - "type": "long" - }, - "cisco_avc_rtp_mos_total": { - "type": "long" - }, - "cisco_avc_app_http_uri_stats": { - "type": "keyword" - }, - "cisco_avc_policy_qos_queue_id": { - "type": "long" - }, - "cisco_avc_policy_qos_queue_drops": { - "type": "long" - }, - "cisco_eta_idp_old": { - "type": "long" - }, - "cisco_eta_slpt_old": { - "type": "long" - }, - "cisco_wlan_id": { - "type": "long" - }, - "cisco_avc_app_category": { - "type": "keyword" - }, - "cisco_avc_app_sub_category": { - "type": "keyword" - }, - "cisco_avc_app_group": { - "type": "keyword" - }, - "cisco_avc_app_http_host": { - "type": "keyword" - }, - "cisco_avc_client_ipv4_addr": { - "type": "ip" - }, - "cisco_avc_server_ipv4_addr": { - "type": "ip" - }, - "cisco_avc_client_ipv6_addr": { - "type": "ip" - }, - "cisco_avc_server_ipv6_addr": { - "type": "ip" - }, - "cisco_avc_client_l4_port": { - "type": "long" - }, - "cisco_avc_server_l4_port": { - "type": "long" - }, - "cisco_avc_conn_id": { - "type": "long" - }, - "cisco_avc_app_traffic_class": { - "type": "keyword" - }, - "cisco_avc_app_business_relevance": { - "type": "keyword" - }, - "cisco_nvzflow_udid": { - "type": "keyword" - }, - "cisco_nvzflow_user": { - "type": "keyword" - }, - "cisco_nvzflow_os_name": { - "type": "keyword" - }, - "cisco_nvzflow_os_ver": { - "type": "keyword" - }, - "cisco_nvzflow_sys_vendor": { - "type": "keyword" - }, - "cisco_nvzflow_sys_type": { - "type": "keyword" - }, - "cisco_nvzflow_proc_acct": { - "type": "keyword" - }, - "cisco_nvzflow_parent_proc_acct": { - "type": "keyword" - }, - "cisco_nvzflow_proc": { - "type": "keyword" - }, - "cisco_nvzflow_proc_hash": { - "type": "keyword" - }, - "cisco_nvzflow_parent_proc": { - "type": "keyword" - }, - "cisco_nvzflow_parent_proc_hash": { - "type": "keyword" - }, - "cisco_nvzflow_dns_suffix": { - "type": "keyword" - }, - "cisco_nvzflow_dst_hostname": { - "type": "keyword" - }, - "cisco_nvzflow_l4_bytes_in": { - "type": "long" - }, - "cisco_nvzflow_l4_bytes_out": { - "type": "long" - }, - "cisco_nvzflow_os_edition": { - "type": "keyword" - }, - "cisco_nvzflow_module_list": { - "type": "keyword" - }, - "cisco_nvzflow_hash_list": { - "type": "keyword" - }, - "cisco_nvzflow_coord_list": { - "type": "keyword" - }, - "cisco_nvzflow_iface_info_uid": { - "type": "long" - }, - "cisco_nvzflow_iface_index": { - "type": "long" - }, - "cisco_nvzflow_iface_type": { - "type": "long" - }, - "cisco_nvzflow_iface_name": { - "type": "keyword" - }, - "cisco_nvzflow_iface_details_list": { - "type": "keyword" - }, - "cisco_timestamp_abs_monitor_interval_start": { - "type": "long" - }, - "cisco_timestamp_abs_monitor_interval_end": { - "type": "long" - }, + "cisco_avc_p2p_tech": { + "type": "keyword" + }, + "cisco_avc_tunnel_tech": { + "type": "keyword" + }, + "cisco_avc_encrypt_tech": { + "type": "keyword" + }, + "cisco_ipt_dialing_phone": { + "type": "ip" + }, + "cisco_ipt_dialing_user": { + "type": "keyword" + }, + "cisco_ipt_dialed_phone": { + "type": "ip" + }, + "cisco_ipt_dialed_user": { + "type": "keyword" + }, + "cisco_ipt_call_duration": { + "type": "long" + }, + "cisco_ipt_call_end_reason": { + "type": "long" + }, + "cisco_ipt_calls_dialed": { + "type": "long" + }, + "cisco_ipt_calls_connected": { + "type": "long" + }, + "cisco_ipt_calls_failed": { + "type": "long" + }, + "cisco_nexus_fastpath_src_addr": { + "type": "ip" + }, + "cisco_nexus_fastpath_src_port": { + "type": "long" + }, + "cisco_nexus_fastpath_dst_addr": { + "type": "ip" + }, + "cisco_nexus_fastpath_dst_port": { + "type": "long" + }, + "cisco_endpoint_process_user": { + "type": "keyword" + }, + "cisco_endpoint_process_name": { + "type": "keyword" + }, + "cisco_endpoint_process_hash": { + "type": "keyword" + }, + "cisco_endpoint_process_parent_user": { + "type": "keyword" + }, + "cisco_endpoint_process_parent_name": { + "type": "keyword" + }, + "cisco_endpoint_process_parent_hash": { + "type": "keyword" + }, + "cisco_pfr_policy_id": { + "type": "long" + }, + "cisco_pfr_map_name": { + "type": "keyword" + }, + "cisco_pfr_reason": { + "type": "keyword" + }, + "cisco_fw_ingress_acl_id": { + "type": "keyword" + }, + "cisco_fw_egress_acl_id": { + "type": "keyword" + }, + "cisco_fw_ext_event": { + "type": "keyword" + }, + "cisco_fw_event_level": { + "type": "long" + }, + "cisco_fw_event_level_id": { + "type": "long" + }, + "cisco_fw_config_value": { + "type": "long" + }, + "cisco_fw_erm_code": { + "type": "long" + }, + "cisco_fw_erm_descr": { + "type": "keyword" + }, + "cisco_trustsec_src_id": { + "type": "keyword" + }, + "cisco_trustsec_dst_id": { + "type": "keyword" + }, + "cisco_trustsec_src_name": { + "type": "keyword" + }, + "cisco_trustsec_dst_name": { + "type": "keyword" + }, + "cisco_trustsec_switch_derived_sgt": { + "type": "keyword" + }, + "cisco_fw_blackout_secs": { + "type": "long" + }, + "cisco_fw_half_open_sessions_rate_1min_max": { + "type": "long" + }, + "cisco_fw_half_open_sessions_rate_1min": { + "type": "long" + }, + "cisco_fw_zonepair_id": { + "type": "long" + }, + "cisco_fw_sessions_max": { + "type": "long" + }, + "cisco_fw_zonepair": { + "type": "keyword" + }, + "cisco_fw_ext_event_descr": { + "type": "keyword" + }, + "cisco_fw_drop_pass_summary_packets": { + "type": "long" + }, + "cisco_fw_half_open_sessions": { + "type": "long" + }, + "cisco_waas_dre_input": { + "type": "long" + }, + "cisco_waas_dre_output": { + "type": "long" + }, + "cisco_waas_lz_input": { + "type": "long" + }, + "cisco_waas_lz_output": { + "type": "long" + }, + "cisco_waas_conn_mode": { + "type": "long" + }, + "cisco_waas_input_bytes": { + "type": "long" + }, + "cisco_waas_output_bytes": { + "type": "long" + }, + "cisco_avc_transport_short_term_packets_drop": { + "type": "long" + }, + "cisco_avc_transport_long_term_packets_drop": { + "type": "long" + }, + "cisco_avc_app_media_bytes": { + "type": "long" + }, + "cisco_avc_app_media_byte_rate": { + "type": "long" + }, + "cisco_avc_app_media_packets": { + "type": "long" + }, + "cisco_avc_app_media_packet_rate": { + "type": "long" + }, + "cisco_avc_app_media_packet_rate_variation": { + "type": "long" + }, + "cisco_avc_app_media_event": { + "type": "long" + }, + "cisco_avc_app_monitor_event": { + "type": "long" + }, + "cisco_avc_transport_packets_expected": { + "type": "long" + }, + "cisco_avc_transport_rtt": { + "type": "long" + }, + "cisco_avc_transport_packet_sets_lost": { + "type": "long" + }, + "cisco_avc_transport_short_term_packets_lost": { + "type": "long" + }, + "cisco_avc_transport_long_term_packets_lost": { + "type": "long" + }, + "cisco_avc_transport_packet_loss_rate": { + "type": "long" + }, + "cisco_avc_transport_rtp_ssrc": { + "type": "long" + }, + "cisco_avc_transport_rtp_jitter_mean": { + "type": "long" + }, + "cisco_avc_transport_rtp_jitter_min": { + "type": "long" + }, + "cisco_avc_transport_rtp_jitter_max": { + "type": "long" + }, + "cisco_avc_controlled_tc": { + "type": "long" + }, + "cisco_avc_in_policy_tc": { + "type": "long" + }, + "cisco_avc_app_media_packet_rate_variation_min": { + "type": "long" + }, + "cisco_avc_app_media_packet_rate_variation_max": { + "type": "long" + }, + "cisco_avc_transport_rtp_flows": { + "type": "long" + }, + "cisco_avc_transport_rtp_payload_type": { + "type": "long" + }, + "cisco_avc_transport_packet_loss_rate_min": { + "type": "long" + }, + "cisco_avc_transport_packet_loss_rate_max": { + "type": "long" + }, + "cisco_avc_transport_rtt_sum": { + "type": "long" + }, + "cisco_avc_transport_rtt_min": { + "type": "long" + }, + "cisco_avc_transport_rtt_max": { + "type": "long" + }, + "cisco_avc_metadata_global_session_id": { + "type": "long" + }, + "cisco_avc_metadata_multi_party_session_id": { + "type": "long" + }, + "cisco_avc_metadata_clock_rate": { + "type": "long" + }, + "cisco_avc_network_delay_avg": { + "type": "long" + }, + "cisco_avc_one_way_delay": { + "type": "long" + }, + "cisco_avc_tcp_window_size_min": { + "type": "long" + }, + "cisco_avc_tcp_window_size_max": { + "type": "long" + }, + "cisco_avc_tcp_max_segment_size": { + "type": "long" + }, + "cisco_avc_tcp_window_size_sum": { + "type": "long" + }, + "cisco_avc_rtp_jitter_interarrival_avg": { + "type": "long" + }, + "cisco_pfr_src_site_id": { + "type": "ip" + }, + "cisco_pfr_dst_site_id": { + "type": "ip" + }, + "cisco_avc_transport_byte_loss_rate": { + "type": "long" + }, + "cisco_pfr_event_tc_nomitigation_err_bw_count": { + "type": "long" + }, + "cisco_pfr_event_tc_nomitigation_err_perf_count": { + "type": "long" + }, + "cisco_pfr_dst_site_prefix": { + "type": "ip" + }, + "cisco_pfr_dst_site_prefix_mask": { + "type": "long" + }, + "cisco_pfr_label_id": { + "type": "long" + }, + "cisco_pfr_br_addr": { + "type": "ip" + }, + "cisco_pfr_state": { + "type": "long" + }, + "cisco_pfr_reason_id": { + "type": "long" + }, + "cisco_pfr_threshold": { + "type": "long" + }, + "cisco_pfr_priority": { + "type": "long" + }, + "cisco_avc_long_term_rtt": { + "type": "long" + }, + "cisco_avc_mos_below_counts": { + "type": "long" + }, + "cisco_avc_rsvp_bandwidth_pool": { + "type": "long" + }, + "cisco_avc_rollup_counter": { + "type": "long" + }, + "cisco_avc_kth_tier_percent": { + "type": "long" + }, + "cisco_avc_kth_bw_fee": { + "type": "long" + }, + "cisco_avc_src_port_min": { + "type": "long" + }, + "cisco_avc_src_port_max": { + "type": "long" + }, + "cisco_avc_dst_port_min": { + "type": "long" + }, + "cisco_avc_dst_port_max": { + "type": "long" + }, + "cisco_avc_link_capacity": { + "type": "long" + }, + "cisco_avc_ingress_bw": { + "type": "long" + }, + "cisco_avc_ingress_bw_max": { + "type": "long" + }, + "cisco_avc_egress_bw": { + "type": "long" + }, + "cisco_avc_egress_bw_max": { + "type": "long" + }, + "cisco_avc_ingress_rollup_bw": { + "type": "long" + }, + "cisco_avc_egress_rollup_bw": { + "type": "long" + }, + "cisco_avc_kth_rollup_bw": { + "type": "long" + }, + "cisco_avc_link_group_name": { + "type": "keyword" + }, + "cisco_avc_bgp_community": { + "type": "ip" + }, + "cisco_avc_bgp_prepend": { + "type": "long" + }, + "cisco_avc_cost_discard_rollup_count": { + "type": "long" + }, + "cisco_fw_user": { + "type": "keyword" + }, + "cisco_fw_xlate_src_addr_ipv4": { + "type": "ip" + }, + "cisco_fw_xlate_dst_addr_ipv4": { + "type": "ip" + }, + "cisco_fw_xlate_src_port": { + "type": "long" + }, + "cisco_fw_xlate_dst_port": { + "type": "long" + }, + "cisco_fw_event": { + "type": "keyword" + }, + "cisco_avc_client_long_lived_network_delay_max": { + "type": "long" + }, + "cisco_avc_client_long_lived_network_delay_min": { + "type": "long" + }, + "cisco_avc_server_long_lived_network_delay_max": { + "type": "long" + }, + "cisco_avc_server_long_lived_network_delay_min": { + "type": "long" + }, + "cisco_policy_qos_class_hierarchy": { + "type": "keyword" + }, + "cisco_avc_server_bytes": { + "type": "long" + }, + "cisco_avc_client_bytes": { + "type": "long" + }, + "cisco_avc_concurrent_sessions": { + "type": "long" + }, + "cisco_waas_segment": { + "type": "long" + }, + "cisco_waas_passthru_reason": { + "type": "long" + }, + "cisco_avc_server_long_lived_network_delay_sum": { + "type": "long" + }, + "cisco_avc_client_long_lived_network_delay_sum": { + "type": "long" + }, + "cisco_avc_total_long_lived_network_delay_sum": { + "type": "long" + }, + "cisco_avc_total_long_lived_network_delay_samples": { + "type": "long" + }, + "cisco_avc_server_long_lived_network_delay_samples": { + "type": "long" + }, + "cisco_avc_client_long_lived_network_delay_samples": { + "type": "long" + }, + "cisco_avc_client_packets": { + "type": "long" + }, + "cisco_avc_server_packets": { + "type": "long" + }, + "cisco_avc_client_retrans_bytes": { + "type": "long" + }, + "cisco_avc_client_retrans_packets": { + "type": "long" + }, + "cisco_avc_server_retrans_bytes": { + "type": "long" + }, + "cisco_avc_server_retrans_packets": { + "type": "long" + }, + "cisco_avc_transact_time_delta": { + "type": "long" + }, + "cisco_avc_transact_time_total": { + "type": "long" + }, + "cisco_avc_transact_time_max": { + "type": "long" + }, + "cisco_avc_transact_time_min": { + "type": "long" + }, + "cisco_avc_server_resps": { + "type": "long" + }, + "cisco_avc_resp_histogram1": { + "type": "long" + }, + "cisco_avc_resp_histogram2": { + "type": "long" + }, + "cisco_avc_resp_histogram3": { + "type": "long" + }, + "cisco_avc_resp_histogram4": { + "type": "long" + }, + "cisco_avc_resp_histogram5": { + "type": "long" + }, + "cisco_avc_resp_histogram6": { + "type": "long" + }, + "cisco_avc_resp_histogram7": { + "type": "long" + }, + "cisco_avc_server_late_resps": { + "type": "long" + }, + "cisco_avc_server_resp_time_sum": { + "type": "long" + }, + "cisco_avc_server_resp_time_max": { + "type": "long" + }, + "cisco_avc_server_resp_time_min": { + "type": "long" + }, + "cisco_avc_app_delay_sum": { + "type": "long" + }, + "cisco_avc_app_delay_max": { + "type": "long" + }, + "cisco_avc_app_delay_min": { + "type": "long" + }, + "cisco_avc_total_delay_sum": { + "type": "long" + }, + "cisco_avc_total_delay_max": { + "type": "long" + }, + "cisco_avc_total_delay_min": { + "type": "long" + }, + "cisco_avc_total_network_delay_sum": { + "type": "long" + }, + "cisco_avc_total_network_delay_max": { + "type": "long" + }, + "cisco_avc_total_network_delay_min": { + "type": "long" + }, + "cisco_avc_client_network_delay_sum": { + "type": "long" + }, + "cisco_avc_client_network_delay_max": { + "type": "long" + }, + "cisco_avc_client_network_delay_min": { + "type": "long" + }, + "cisco_avc_server_network_delay_sum": { + "type": "long" + }, + "cisco_avc_server_network_delay_max": { + "type": "long" + }, + "cisco_avc_server_network_delay_min": { + "type": "long" + }, + "cisco_avc_rtp_short_term_mos": { + "type": "long" + }, + "cisco_avc_rtp_mos": { + "type": "long" + }, + "cisco_avc_rtp_mos_total": { + "type": "long" + }, + "cisco_avc_app_http_uri_stats": { + "type": "keyword" + }, + "cisco_avc_policy_qos_queue_id": { + "type": "long" + }, + "cisco_avc_policy_qos_queue_drops": { + "type": "long" + }, + "cisco_eta_idp_old": { + "type": "long" + }, + "cisco_eta_slpt_old": { + "type": "long" + }, + "cisco_wlan_id": { + "type": "long" + }, + "cisco_avc_app_category": { + "type": "keyword" + }, + "cisco_avc_app_sub_category": { + "type": "keyword" + }, + "cisco_avc_app_group": { + "type": "keyword" + }, + "cisco_avc_app_http_host": { + "type": "keyword" + }, + "cisco_avc_client_ipv4_addr": { + "type": "ip" + }, + "cisco_avc_server_ipv4_addr": { + "type": "ip" + }, + "cisco_avc_client_ipv6_addr": { + "type": "ip" + }, + "cisco_avc_server_ipv6_addr": { + "type": "ip" + }, + "cisco_avc_client_l4_port": { + "type": "long" + }, + "cisco_avc_server_l4_port": { + "type": "long" + }, + "cisco_avc_conn_id": { + "type": "long" + }, + "cisco_avc_app_traffic_class": { + "type": "keyword" + }, + "cisco_avc_app_business_relevance": { + "type": "keyword" + }, + "cisco_nvzflow_udid": { + "type": "keyword" + }, + "cisco_nvzflow_user": { + "type": "keyword" + }, + "cisco_nvzflow_os_name": { + "type": "keyword" + }, + "cisco_nvzflow_os_ver": { + "type": "keyword" + }, + "cisco_nvzflow_sys_vendor": { + "type": "keyword" + }, + "cisco_nvzflow_sys_type": { + "type": "keyword" + }, + "cisco_nvzflow_proc_acct": { + "type": "keyword" + }, + "cisco_nvzflow_parent_proc_acct": { + "type": "keyword" + }, + "cisco_nvzflow_proc": { + "type": "keyword" + }, + "cisco_nvzflow_proc_hash": { + "type": "keyword" + }, + "cisco_nvzflow_parent_proc": { + "type": "keyword" + }, + "cisco_nvzflow_parent_proc_hash": { + "type": "keyword" + }, + "cisco_nvzflow_dns_suffix": { + "type": "keyword" + }, + "cisco_nvzflow_dst_hostname": { + "type": "keyword" + }, + "cisco_nvzflow_l4_bytes_in": { + "type": "long" + }, + "cisco_nvzflow_l4_bytes_out": { + "type": "long" + }, + "cisco_nvzflow_os_edition": { + "type": "keyword" + }, + "cisco_nvzflow_module_list": { + "type": "keyword" + }, + "cisco_nvzflow_hash_list": { + "type": "keyword" + }, + "cisco_nvzflow_coord_list": { + "type": "keyword" + }, + "cisco_nvzflow_iface_info_uid": { + "type": "long" + }, + "cisco_nvzflow_iface_index": { + "type": "long" + }, + "cisco_nvzflow_iface_type": { + "type": "long" + }, + "cisco_nvzflow_iface_name": { + "type": "keyword" + }, + "cisco_nvzflow_iface_details_list": { + "type": "keyword" + }, + "cisco_timestamp_abs_monitor_interval_start": { + "type": "long" + }, + "cisco_timestamp_abs_monitor_interval_end": { + "type": "long" + }, - "f5_msg_sev": { - "type": "long" - }, - "f5_partition": { - "type": "keyword" - }, - "f5_err_defs_msg_num": { - "type": "long" - }, - "f5_bigip_mgmt_ipv4_addr": { - "type": "ip" - }, - "f5_bigip_mgmt_ipv6_addr": { - "type": "ip" - }, - "f5_query_name": { - "type": "keyword" - }, - "f5_dns_query_type": { - "type": "keyword" - }, - "f5_context_name": { - "type": "keyword" - }, - "f5_bigip_hostname": { - "type": "keyword" - }, - "f5_device_vendor": { - "type": "keyword" - }, - "f5_device_product": { - "type": "keyword" - }, - "f5_device_ver": { - "type": "keyword" - }, - "f5_msg": { - "type": "keyword" - }, - "f5_vlan": { - "type": "keyword" - }, - "f5_ipfix_msg_no": { - "type": "long" - }, - "f5_attack_id": { - "type": "long" - }, - "f5_attack": { - "type": "keyword" - }, - "f5_packets_rcvd": { - "type": "long" - }, - "f5_packets_drop": { - "type": "long" - }, - "f5_context_type": { - "type": "keyword" - }, - "f5_acl_policy_type": { - "type": "keyword" - }, - "f5_acl_policy": { - "type": "keyword" - }, - "f5_trans_ip_proto": { - "type": "long" - }, - "f5_trans_src_ipv4_addr": { - "type": "ip" - }, - "f5_trans_src_ipv6_addr": { - "type": "ip" - }, - "f5_trans_src_port": { - "type": "long" - }, - "f5_trans_dst_ipv4_addr": { - "type": "ip" - }, - "f5_trans_dst_ipv6_addr": { - "type": "ip" - }, - "f5_trans_dst_port": { - "type": "long" - }, - "f5_trans_vlan": { - "type": "keyword" - }, - "f5_trans_route_domain": { - "type": "long" - }, - "f5_sa_trans_type": { - "type": "keyword" - }, - "f5_sa_trans_pool": { - "type": "keyword" - }, - "f5_acl_rule": { - "type": "keyword" - }, - "f5_action": { - "type": "keyword" - }, - "f5_drop_reason": { - "type": "keyword" - }, - "f5_attack_event": { - "type": "keyword" - }, - "f5_ip_intel_threat_name": { - "type": "keyword" - }, - "f5_destination_geo": { - "type": "keyword" - }, - "f5_source_geo": { - "type": "keyword" - }, - "f5_ip_intel_policy_name": { - "type": "keyword" - }, - "f5_attack_type": { - "type": "keyword" - }, - "f5_app_category": { - "type": "long" - }, - "f5_classification": { - "type": "keyword" - }, - "f5_flow_start_millis": { - "type": "long" - }, - "f5_flow_start_secs": { - "type": "long" - }, - "f5_flow_stop_millis": { - "type": "long" - }, - "f5_flow_stop_secs": { - "type": "long" - }, - "f5_record_type": { - "type": "long" - }, - "f5_report_id": { - "type": "long" - }, - "f5_report_ver": { - "type": "keyword" - }, - "f5_3gpp_params": { - "type": "keyword" - }, - "f5_concurrent_flows": { - "type": "long" - }, - "f5_duration_secs": { - "type": "long" - }, - "f5_last_record_sent": { - "type": "long" - }, - "f5_new_flows": { - "type": "long" - }, - "f5_record_reason": { - "type": "long" - }, - "f5_success_transacts": { - "type": "long" - }, - "f5_terminated_flows": { - "type": "long" - }, - "f5_subscriber_id": { - "type": "keyword" - }, - "f5_subscriber_id_type": { - "type": "keyword" - }, - "f5_total_transacts": { - "type": "long" - }, - "f5_http_hostname": { - "type": "keyword" - }, - "f5_http_hostname_trunc": { - "type": "long" - }, - "f5_http_resp_code": { - "type": "long" - }, - "f5_http_url": { - "type": "keyword" - }, - "f5_http_url_trunc": { - "type": "long" - }, - "f5_http_user_agent": { - "type": "keyword" - }, - "f5_http_user_agent_trunc": { - "type": "long" - }, - "f5_transacts": { - "type": "long" - }, - "f5_skipped_transacts": { - "type": "long" - }, - "f5_transact_start_millis": { - "type": "long" - }, - "f5_transact_start_secs": { - "type": "long" - }, - "f5_transact_stop_millis": { - "type": "long" - }, - "f5_transact_stop_secs": { - "type": "long" - }, - "f5_url_category": { - "type": "long" - }, - "f5_downlink_volume": { - "type": "long" - }, - "f5_uplink_volume": { - "type": "long" - }, - "f5_observation_time_secs": { - "type": "long" - }, - "f5_timestamp_millis": { - "type": "long" - }, - "f5_vlan_id": { - "type": "long" - }, - "f5_source_user": { - "type": "keyword" - }, - "f5_log_profile": { - "type": "keyword" - }, - "f5_log_msg_drops": { - "type": "long" - }, - "f5_log_msg_name": { - "type": "keyword" - }, - "f5_src_fqdn": { - "type": "keyword" - }, - "f5_dst_fqdn": { - "type": "keyword" - }, + "f5_msg_sev": { + "type": "long" + }, + "f5_partition": { + "type": "keyword" + }, + "f5_err_defs_msg_num": { + "type": "long" + }, + "f5_bigip_mgmt_ipv4_addr": { + "type": "ip" + }, + "f5_bigip_mgmt_ipv6_addr": { + "type": "ip" + }, + "f5_query_name": { + "type": "keyword" + }, + "f5_dns_query_type": { + "type": "keyword" + }, + "f5_context_name": { + "type": "keyword" + }, + "f5_bigip_hostname": { + "type": "keyword" + }, + "f5_device_vendor": { + "type": "keyword" + }, + "f5_device_product": { + "type": "keyword" + }, + "f5_device_ver": { + "type": "keyword" + }, + "f5_msg": { + "type": "keyword" + }, + "f5_vlan": { + "type": "keyword" + }, + "f5_ipfix_msg_no": { + "type": "long" + }, + "f5_attack_id": { + "type": "long" + }, + "f5_attack": { + "type": "keyword" + }, + "f5_packets_rcvd": { + "type": "long" + }, + "f5_packets_drop": { + "type": "long" + }, + "f5_context_type": { + "type": "keyword" + }, + "f5_acl_policy_type": { + "type": "keyword" + }, + "f5_acl_policy": { + "type": "keyword" + }, + "f5_trans_ip_proto": { + "type": "long" + }, + "f5_trans_src_ipv4_addr": { + "type": "ip" + }, + "f5_trans_src_ipv6_addr": { + "type": "ip" + }, + "f5_trans_src_port": { + "type": "long" + }, + "f5_trans_dst_ipv4_addr": { + "type": "ip" + }, + "f5_trans_dst_ipv6_addr": { + "type": "ip" + }, + "f5_trans_dst_port": { + "type": "long" + }, + "f5_trans_vlan": { + "type": "keyword" + }, + "f5_trans_route_domain": { + "type": "long" + }, + "f5_sa_trans_type": { + "type": "keyword" + }, + "f5_sa_trans_pool": { + "type": "keyword" + }, + "f5_acl_rule": { + "type": "keyword" + }, + "f5_action": { + "type": "keyword" + }, + "f5_drop_reason": { + "type": "keyword" + }, + "f5_attack_event": { + "type": "keyword" + }, + "f5_ip_intel_threat_name": { + "type": "keyword" + }, + "f5_destination_geo": { + "type": "keyword" + }, + "f5_source_geo": { + "type": "keyword" + }, + "f5_ip_intel_policy_name": { + "type": "keyword" + }, + "f5_attack_type": { + "type": "keyword" + }, + "f5_app_category": { + "type": "long" + }, + "f5_classification": { + "type": "keyword" + }, + "f5_flow_start_millis": { + "type": "long" + }, + "f5_flow_start_secs": { + "type": "long" + }, + "f5_flow_stop_millis": { + "type": "long" + }, + "f5_flow_stop_secs": { + "type": "long" + }, + "f5_record_type": { + "type": "long" + }, + "f5_report_id": { + "type": "long" + }, + "f5_report_ver": { + "type": "keyword" + }, + "f5_3gpp_params": { + "type": "keyword" + }, + "f5_concurrent_flows": { + "type": "long" + }, + "f5_duration_secs": { + "type": "long" + }, + "f5_last_record_sent": { + "type": "long" + }, + "f5_new_flows": { + "type": "long" + }, + "f5_record_reason": { + "type": "long" + }, + "f5_success_transacts": { + "type": "long" + }, + "f5_terminated_flows": { + "type": "long" + }, + "f5_subscriber_id": { + "type": "keyword" + }, + "f5_subscriber_id_type": { + "type": "keyword" + }, + "f5_total_transacts": { + "type": "long" + }, + "f5_http_hostname": { + "type": "keyword" + }, + "f5_http_hostname_trunc": { + "type": "long" + }, + "f5_http_resp_code": { + "type": "long" + }, + "f5_http_url": { + "type": "keyword" + }, + "f5_http_url_trunc": { + "type": "long" + }, + "f5_http_user_agent": { + "type": "keyword" + }, + "f5_http_user_agent_trunc": { + "type": "long" + }, + "f5_transacts": { + "type": "long" + }, + "f5_skipped_transacts": { + "type": "long" + }, + "f5_transact_start_millis": { + "type": "long" + }, + "f5_transact_start_secs": { + "type": "long" + }, + "f5_transact_stop_millis": { + "type": "long" + }, + "f5_transact_stop_secs": { + "type": "long" + }, + "f5_url_category": { + "type": "long" + }, + "f5_downlink_volume": { + "type": "long" + }, + "f5_uplink_volume": { + "type": "long" + }, + "f5_observation_time_secs": { + "type": "long" + }, + "f5_timestamp_millis": { + "type": "long" + }, + "f5_vlan_id": { + "type": "long" + }, + "f5_source_user": { + "type": "keyword" + }, + "f5_log_profile": { + "type": "keyword" + }, + "f5_log_msg_drops": { + "type": "long" + }, + "f5_log_msg_name": { + "type": "keyword" + }, + "f5_src_fqdn": { + "type": "keyword" + }, + "f5_dst_fqdn": { + "type": "keyword" + }, - "flowmon_http_hostname": { - "type": "keyword" - }, + "flowmon_http_hostname": { + "type": "keyword" + }, - "gigamon_http_req_url": { - "type": "keyword" - }, - "gigamon_http_resp_status": { - "type": "long" - }, - "gigamon_ssl_cert_issuer_common": { - "type": "keyword" - }, - "gigamon_ssl_cert_subj_common": { - "type": "keyword" - }, - "gigamon_ssl_cert_issuer": { - "type": "keyword" - }, - "gigamon_ssl_cert_subj": { - "type": "keyword" - }, - "gigamon_ssl_cert_valid_not_before": { - "type": "keyword" - }, - "gigamon_ssl_cert_valid_not_after": { - "type": "keyword" - }, - "gigamon_ssl_cert_serial_num": { - "type": "keyword" - }, - "gigamon_ssl_cert_sig_algo": { - "type": "keyword" - }, - "gigamon_ssl_cert_subj_pub_algo": { - "type": "keyword" - }, - "gigamon_ssl_cert_subj_pubkey_size": { - "type": "long" - }, - "gigamon_ssl_cert_subj_alt_name": { - "type": "keyword" - }, - "gigamon_ssl_server_name_ind": { - "type": "keyword" - }, - "gigamon_ssl_server_ver": { - "type": "long" - }, - "gigamon_ssl_server_cipher": { - "type": "long" - }, - "gigamon_ssl_server_compress_method": { - "type": "long" - }, - "gigamon_ssl_server_sess_id": { - "type": "keyword" - }, - "gigamon_dns_id": { - "type": "long" - }, - "gigamon_dns_op_code": { - "type": "long" - }, - "gigamon_dns_resp_code": { - "type": "long" - }, - "gigamon_dns_query": { - "type": "keyword" - }, - "gigamon_dns_resp": { - "type": "keyword" - }, - "gigamon_dns_resp_ttl": { - "type": "long" - }, - "gigamon_dns_resp_ipv4_addr": { - "type": "ip" - }, - "gigamon_dns_resp_ipv6_addr": { - "type": "ip" - }, - "gigamon_dns_bits": { - "type": "keyword" - }, - "gigamon_dns_qd_count": { - "type": "long" - }, - "gigamon_dns_an_count": { - "type": "long" - }, - "gigamon_dns_ns_count": { - "type": "long" - }, - "gigamon_dns_ar_count": { - "type": "long" - }, - "gigamon_dns_query_type": { - "type": "long" - }, - "gigamon_dns_query_class": { - "type": "long" - }, - "gigamon_dns_resp_type": { - "type": "long" - }, - "gigamon_dns_resp_class": { - "type": "long" - }, - "gigamon_dns_resp_rd_len": { - "type": "long" - }, - "gigamon_dns_resp_rdata": { - "type": "keyword" - }, - "gigamon_dns_auth_name": { - "type": "keyword" - }, - "gigamon_dns_auth_type": { - "type": "long" - }, - "gigamon_dns_auth_class": { - "type": "long" - }, - "gigamon_dns_auth_ttl": { - "type": "long" - }, - "gigamon_dns_auth_rd_len": { - "type": "long" - }, - "gigamon_dns_authority_rdata": { - "type": "keyword" - }, - "gigamon_dns_addl_name": { - "type": "keyword" - }, - "gigamon_dns_addl_type": { - "type": "long" - }, - "gigamon_dns_addl_class": { - "type": "long" - }, - "gigamon_dns_addl_ttl": { - "type": "long" - }, - "gigamon_dns_addl_rd_len": { - "type": "long" - }, - "gigamon_dns_addl_rdata": { - "type": "keyword" - }, + "gigamon_http_req_url": { + "type": "keyword" + }, + "gigamon_http_resp_status": { + "type": "long" + }, + "gigamon_ssl_cert_issuer_common": { + "type": "keyword" + }, + "gigamon_ssl_cert_subj_common": { + "type": "keyword" + }, + "gigamon_ssl_cert_issuer": { + "type": "keyword" + }, + "gigamon_ssl_cert_subj": { + "type": "keyword" + }, + "gigamon_ssl_cert_valid_not_before": { + "type": "keyword" + }, + "gigamon_ssl_cert_valid_not_after": { + "type": "keyword" + }, + "gigamon_ssl_cert_serial_num": { + "type": "keyword" + }, + "gigamon_ssl_cert_sig_algo": { + "type": "keyword" + }, + "gigamon_ssl_cert_subj_pub_algo": { + "type": "keyword" + }, + "gigamon_ssl_cert_subj_pubkey_size": { + "type": "long" + }, + "gigamon_ssl_cert_subj_alt_name": { + "type": "keyword" + }, + "gigamon_ssl_server_name_ind": { + "type": "keyword" + }, + "gigamon_ssl_server_ver": { + "type": "long" + }, + "gigamon_ssl_server_cipher": { + "type": "long" + }, + "gigamon_ssl_server_compress_method": { + "type": "long" + }, + "gigamon_ssl_server_sess_id": { + "type": "keyword" + }, + "gigamon_dns_id": { + "type": "long" + }, + "gigamon_dns_op_code": { + "type": "long" + }, + "gigamon_dns_resp_code": { + "type": "long" + }, + "gigamon_dns_query": { + "type": "keyword" + }, + "gigamon_dns_resp": { + "type": "keyword" + }, + "gigamon_dns_resp_ttl": { + "type": "long" + }, + "gigamon_dns_resp_ipv4_addr": { + "type": "ip" + }, + "gigamon_dns_resp_ipv6_addr": { + "type": "ip" + }, + "gigamon_dns_bits": { + "type": "keyword" + }, + "gigamon_dns_qd_count": { + "type": "long" + }, + "gigamon_dns_an_count": { + "type": "long" + }, + "gigamon_dns_ns_count": { + "type": "long" + }, + "gigamon_dns_ar_count": { + "type": "long" + }, + "gigamon_dns_query_type": { + "type": "long" + }, + "gigamon_dns_query_class": { + "type": "long" + }, + "gigamon_dns_resp_type": { + "type": "long" + }, + "gigamon_dns_resp_class": { + "type": "long" + }, + "gigamon_dns_resp_rd_len": { + "type": "long" + }, + "gigamon_dns_resp_rdata": { + "type": "keyword" + }, + "gigamon_dns_auth_name": { + "type": "keyword" + }, + "gigamon_dns_auth_type": { + "type": "long" + }, + "gigamon_dns_auth_class": { + "type": "long" + }, + "gigamon_dns_auth_ttl": { + "type": "long" + }, + "gigamon_dns_auth_rd_len": { + "type": "long" + }, + "gigamon_dns_authority_rdata": { + "type": "keyword" + }, + "gigamon_dns_addl_name": { + "type": "keyword" + }, + "gigamon_dns_addl_type": { + "type": "long" + }, + "gigamon_dns_addl_class": { + "type": "long" + }, + "gigamon_dns_addl_ttl": { + "type": "long" + }, + "gigamon_dns_addl_rd_len": { + "type": "long" + }, + "gigamon_dns_addl_rdata": { + "type": "keyword" + }, - "ipt_mark": { - "type": "long" - }, - "ipt_conntrack_id": { - "type": "long" - }, + "ipt_mark": { + "type": "long" + }, + "ipt_conntrack_id": { + "type": "long" + }, - "ixia_l7_app_id": { - "type": "long" - }, - "ixia_l7_app": { - "type": "keyword" - }, - "ixia_src_country_code": { - "type": "keyword" - }, - "ixia_src_country": { - "type": "keyword" - }, - "ixia_src_region_code": { - "type": "keyword" - }, - "ixia_src_region": { - "type": "keyword" - }, - "ixia_src_city": { - "type": "keyword" - }, - "ixia_src_latitude": { - "type": "float" - }, - "ixia_src_longitude": { - "type": "float" - }, - "ixia_dst_country_code": { - "type": "keyword" - }, - "ixia_dst_country": { - "type": "keyword" - }, - "ixia_dst_region_code": { - "type": "keyword" - }, - "ixia_dst_region": { - "type": "keyword" - }, - "ixia_dst_city": { - "type": "keyword" - }, - "ixia_dst_latitude": { - "type": "float" - }, - "ixia_dst_longitude": { - "type": "float" - }, - "ixia_device_id": { - "type": "long" - }, - "ixia_device": { - "type": "keyword" - }, - "ixia_browser_id": { - "type": "long" - }, - "ixia_browser": { - "type": "keyword" - }, - "ixia_rev_bytes_delta": { - "type": "long" - }, - "ixia_rev_packets_delta": { - "type": "long" - }, - "ixia_encrypt_type": { - "type": "keyword" - }, - "ixia_encrypt_cipher": { - "type": "keyword" - }, - "ixia_encrypt_key_len": { - "type": "long" - }, - "ixia_imsi_subscriber": { - "type": "keyword" - }, - "ixia_http_user_agent": { - "type": "keyword" - }, - "ixia_http_hostname": { - "type": "keyword" - }, - "ixia_http_uri": { - "type": "keyword" - }, - "ixia_dns_record_txt": { - "type": "keyword" - }, - "ixia_src_as": { - "type": "keyword" - }, - "ixia_dst_as": { - "type": "keyword" - }, - "ixia_latency": { - "type": "long" - }, - "ixia_dns_query": { - "type": "keyword" - }, - "ixia_dns_answer": { - "type": "keyword" - }, - "ixia_dns_classes": { - "type": "keyword" - }, - "ixia_threat_type": { - "type": "keyword" - }, - "ixia_threat_ipv4": { - "type": "ip" - }, - "ixia_threat_ipv6": { - "type": "ip" - }, + "ixia_l7_app_id": { + "type": "long" + }, + "ixia_l7_app": { + "type": "keyword" + }, + "ixia_src_country_code": { + "type": "keyword" + }, + "ixia_src_country": { + "type": "keyword" + }, + "ixia_src_region_code": { + "type": "keyword" + }, + "ixia_src_region": { + "type": "keyword" + }, + "ixia_src_city": { + "type": "keyword" + }, + "ixia_src_latitude": { + "type": "float" + }, + "ixia_src_longitude": { + "type": "float" + }, + "ixia_dst_country_code": { + "type": "keyword" + }, + "ixia_dst_country": { + "type": "keyword" + }, + "ixia_dst_region_code": { + "type": "keyword" + }, + "ixia_dst_region": { + "type": "keyword" + }, + "ixia_dst_city": { + "type": "keyword" + }, + "ixia_dst_latitude": { + "type": "float" + }, + "ixia_dst_longitude": { + "type": "float" + }, + "ixia_device_id": { + "type": "long" + }, + "ixia_device": { + "type": "keyword" + }, + "ixia_browser_id": { + "type": "long" + }, + "ixia_browser": { + "type": "keyword" + }, + "ixia_rev_bytes_delta": { + "type": "long" + }, + "ixia_rev_packets_delta": { + "type": "long" + }, + "ixia_encrypt_type": { + "type": "keyword" + }, + "ixia_encrypt_cipher": { + "type": "keyword" + }, + "ixia_encrypt_key_len": { + "type": "long" + }, + "ixia_imsi_subscriber": { + "type": "keyword" + }, + "ixia_http_user_agent": { + "type": "keyword" + }, + "ixia_http_hostname": { + "type": "keyword" + }, + "ixia_http_uri": { + "type": "keyword" + }, + "ixia_dns_record_txt": { + "type": "keyword" + }, + "ixia_src_as": { + "type": "keyword" + }, + "ixia_dst_as": { + "type": "keyword" + }, + "ixia_latency": { + "type": "long" + }, + "ixia_dns_query": { + "type": "keyword" + }, + "ixia_dns_answer": { + "type": "keyword" + }, + "ixia_dns_classes": { + "type": "keyword" + }, + "ixia_threat_type": { + "type": "keyword" + }, + "ixia_threat_ipv4": { + "type": "ip" + }, + "ixia_threat_ipv6": { + "type": "ip" + }, - "netscaler_rtt": { - "type": "long" - }, - "netscaler_trans_id": { - "type": "long" - }, - "netscaler_http_req_url": { - "type": "keyword" - }, - "netscaler_http_req_cookie": { - "type": "keyword" - }, - "netscaler_flow_flags": { - "type": "long" - }, - "netscaler_conn_id": { - "type": "long" - }, - "netscaler_syslog_pri": { - "type": "long" - }, - "netscaler_syslog_msg": { - "type": "keyword" - }, - "netscaler_syslog_timestamp": { - "type": "long" - }, - "netscaler_http_req_referrer": { - "type": "keyword" - }, - "netscaler_http_req_method": { - "type": "keyword" - }, - "netscaler_http_req_host": { - "type": "keyword" - }, - "netscaler_http_req_user_agent": { - "type": "keyword" - }, - "netscaler_http_resp_status": { - "type": "long" - }, - "netscaler_http_resp_len": { - "type": "long" - }, - "netscaler_server_ttfb": { - "type": "long" - }, - "netscaler_server_ttlb": { - "type": "long" - }, - "netscaler_app_incarnations": { - "type": "long" - }, - "netscaler_app_id": { - "type": "long" - }, - "netscaler_app": { - "type": "keyword" - }, - "netscaler_http_req_rcv_fb": { - "type": "long" - }, - "netscaler_http_req_forw_fb": { - "type": "long" - }, - "netscaler_http_res_rcv_fb": { - "type": "long" - }, - "netscaler_http_res_forw_fb": { - "type": "long" - }, - "netscaler_http_req_rcv_lb": { - "type": "long" - }, - "netscaler_http_req_forw_lb": { - "type": "long" - }, - "netscaler_main_page_id": { - "type": "long" - }, - "netscaler_main_page_core_id": { - "type": "long" - }, - "netscaler_http_client_interact_start_time": { - "type": "keyword" - }, - "netscaler_http_client_render_end_time": { - "type": "keyword" - }, - "netscaler_http_client_render_start_time": { - "type": "keyword" - }, - "netscaler_app_template": { - "type": "keyword" - }, - "netscaler_http_client_interact_end_time": { - "type": "keyword" - }, - "netscaler_http_res_rcv_lb": { - "type": "long" - }, - "netscaler_http_res_forw_lb": { - "type": "long" - }, - "netscaler_app_unit_app_id": { - "type": "long" - }, - "netscaler_db_login_flags": { - "type": "long" - }, - "netscaler_db_req_type": { - "type": "long" - }, - "netscaler_db_proto": { - "type": "long" - }, - "netscaler_db_user": { - "type": "keyword" - }, - "netscaler_db_database": { - "type": "keyword" - }, - "netscaler_db_client_hostname": { - "type": "keyword" - }, - "netscaler_db_req_string": { - "type": "keyword" - }, - "netscaler_db_resp_status_string": { - "type": "keyword" - }, - "netscaler_db_resp_status": { - "type": "long" - }, - "netscaler_db_resp_len": { - "type": "long" - }, - "netscaler_client_rtt": { - "type": "long" - }, - "netscaler_http_content_type": { - "type": "keyword" - }, - "netscaler_http_req_auth": { - "type": "keyword" - }, - "netscaler_http_req_via": { - "type": "keyword" - }, - "netscaler_http_res_location": { - "type": "keyword" - }, - "netscaler_http_res_set_cookie": { - "type": "keyword" - }, - "netscaler_http_res_set_cookie2": { - "type": "keyword" - }, - "netscaler_http_req_x_forwarded_for": { - "type": "keyword" - }, - "netscaler_conn_chain_id": { - "type": "keyword" - }, - "netscaler_conn_chain_hop_count": { - "type": "long" - }, - "netscaler_ica_sess_guid": { - "type": "keyword" - }, - "netscaler_ica_client_ver": { - "type": "keyword" - }, - "netscaler_ica_client_type": { - "type": "long" - }, - "netscaler_ica_client_ip": { - "type": "ip" - }, - "netscaler_ica_client_hostname": { - "type": "keyword" - }, - "netscaler_aaa_user": { - "type": "keyword" - }, - "netscaler_ica_domain": { - "type": "keyword" - }, - "netscaler_ica_client_launcher": { - "type": "long" - }, - "netscaler_ica_sess_setup_time": { - "type": "long" - }, - "netscaler_ica_server": { - "type": "keyword" - }, - "netscaler_ica_sess_reconnects": { - "type": "long" - }, - "netscaler_ica_rtt": { - "type": "long" - }, - "netscaler_ica_clientside_rx_bytes": { - "type": "long" - }, - "netscaler_ica_clientside_tx_bytes": { - "type": "long" - }, - "netscaler_ica_clientside_packets_retrans": { - "type": "long" - }, - "netscaler_ica_serverside_packets_retrans": { - "type": "long" - }, - "netscaler_ica_clientside_rtt": { - "type": "long" - }, - "netscaler_ica_serverside_rtt": { - "type": "long" - }, - "netscaler_ica_sess_update_begin_sec": { - "type": "long" - }, - "netscaler_ica_sess_update_end_sec": { - "type": "long" - }, - "netscaler_ica_channel_id1": { - "type": "long" - }, - "netscaler_ica_channel_id1_bytes": { - "type": "long" - }, - "netscaler_ica_channel_id2": { - "type": "long" - }, - "netscaler_ica_channel_id2_bytes": { - "type": "long" - }, - "netscaler_ica_channel_id3": { - "type": "long" - }, - "netscaler_ica_channel_id3_bytes": { - "type": "long" - }, - "netscaler_ica_channel_id4": { - "type": "long" - }, - "netscaler_ica_channel_id4_bytes": { - "type": "long" - }, - "netscaler_ica_channel_id5": { - "type": "long" - }, - "netscaler_ica_channel_id5_bytes": { - "type": "long" - }, - "netscaler_ica_conn_pri": { - "type": "long" - }, - "netscaler_app_start_duration": { - "type": "long" - }, - "netscaler_ica_launch_mechanism": { - "type": "long" - }, - "netscaler_ica_app": { - "type": "keyword" - }, - "netscaler_app_start_time": { - "type": "long" - }, - "netscaler_ica_app_term_type": { - "type": "long" - }, - "netscaler_ica_app_term_time": { - "type": "long" - }, - "netscaler_ica_sess_end_time": { - "type": "long" - }, - "netscaler_ica_clientside_jitter": { - "type": "long" - }, - "netscaler_ica_serverside_jitter": { - "type": "long" - }, - "netscaler_ica_app_pid": { - "type": "long" - }, - "netscaler_ica_app_module_path": { - "type": "keyword" - }, - "netscaler_ica_device_serial_no": { - "type": "long" - }, - "netscaler_msi_client_cookie": { - "type": "keyword" - }, - "netscaler_ica_flags": { - "type": "long" - }, - "netscaler_ica_user": { - "type": "keyword" - }, - "netscaler_license_type": { - "type": "long" - }, - "netscaler_max_licenses": { - "type": "long" - }, - "netscaler_licenses_used": { - "type": "long" - }, - "netscaler_ica_network_update_start_time": { - "type": "long" - }, - "netscaler_ica_network_update_end_time": { - "type": "long" - }, - "netscaler_ica_clientside_srtt": { - "type": "long" - }, - "netscaler_ica_serverside_srtt": { - "type": "long" - }, - "netscaler_ica_clientside_delay": { - "type": "long" - }, - "netscaler_ica_serverside_delay": { - "type": "long" - }, - "netscaler_ica_host_delay": { - "type": "long" - }, - "netscaler_ica_clientside_window_size": { - "type": "long" - }, - "netscaler_ica_serverside_window_size": { - "type": "long" - }, - "netscaler_ica_clientside_rto_count": { - "type": "long" - }, - "netscaler_ica_serverside_rto_count": { - "type": "long" - }, - "netscaler_ica_l7_client_latency": { - "type": "long" - }, - "netscaler_ica_l7_server_latency": { - "type": "long" - }, - "netscaler_http_domain": { - "type": "keyword" - }, - "netscaler_cache_redir_client_conn_core_id": { - "type": "long" - }, - "netscaler_cache_redir_client_conn_trans_id": { - "type": "long" - }, - "netscaler_unk_270": { - "type": "long" - }, - "netscaler_unk_271": { - "type": "long" - }, - "netscaler_unk_272": { - "type": "long" - }, - "netscaler_unk_273": { - "type": "long" - }, - "netscaler_unk_274": { - "type": "long" - }, - "netscaler_unk_275": { - "type": "long" - }, - "netscaler_unk_276": { - "type": "long" - }, - "netscaler_unk_277": { - "type": "long" - }, - "netscaler_unk_278": { - "type": "long" - }, - "netscaler_unk_279": { - "type": "long" - }, - "netscaler_unk_280": { - "type": "long" - }, - "netscaler_unk_281": { - "type": "long" - }, - "netscaler_unk_282": { - "type": "long" - }, - "netscaler_unk_283": { - "type": "long" - }, - "netscaler_unk_284": { - "type": "long" - }, - "netscaler_unk_285": { - "type": "long" - }, - "netscaler_unk_286": { - "type": "long" - }, - "netscaler_unk_287": { - "type": "long" - }, - "netscaler_unk_288": { - "type": "long" - }, - "netscaler_unk_289": { - "type": "long" - }, - "netscaler_unk_290": { - "type": "long" - }, - "netscaler_unk_291": { - "type": "long" - }, - "netscaler_unk_292": { - "type": "long" - }, - "netscaler_unk_293": { - "type": "long" - }, - "netscaler_unk_294": { - "type": "long" - }, - "netscaler_unk_295": { - "type": "long" - }, - "netscaler_unk_296": { - "type": "long" - }, - "netscaler_unk_297": { - "type": "long" - }, - "netscaler_unk_298": { - "type": "long" - }, - "netscaler_unk_299": { - "type": "long" - }, - "netscaler_unk_300": { - "type": "long" - }, - "netscaler_unk_301": { - "type": "long" - }, - "netscaler_unk_302": { - "type": "long" - }, - "netscaler_unk_303": { - "type": "long" - }, - "netscaler_unk_304": { - "type": "long" - }, - "netscaler_unk_305": { - "type": "long" - }, - "netscaler_unk_306": { - "type": "long" - }, - "netscaler_unk_307": { - "type": "long" - }, - "netscaler_unk_308": { - "type": "long" - }, - "netscaler_unk_309": { - "type": "long" - }, - "netscaler_unk_310": { - "type": "long" - }, - "netscaler_unk_311": { - "type": "long" - }, - "netscaler_unk_312": { - "type": "long" - }, - "netscaler_unk_313": { - "type": "long" - }, - "netscaler_unk_314": { - "type": "long" - }, - "netscaler_unk_315": { - "type": "long" - }, - "netscaler_unk_316": { - "type": "keyword" - }, - "netscaler_unk_317": { - "type": "long" - }, - "netscaler_unk_318": { - "type": "long" - }, - "netscaler_unk_319": { - "type": "long" - }, - "netscaler_unk_320": { - "type": "long" - }, - "netscaler_unk_321": { - "type": "long" - }, - "netscaler_unk_322": { - "type": "long" - }, - "netscaler_unk_323": { - "type": "long" - }, - "netscaler_unk_324": { - "type": "long" - }, - "netscaler_unk_325": { - "type": "long" - }, - "netscaler_unk_326": { - "type": "long" - }, - "netscaler_unk_327": { - "type": "long" - }, - "netscaler_unk_328": { - "type": "long" - }, - "netscaler_unk_329": { - "type": "long" - }, - "netscaler_unk_330": { - "type": "long" - }, - "netscaler_unk_331": { - "type": "long" - }, - "netscaler_unk_332": { - "type": "long" - }, - "netscaler_unk_333": { - "type": "keyword" - }, - "netscaler_unk_334": { - "type": "keyword" - }, - "netscaler_unk_335": { - "type": "long" - }, - "netscaler_unk_336": { - "type": "long" - }, - "netscaler_unk_337": { - "type": "long" - }, - "netscaler_unk_338": { - "type": "long" - }, - "netscaler_unk_339": { - "type": "long" - }, - "netscaler_unk_340": { - "type": "long" - }, - "netscaler_unk_341": { - "type": "long" - }, - "netscaler_unk_342": { - "type": "long" - }, - "netscaler_unk_343": { - "type": "long" - }, - "netscaler_unk_344": { - "type": "long" - }, - "netscaler_unk_345": { - "type": "long" - }, - "netscaler_unk_346": { - "type": "long" - }, - "netscaler_unk_347": { - "type": "long" - }, - "netscaler_unk_348": { - "type": "long" - }, - "netscaler_unk_349": { - "type": "keyword" - }, - "netscaler_unk_350": { - "type": "keyword" - }, - "netscaler_unk_351": { - "type": "keyword" - }, - "netscaler_unk_352": { - "type": "long" - }, - "netscaler_unk_353": { - "type": "long" - }, - "netscaler_unk_354": { - "type": "long" - }, - "netscaler_unk_355": { - "type": "long" - }, - "netscaler_unk_356": { - "type": "long" - }, - "netscaler_unk_357": { - "type": "long" - }, - "netscaler_unk_358": { - "type": "long" - }, - "netscaler_unk_359": { - "type": "long" - }, - "netscaler_unk_360": { - "type": "long" - }, - "netscaler_unk_361": { - "type": "keyword" - }, - "netscaler_unk_362": { - "type": "long" - }, - "netscaler_unk_363": { - "type": "keyword" - }, - "netscaler_unk_364": { - "type": "long" - }, - "netscaler_unk_365": { - "type": "long" - }, - "netscaler_unk_366": { - "type": "long" - }, - "netscaler_unk_367": { - "type": "keyword" - }, - "netscaler_unk_377": { - "type": "long" - }, - "netscaler_unk_380": { - "type": "long" - }, - "netscaler_unk_383": { - "type": "keyword" - }, - "netscaler_unk_384": { - "type": "keyword" - }, - "netscaler_unk_385": { - "type": "keyword" - }, - "netscaler_unk_386": { - "type": "keyword" - }, - "netscaler_unk_387": { - "type": "keyword" - }, - "netscaler_unk_388": { - "type": "long" - }, - "netscaler_unk_389": { - "type": "keyword" - }, - "netscaler_unk_391": { - "type": "long" - }, - "netscaler_unk_392": { - "type": "long" - }, - "netscaler_unk_393": { - "type": "long" - }, - "netscaler_unk_394": { - "type": "long" - }, - "netscaler_unk_398": { - "type": "long" - }, - "netscaler_unk_399": { - "type": "long" - }, - "netscaler_unk_400": { - "type": "long" - }, - "netscaler_unk_401": { - "type": "long" - }, - "netscaler_unk_402": { - "type": "long" - }, - "netscaler_unk_403": { - "type": "long" - }, - "netscaler_unk_404": { - "type": "long" - }, - "netscaler_unk_405": { - "type": "long" - }, - "netscaler_unk_408": { - "type": "long" - }, - "netscaler_unk_427": { - "type": "long" - }, - "netscaler_unk_429": { - "type": "long" - }, - "netscaler_unk_432": { - "type": "long" - }, - "netscaler_unk_433": { - "type": "long" - }, - "netscaler_unk_434": { - "type": "long" - }, - "netscaler_unk_435": { - "type": "long" - }, - "netscaler_unk_447": { - "type": "long" - }, - "netscaler_unk_448": { - "type": "long" - }, - "netscaler_unk_451": { - "type": "long" - }, - "netscaler_unk_452": { - "type": "long" - }, - "netscaler_unk_453": { - "type": "long" - }, - "netscaler_unk_455": { - "type": "long" - }, - "netscaler_unk_458": { - "type": "long" - }, - "netscaler_unk_459": { - "type": "long" - }, - "netscaler_unk_460": { - "type": "long" - }, - "netscaler_unk_461": { - "type": "long" - }, - "netscaler_unk_463": { - "type": "long" - }, - "netscaler_unk_464": { - "type": "long" - }, - "netscaler_unk_465": { - "type": "long" - }, - "netscaler_unk_466": { - "type": "long" - }, - "netscaler_unk_467": { - "type": "long" - }, - "netscaler_unk_468": { - "type": "long" - }, - "netscaler_unk_475": { - "type": "long" - }, - "netscaler_unk_476": { - "type": "long" - }, - "netscaler_unk_477": { - "type": "long" - }, - "netscaler_unk_478": { - "type": "long" - }, - "netscaler_unk_479": { - "type": "long" - }, - "netscaler_unk_480": { - "type": "long" - }, - "netscaler_unk_481": { - "type": "long" - }, - "netscaler_unk_487": { - "type": "long" - }, - "netscaler_unk_488": { - "type": "long" - }, - "netscaler_unk_489": { - "type": "long" - }, - "netscaler_unk_491": { - "type": "long" - }, - "netscaler_unk_492": { - "type": "long" - }, - "netscaler_unk_493": { - "type": "long" - }, - "netscaler_unk_494": { - "type": "long" - }, - "netscaler_unk_507": { - "type": "long" - }, - "netscaler_unk_508": { - "type": "long" - }, - "netscaler_unk_509": { - "type": "long" - }, - "netscaler_unk_510": { - "type": "long" - }, - "netscaler_unk_511": { - "type": "long" - }, - "netscaler_unk_512": { - "type": "long" - }, - "netscaler_unk_513": { - "type": "long" - }, - "netscaler_unk_514": { - "type": "long" - }, - "netscaler_unk_518": { - "type": "long" - }, - "netscaler_unk_519": { - "type": "long" - }, - "netscaler_unk_520": { - "type": "long" - }, - "netscaler_unk_521": { - "type": "long" - }, - "netscaler_unk_522": { - "type": "long" - }, - "netscaler_unk_523": { - "type": "long" - }, - "netscaler_unk_532": { - "type": "long" - }, - "netscaler_unk_533": { - "type": "long" - }, - "netscaler_unk_534": { - "type": "long" - }, - "netscaler_unk_535": { - "type": "long" - }, - "netscaler_unk_536": { - "type": "long" - }, - "netscaler_unk_537": { - "type": "long" - }, - "netscaler_unk_538": { - "type": "long" - }, - "netscaler_unk_541": { - "type": "long" - }, + "netscaler_rtt": { + "type": "long" + }, + "netscaler_trans_id": { + "type": "long" + }, + "netscaler_http_req_url": { + "type": "keyword" + }, + "netscaler_http_req_cookie": { + "type": "keyword" + }, + "netscaler_flow_flags": { + "type": "long" + }, + "netscaler_conn_id": { + "type": "long" + }, + "netscaler_syslog_pri": { + "type": "long" + }, + "netscaler_syslog_msg": { + "type": "keyword" + }, + "netscaler_syslog_timestamp": { + "type": "long" + }, + "netscaler_http_req_referrer": { + "type": "keyword" + }, + "netscaler_http_req_method": { + "type": "keyword" + }, + "netscaler_http_req_host": { + "type": "keyword" + }, + "netscaler_http_req_user_agent": { + "type": "keyword" + }, + "netscaler_http_resp_status": { + "type": "long" + }, + "netscaler_http_resp_len": { + "type": "long" + }, + "netscaler_server_ttfb": { + "type": "long" + }, + "netscaler_server_ttlb": { + "type": "long" + }, + "netscaler_app_incarnations": { + "type": "long" + }, + "netscaler_app_id": { + "type": "long" + }, + "netscaler_app": { + "type": "keyword" + }, + "netscaler_http_req_rcv_fb": { + "type": "long" + }, + "netscaler_http_req_forw_fb": { + "type": "long" + }, + "netscaler_http_res_rcv_fb": { + "type": "long" + }, + "netscaler_http_res_forw_fb": { + "type": "long" + }, + "netscaler_http_req_rcv_lb": { + "type": "long" + }, + "netscaler_http_req_forw_lb": { + "type": "long" + }, + "netscaler_main_page_id": { + "type": "long" + }, + "netscaler_main_page_core_id": { + "type": "long" + }, + "netscaler_http_client_interact_start_time": { + "type": "keyword" + }, + "netscaler_http_client_render_end_time": { + "type": "keyword" + }, + "netscaler_http_client_render_start_time": { + "type": "keyword" + }, + "netscaler_app_template": { + "type": "keyword" + }, + "netscaler_http_client_interact_end_time": { + "type": "keyword" + }, + "netscaler_http_res_rcv_lb": { + "type": "long" + }, + "netscaler_http_res_forw_lb": { + "type": "long" + }, + "netscaler_app_unit_app_id": { + "type": "long" + }, + "netscaler_db_login_flags": { + "type": "long" + }, + "netscaler_db_req_type": { + "type": "long" + }, + "netscaler_db_proto": { + "type": "long" + }, + "netscaler_db_user": { + "type": "keyword" + }, + "netscaler_db_database": { + "type": "keyword" + }, + "netscaler_db_client_hostname": { + "type": "keyword" + }, + "netscaler_db_req_string": { + "type": "keyword" + }, + "netscaler_db_resp_status_string": { + "type": "keyword" + }, + "netscaler_db_resp_status": { + "type": "long" + }, + "netscaler_db_resp_len": { + "type": "long" + }, + "netscaler_client_rtt": { + "type": "long" + }, + "netscaler_http_content_type": { + "type": "keyword" + }, + "netscaler_http_req_auth": { + "type": "keyword" + }, + "netscaler_http_req_via": { + "type": "keyword" + }, + "netscaler_http_res_location": { + "type": "keyword" + }, + "netscaler_http_res_set_cookie": { + "type": "keyword" + }, + "netscaler_http_res_set_cookie2": { + "type": "keyword" + }, + "netscaler_http_req_x_forwarded_for": { + "type": "keyword" + }, + "netscaler_conn_chain_id": { + "type": "keyword" + }, + "netscaler_conn_chain_hop_count": { + "type": "long" + }, + "netscaler_ica_sess_guid": { + "type": "keyword" + }, + "netscaler_ica_client_ver": { + "type": "keyword" + }, + "netscaler_ica_client_type": { + "type": "long" + }, + "netscaler_ica_client_ip": { + "type": "ip" + }, + "netscaler_ica_client_hostname": { + "type": "keyword" + }, + "netscaler_aaa_user": { + "type": "keyword" + }, + "netscaler_ica_domain": { + "type": "keyword" + }, + "netscaler_ica_client_launcher": { + "type": "long" + }, + "netscaler_ica_sess_setup_time": { + "type": "long" + }, + "netscaler_ica_server": { + "type": "keyword" + }, + "netscaler_ica_sess_reconnects": { + "type": "long" + }, + "netscaler_ica_rtt": { + "type": "long" + }, + "netscaler_ica_clientside_rx_bytes": { + "type": "long" + }, + "netscaler_ica_clientside_tx_bytes": { + "type": "long" + }, + "netscaler_ica_clientside_packets_retrans": { + "type": "long" + }, + "netscaler_ica_serverside_packets_retrans": { + "type": "long" + }, + "netscaler_ica_clientside_rtt": { + "type": "long" + }, + "netscaler_ica_serverside_rtt": { + "type": "long" + }, + "netscaler_ica_sess_update_begin_sec": { + "type": "long" + }, + "netscaler_ica_sess_update_end_sec": { + "type": "long" + }, + "netscaler_ica_channel_id1": { + "type": "long" + }, + "netscaler_ica_channel_id1_bytes": { + "type": "long" + }, + "netscaler_ica_channel_id2": { + "type": "long" + }, + "netscaler_ica_channel_id2_bytes": { + "type": "long" + }, + "netscaler_ica_channel_id3": { + "type": "long" + }, + "netscaler_ica_channel_id3_bytes": { + "type": "long" + }, + "netscaler_ica_channel_id4": { + "type": "long" + }, + "netscaler_ica_channel_id4_bytes": { + "type": "long" + }, + "netscaler_ica_channel_id5": { + "type": "long" + }, + "netscaler_ica_channel_id5_bytes": { + "type": "long" + }, + "netscaler_ica_conn_pri": { + "type": "long" + }, + "netscaler_app_start_duration": { + "type": "long" + }, + "netscaler_ica_launch_mechanism": { + "type": "long" + }, + "netscaler_ica_app": { + "type": "keyword" + }, + "netscaler_app_start_time": { + "type": "long" + }, + "netscaler_ica_app_term_type": { + "type": "long" + }, + "netscaler_ica_app_term_time": { + "type": "long" + }, + "netscaler_ica_sess_end_time": { + "type": "long" + }, + "netscaler_ica_clientside_jitter": { + "type": "long" + }, + "netscaler_ica_serverside_jitter": { + "type": "long" + }, + "netscaler_ica_app_pid": { + "type": "long" + }, + "netscaler_ica_app_module_path": { + "type": "keyword" + }, + "netscaler_ica_device_serial_no": { + "type": "long" + }, + "netscaler_msi_client_cookie": { + "type": "keyword" + }, + "netscaler_ica_flags": { + "type": "long" + }, + "netscaler_ica_user": { + "type": "keyword" + }, + "netscaler_license_type": { + "type": "long" + }, + "netscaler_max_licenses": { + "type": "long" + }, + "netscaler_licenses_used": { + "type": "long" + }, + "netscaler_ica_network_update_start_time": { + "type": "long" + }, + "netscaler_ica_network_update_end_time": { + "type": "long" + }, + "netscaler_ica_clientside_srtt": { + "type": "long" + }, + "netscaler_ica_serverside_srtt": { + "type": "long" + }, + "netscaler_ica_clientside_delay": { + "type": "long" + }, + "netscaler_ica_serverside_delay": { + "type": "long" + }, + "netscaler_ica_host_delay": { + "type": "long" + }, + "netscaler_ica_clientside_window_size": { + "type": "long" + }, + "netscaler_ica_serverside_window_size": { + "type": "long" + }, + "netscaler_ica_clientside_rto_count": { + "type": "long" + }, + "netscaler_ica_serverside_rto_count": { + "type": "long" + }, + "netscaler_ica_l7_client_latency": { + "type": "long" + }, + "netscaler_ica_l7_server_latency": { + "type": "long" + }, + "netscaler_http_domain": { + "type": "keyword" + }, + "netscaler_cache_redir_client_conn_core_id": { + "type": "long" + }, + "netscaler_cache_redir_client_conn_trans_id": { + "type": "long" + }, + "netscaler_unk_270": { + "type": "long" + }, + "netscaler_unk_271": { + "type": "long" + }, + "netscaler_unk_272": { + "type": "long" + }, + "netscaler_unk_273": { + "type": "long" + }, + "netscaler_unk_274": { + "type": "long" + }, + "netscaler_unk_275": { + "type": "long" + }, + "netscaler_unk_276": { + "type": "long" + }, + "netscaler_unk_277": { + "type": "long" + }, + "netscaler_unk_278": { + "type": "long" + }, + "netscaler_unk_279": { + "type": "long" + }, + "netscaler_unk_280": { + "type": "long" + }, + "netscaler_unk_281": { + "type": "long" + }, + "netscaler_unk_282": { + "type": "long" + }, + "netscaler_unk_283": { + "type": "long" + }, + "netscaler_unk_284": { + "type": "long" + }, + "netscaler_unk_285": { + "type": "long" + }, + "netscaler_unk_286": { + "type": "long" + }, + "netscaler_unk_287": { + "type": "long" + }, + "netscaler_unk_288": { + "type": "long" + }, + "netscaler_unk_289": { + "type": "long" + }, + "netscaler_unk_290": { + "type": "long" + }, + "netscaler_unk_291": { + "type": "long" + }, + "netscaler_unk_292": { + "type": "long" + }, + "netscaler_unk_293": { + "type": "long" + }, + "netscaler_unk_294": { + "type": "long" + }, + "netscaler_unk_295": { + "type": "long" + }, + "netscaler_unk_296": { + "type": "long" + }, + "netscaler_unk_297": { + "type": "long" + }, + "netscaler_unk_298": { + "type": "long" + }, + "netscaler_unk_299": { + "type": "long" + }, + "netscaler_unk_300": { + "type": "long" + }, + "netscaler_unk_301": { + "type": "long" + }, + "netscaler_unk_302": { + "type": "long" + }, + "netscaler_unk_303": { + "type": "long" + }, + "netscaler_unk_304": { + "type": "long" + }, + "netscaler_unk_305": { + "type": "long" + }, + "netscaler_unk_306": { + "type": "long" + }, + "netscaler_unk_307": { + "type": "long" + }, + "netscaler_unk_308": { + "type": "long" + }, + "netscaler_unk_309": { + "type": "long" + }, + "netscaler_unk_310": { + "type": "long" + }, + "netscaler_unk_311": { + "type": "long" + }, + "netscaler_unk_312": { + "type": "long" + }, + "netscaler_unk_313": { + "type": "long" + }, + "netscaler_unk_314": { + "type": "long" + }, + "netscaler_unk_315": { + "type": "long" + }, + "netscaler_unk_316": { + "type": "keyword" + }, + "netscaler_unk_317": { + "type": "long" + }, + "netscaler_unk_318": { + "type": "long" + }, + "netscaler_unk_319": { + "type": "long" + }, + "netscaler_unk_320": { + "type": "long" + }, + "netscaler_unk_321": { + "type": "long" + }, + "netscaler_unk_322": { + "type": "long" + }, + "netscaler_unk_323": { + "type": "long" + }, + "netscaler_unk_324": { + "type": "long" + }, + "netscaler_unk_325": { + "type": "long" + }, + "netscaler_unk_326": { + "type": "long" + }, + "netscaler_unk_327": { + "type": "long" + }, + "netscaler_unk_328": { + "type": "long" + }, + "netscaler_unk_329": { + "type": "long" + }, + "netscaler_unk_330": { + "type": "long" + }, + "netscaler_unk_331": { + "type": "long" + }, + "netscaler_unk_332": { + "type": "long" + }, + "netscaler_unk_333": { + "type": "keyword" + }, + "netscaler_unk_334": { + "type": "keyword" + }, + "netscaler_unk_335": { + "type": "long" + }, + "netscaler_unk_336": { + "type": "long" + }, + "netscaler_unk_337": { + "type": "long" + }, + "netscaler_unk_338": { + "type": "long" + }, + "netscaler_unk_339": { + "type": "long" + }, + "netscaler_unk_340": { + "type": "long" + }, + "netscaler_unk_341": { + "type": "long" + }, + "netscaler_unk_342": { + "type": "long" + }, + "netscaler_unk_343": { + "type": "long" + }, + "netscaler_unk_344": { + "type": "long" + }, + "netscaler_unk_345": { + "type": "long" + }, + "netscaler_unk_346": { + "type": "long" + }, + "netscaler_unk_347": { + "type": "long" + }, + "netscaler_unk_348": { + "type": "long" + }, + "netscaler_unk_349": { + "type": "keyword" + }, + "netscaler_unk_350": { + "type": "keyword" + }, + "netscaler_unk_351": { + "type": "keyword" + }, + "netscaler_unk_352": { + "type": "long" + }, + "netscaler_unk_353": { + "type": "long" + }, + "netscaler_unk_354": { + "type": "long" + }, + "netscaler_unk_355": { + "type": "long" + }, + "netscaler_unk_356": { + "type": "long" + }, + "netscaler_unk_357": { + "type": "long" + }, + "netscaler_unk_358": { + "type": "long" + }, + "netscaler_unk_359": { + "type": "long" + }, + "netscaler_unk_360": { + "type": "long" + }, + "netscaler_unk_361": { + "type": "keyword" + }, + "netscaler_unk_362": { + "type": "long" + }, + "netscaler_unk_363": { + "type": "keyword" + }, + "netscaler_unk_364": { + "type": "long" + }, + "netscaler_unk_365": { + "type": "long" + }, + "netscaler_unk_366": { + "type": "long" + }, + "netscaler_unk_367": { + "type": "keyword" + }, + "netscaler_unk_377": { + "type": "long" + }, + "netscaler_unk_380": { + "type": "long" + }, + "netscaler_unk_383": { + "type": "keyword" + }, + "netscaler_unk_384": { + "type": "keyword" + }, + "netscaler_unk_385": { + "type": "keyword" + }, + "netscaler_unk_386": { + "type": "keyword" + }, + "netscaler_unk_387": { + "type": "keyword" + }, + "netscaler_unk_388": { + "type": "long" + }, + "netscaler_unk_389": { + "type": "keyword" + }, + "netscaler_unk_391": { + "type": "long" + }, + "netscaler_unk_392": { + "type": "long" + }, + "netscaler_unk_393": { + "type": "long" + }, + "netscaler_unk_394": { + "type": "long" + }, + "netscaler_unk_398": { + "type": "long" + }, + "netscaler_unk_399": { + "type": "long" + }, + "netscaler_unk_400": { + "type": "long" + }, + "netscaler_unk_401": { + "type": "long" + }, + "netscaler_unk_402": { + "type": "long" + }, + "netscaler_unk_403": { + "type": "long" + }, + "netscaler_unk_404": { + "type": "long" + }, + "netscaler_unk_405": { + "type": "long" + }, + "netscaler_unk_408": { + "type": "long" + }, + "netscaler_unk_427": { + "type": "long" + }, + "netscaler_unk_429": { + "type": "long" + }, + "netscaler_unk_432": { + "type": "long" + }, + "netscaler_unk_433": { + "type": "long" + }, + "netscaler_unk_434": { + "type": "long" + }, + "netscaler_unk_435": { + "type": "long" + }, + "netscaler_unk_447": { + "type": "long" + }, + "netscaler_unk_448": { + "type": "long" + }, + "netscaler_unk_451": { + "type": "long" + }, + "netscaler_unk_452": { + "type": "long" + }, + "netscaler_unk_453": { + "type": "long" + }, + "netscaler_unk_455": { + "type": "long" + }, + "netscaler_unk_458": { + "type": "long" + }, + "netscaler_unk_459": { + "type": "long" + }, + "netscaler_unk_460": { + "type": "long" + }, + "netscaler_unk_461": { + "type": "long" + }, + "netscaler_unk_463": { + "type": "long" + }, + "netscaler_unk_464": { + "type": "long" + }, + "netscaler_unk_465": { + "type": "long" + }, + "netscaler_unk_466": { + "type": "long" + }, + "netscaler_unk_467": { + "type": "long" + }, + "netscaler_unk_468": { + "type": "long" + }, + "netscaler_unk_475": { + "type": "long" + }, + "netscaler_unk_476": { + "type": "long" + }, + "netscaler_unk_477": { + "type": "long" + }, + "netscaler_unk_478": { + "type": "long" + }, + "netscaler_unk_479": { + "type": "long" + }, + "netscaler_unk_480": { + "type": "long" + }, + "netscaler_unk_481": { + "type": "long" + }, + "netscaler_unk_487": { + "type": "long" + }, + "netscaler_unk_488": { + "type": "long" + }, + "netscaler_unk_489": { + "type": "long" + }, + "netscaler_unk_491": { + "type": "long" + }, + "netscaler_unk_492": { + "type": "long" + }, + "netscaler_unk_493": { + "type": "long" + }, + "netscaler_unk_494": { + "type": "long" + }, + "netscaler_unk_507": { + "type": "long" + }, + "netscaler_unk_508": { + "type": "long" + }, + "netscaler_unk_509": { + "type": "long" + }, + "netscaler_unk_510": { + "type": "long" + }, + "netscaler_unk_511": { + "type": "long" + }, + "netscaler_unk_512": { + "type": "long" + }, + "netscaler_unk_513": { + "type": "long" + }, + "netscaler_unk_514": { + "type": "long" + }, + "netscaler_unk_518": { + "type": "long" + }, + "netscaler_unk_519": { + "type": "long" + }, + "netscaler_unk_520": { + "type": "long" + }, + "netscaler_unk_521": { + "type": "long" + }, + "netscaler_unk_522": { + "type": "long" + }, + "netscaler_unk_523": { + "type": "long" + }, + "netscaler_unk_532": { + "type": "long" + }, + "netscaler_unk_533": { + "type": "long" + }, + "netscaler_unk_534": { + "type": "long" + }, + "netscaler_unk_535": { + "type": "long" + }, + "netscaler_unk_536": { + "type": "long" + }, + "netscaler_unk_537": { + "type": "long" + }, + "netscaler_unk_538": { + "type": "long" + }, + "netscaler_unk_541": { + "type": "long" + }, - "ntop_src_frags": { - "type": "long" - }, - "ntop_dst_frags": { - "type": "long" - }, - "ntop_src_to_dst_max_throughput": { - "type": "long" - }, - "ntop_src_to_dst_min_throughput": { - "type": "long" - }, - "ntop_src_to_dst_avg_throughput": { - "type": "long" - }, - "ntop_dst_to_src_max_throughput": { - "type": "long" - }, - "ntop_dst_to_src_min_throughput": { - "type": "long" - }, - "ntop_dst_to_src_avg_throughput": { - "type": "long" - }, - "ntop_packets_upto_128_bytes": { - "type": "long" - }, - "ntop_packets_128_to_256_bytes": { - "type": "long" - }, - "ntop_packets_256_to_512_bytes": { - "type": "long" - }, - "ntop_packets_512_to_1024_bytes": { - "type": "long" - }, - "ntop_packets_1024_to_1514_bytes": { - "type": "long" - }, - "ntop_packets_over_1514_bytes": { - "type": "long" - }, - "ntop_cumulative_icmp_type": { - "type": "long" - }, - "ntop_src_country": { - "type": "keyword" - }, - "ntop_src_city": { - "type": "keyword" - }, - "ntop_dst_country": { - "type": "keyword" - }, - "ntop_dst_city": { - "type": "keyword" - }, - "ntop_flow_proto_port": { - "type": "long" - }, - "ntop_tunnel_id": { - "type": "long" - }, - "ntop_longest_flow_packet": { - "type": "long" - }, - "ntop_shortest_flow_packet": { - "type": "long" - }, - "ntop_retrans_in_packets": { - "type": "long" - }, - "ntop_retrans_out_packets": { - "type": "long" - }, - "ntop_ooorder_in_packets": { - "type": "long" - }, - "ntop_ooorder_out_packets": { - "type": "long" - }, - "ntop_untunneled_protocol": { - "type": "long" - }, - "ntop_untunneled_ipv4_src_addr": { - "type": "ip" - }, - "ntop_untunneled_l4_src_port": { - "type": "long" - }, - "ntop_untunneled_ipv4_dst_addr": { - "type": "ip" - }, - "ntop_untunneled_l4_dst_port": { - "type": "long" - }, - "ntop_l7_proto": { - "type": "long" - }, - "ntop_l7_proto_name": { - "type": "keyword" - }, - "ntop_downstram_tunnel_id": { - "type": "long" - }, - "ntop_flow_user": { - "type": "keyword" - }, - "ntop_flow_server": { - "type": "keyword" - }, - "ntop_client_nw_latency_ms": { - "type": "long" - }, - "ntop_server_nw_latency_ms": { - "type": "long" - }, - "ntop_appl_latency_ms": { - "type": "long" - }, - "ntop_plugin": { - "type": "keyword" - }, - "ntop_retrans_in_bytes": { - "type": "long" - }, - "ntop_retrans_out_bytes": { - "type": "long" - }, - "ntop_sip_call_id": { - "type": "keyword" - }, - "ntop_sip_calling_party": { - "type": "keyword" - }, - "ntop_sip_called_party": { - "type": "keyword" - }, - "ntop_sip_rtp_codecs": { - "type": "keyword" - }, - "ntop_sip_invite_time": { - "type": "long" - }, - "ntop_sip_trying_time": { - "type": "long" - }, - "ntop_sip_ringing_time": { - "type": "long" - }, - "ntop_sip_ok_time": { - "type": "long" - }, - "ntop_sip_invite_failure_time": { - "type": "long" - }, - "ntop_sip_bye_time": { - "type": "long" - }, - "ntop_sip_bye_ok_time": { - "type": "long" - }, - "ntop_sip_cancel_time": { - "type": "long" - }, - "ntop_sip_cancel_ok_time": { - "type": "long" - }, - "ntop_sip_rtp_ipv4_src_addr": { - "type": "ip" - }, - "ntop_sip_rtp_l4_src_port": { - "type": "long" - }, - "ntop_sip_rtp_ipv4_dst_addr": { - "type": "ip" - }, - "ntop_sip_rtp_l4_dst_port": { - "type": "long" - }, - "ntop_sip_resp_code": { - "type": "long" - }, - "ntop_sip_reason_cause": { - "type": "long" - }, - "ntop_rtp_first_seq": { - "type": "long" - }, - "ntop_rtp_first_ts": { - "type": "long" - }, - "ntop_rtp_last_seq": { - "type": "long" - }, - "ntop_rtp_last_ts": { - "type": "long" - }, - "ntop_rtp_in_jitter": { - "type": "long" - }, - "ntop_rtp_out_jitter": { - "type": "long" - }, - "ntop_rtp_in_packets_lost": { - "type": "long" - }, - "ntop_rtp_out_packets_lost": { - "type": "long" - }, - "ntop_rtp_out_payload_type": { - "type": "long" - }, - "ntop_rtp_in_max_delta": { - "type": "long" - }, - "ntop_rtp_out_max_delta": { - "type": "long" - }, - "ntop_rtp_in_payload_type": { - "type": "long" - }, - "ntop_src_proc_id": { - "type": "long" - }, - "ntop_src_proc": { - "type": "keyword" - }, - "ntop_http_url": { - "type": "keyword" - }, - "ntop_http_ret_code": { - "type": "long" - }, - "ntop_http_referrer": { - "type": "keyword" - }, - "ntop_http_user_agent": { - "type": "keyword" - }, - "ntop_http_mime": { - "type": "keyword" - }, - "ntop_smtp_mail_from": { - "type": "keyword" - }, - "ntop_smtp_rcpt_to": { - "type": "keyword" - }, - "ntop_http_host": { - "type": "keyword" - }, - "ntop_ssl_server": { - "type": "keyword" - }, - "ntop_bittorrent_hash": { - "type": "keyword" - }, - "ntop_mysql_server_ver": { - "type": "keyword" - }, - "ntop_mysql_user": { - "type": "keyword" - }, - "ntop_mysql_db": { - "type": "keyword" - }, - "ntop_mysql_query": { - "type": "keyword" - }, - "ntop_mysql_resp": { - "type": "long" - }, - "ntop_oracle_user": { - "type": "keyword" - }, - "ntop_oracle_query": { - "type": "keyword" - }, - "ntop_oracle_resp_code": { - "type": "long" - }, - "ntop_oracle_resp_string": { - "type": "keyword" - }, - "ntop_oracle_query_duration": { - "type": "long" - }, - "ntop_dns_query": { - "type": "keyword" - }, - "ntop_dns_query_id": { - "type": "long" - }, - "ntop_dns_query_type": { - "type": "long" - }, - "ntop_dns_ret_code": { - "type": "long" - }, - "ntop_dns_answers": { - "type": "long" - }, - "ntop_pop_user": { - "type": "keyword" - }, - "ntop_gtpv1_req_msg_type": { - "type": "long" - }, - "ntop_gtpv1_resp_msg_type": { - "type": "long" - }, - "ntop_gtpv1_c2s_teid_data": { - "type": "long" - }, - "ntop_gtpv1_c2s_teid_ctrl": { - "type": "long" - }, - "ntop_gtpv1_s2c_teid_data": { - "type": "long" - }, - "ntop_gtpv1_s2c_teid_ctrl": { - "type": "long" - }, - "ntop_gtpv1_end_user_ip": { - "type": "ip" - }, - "ntop_gtpv1_end_user_imsi": { - "type": "keyword" - }, - "ntop_gtpv1_end_user_msisdn": { - "type": "keyword" - }, - "ntop_gtpv1_end_user_imei": { - "type": "keyword" - }, - "ntop_gtpv1_apn": { - "type": "keyword" - }, - "ntop_gtpv1_rai_mcc": { - "type": "long" - }, - "ntop_gtpv1_rai_mnc": { - "type": "long" - }, - "ntop_gtpv1_uli_cell_lac": { - "type": "long" - }, - "ntop_gtpv1_uli_cell_ci": { - "type": "long" - }, - "ntop_gtpv1_uli_sac": { - "type": "long" - }, - "ntop_gtpv1_rai_type": { - "type": "long" - }, - "ntop_radius_req_msg_type": { - "type": "long" - }, - "ntop_radius_resp_msg_type": { - "type": "long" - }, - "ntop_radius_user": { - "type": "keyword" - }, - "ntop_radius_calling_station_id": { - "type": "keyword" - }, - "ntop_radius_called_station_id": { - "type": "keyword" - }, - "ntop_radius_nas_ip": { - "type": "ip" - }, - "ntop_radius_nas_id": { - "type": "keyword" - }, - "ntop_radius_user_imsi": { - "type": "keyword" - }, - "ntop_radius_user_imei": { - "type": "keyword" - }, - "ntop_radius_framed_ip": { - "type": "ip" - }, - "ntop_radius_acct_sess_id": { - "type": "keyword" - }, - "ntop_radius_acct_status_type": { - "type": "keyword" - }, - "ntop_radius_acct_in_octets": { - "type": "long" - }, - "ntop_radius_acct_out_octets": { - "type": "long" - }, - "ntop_radius_acct_in_packets": { - "type": "long" - }, - "ntop_radius_acct_out_packets": { - "type": "long" - }, - "ntop_imap_login": { - "type": "keyword" - }, - "ntop_gtpv2_req_msg_type": { - "type": "long" - }, - "ntop_gtpv2_resp_msg_type": { - "type": "long" - }, - "ntop_gtpv2_c2s_s1u_gtpu_teid": { - "type": "long" - }, - "ntop_gtpv2_c2s_s1u_gtpu_ip": { - "type": "ip" - }, - "ntop_gtpv2_s2c_s1u_gtpu_teid": { - "type": "keyword" - }, - "ntop_gtpv2_s2c_s1u_gtpu_ip": { - "type": "ip" - }, - "ntop_gtpv2_end_user_imsi": { - "type": "keyword" - }, - "ntop_gtpv2_and_user_msisdn": { - "type": "keyword" - }, - "ntop_gtpv2_apn": { - "type": "keyword" - }, - "ntop_gtpv2_uli_mcc": { - "type": "long" - }, - "ntop_gtpv2_uli_mnc": { - "type": "long" - }, - "ntop_gtpv2_uli_cell_tac": { - "type": "long" - }, - "ntop_gtpv2_uli_cell_id": { - "type": "long" - }, - "ntop_gtpv2_rat_type": { - "type": "long" - }, - "ntop_gtpv2_pdn_ip": { - "type": "ip" - }, - "ntop_gtpv2_end_user_imei": { - "type": "keyword" - }, - "ntop_src_as_path_1": { - "type": "long" - }, - "ntop_src_as_path_2": { - "type": "long" - }, - "ntop_src_as_path_3": { - "type": "long" - }, - "ntop_src_as_path_4": { - "type": "long" - }, - "ntop_src_as_path_5": { - "type": "long" - }, - "ntop_src_as_path_6": { - "type": "long" - }, - "ntop_src_as_path_7": { - "type": "long" - }, - "ntop_src_as_path_8": { - "type": "long" - }, - "ntop_src_as_path_9": { - "type": "long" - }, - "ntop_src_as_path_10": { - "type": "long" - }, - "ntop_dst_as_path_1": { - "type": "long" - }, - "ntop_dst_as_path_2": { - "type": "long" - }, - "ntop_dst_as_path_3": { - "type": "long" - }, - "ntop_dst_as_path_4": { - "type": "long" - }, - "ntop_dst_as_path_5": { - "type": "long" - }, - "ntop_dst_as_path_6": { - "type": "long" - }, - "ntop_dst_as_path_7": { - "type": "long" - }, - "ntop_dst_as_path_8": { - "type": "long" - }, - "ntop_dst_as_path_9": { - "type": "long" - }, - "ntop_dst_as_path_10": { - "type": "long" - }, - "ntop_mysql_appl_latency_usec": { - "type": "long" - }, - "ntop_gtpv0_req_msg_type": { - "type": "long" - }, - "ntop_gtpv0_resp_msg_type": { - "type": "long" - }, - "ntop_gtpv0_tid": { - "type": "long" - }, - "ntop_gtpv0_end_user_ip": { - "type": "ip" - }, - "ntop_gtpv0_end_user_msisdn": { - "type": "keyword" - }, - "ntop_gtpv0_apn": { - "type": "keyword" - }, - "ntop_gtpv0_rai_mcc": { - "type": "long" - }, - "ntop_gtpv0_rai_mnc": { - "type": "long" - }, - "ntop_gtpv0_rai_cell_lac": { - "type": "long" - }, - "ntop_gtpv0_rai_cell_rac": { - "type": "long" - }, - "ntop_gtpv0_resp_cause": { - "type": "long" - }, - "ntop_gtpv1_resp_cause": { - "type": "long" - }, - "ntop_gtpv2_resp_cause": { - "type": "long" - }, - "ntop_packets_ttl_5_32": { - "type": "long" - }, - "ntop_packets_ttl_32_64": { - "type": "long" - }, - "ntop_packets_ttl_64_96": { - "type": "long" - }, - "ntop_packets_ttl_96_128": { - "type": "long" - }, - "ntop_packets_ttl_128_160": { - "type": "long" - }, - "ntop_packets_ttl_160_192": { - "type": "long" - }, - "ntop_packets_ttl_192_224": { - "type": "long" - }, - "ntop_packets_ttl_224_225": { - "type": "long" - }, - "ntop_gtpv1_rai_lac": { - "type": "long" - }, - "ntop_gtpv1_rai_rac": { - "type": "long" - }, - "ntop_gtpv1_uli_mcc": { - "type": "long" - }, - "ntop_gtpv1_uli_mnc": { - "type": "long" - }, - "ntop_packets_ttl_2_5": { - "type": "long" - }, - "ntop_packets_ttl_eq_1": { - "type": "long" - }, - "ntop_rtp_sip_call_id": { - "type": "keyword" - }, - "ntop_in_src_osi_sap": { - "type": "keyword" - }, - "ntop_out_dst_osi_sap": { - "type": "keyword" - }, - "ntop_whois_das_domain": { - "type": "keyword" - }, - "ntop_dns_ttl_answer": { - "type": "long" - }, - "ntop_dhcp_client_mac": { - "type": "keyword" - }, - "ntop_dhcp_client_ip": { - "type": "ip" - }, - "ntop_dhcp_client": { - "type": "keyword" - }, - "ntop_ftp_login": { - "type": "keyword" - }, - "ntop_ftp_password": { - "type": "keyword" - }, - "ntop_ftp_command": { - "type": "keyword" - }, - "ntop_ftp_command_ret_code": { - "type": "long" - }, - "ntop_http_method": { - "type": "keyword" - }, - "ntop_http_site": { - "type": "keyword" - }, - "ntop_sip_c_ip": { - "type": "ip" - }, - "ntop_sip_call_state": { - "type": "keyword" - }, - "ntop_rtp_in_mos": { - "type": "long" - }, - "ntop_rtp_in_r_factor": { - "type": "long" - }, - "ntop_src_proc_user": { - "type": "keyword" - }, - "ntop_src_father_proc_pid": { - "type": "long" - }, - "ntop_src_father_proc": { - "type": "keyword" - }, - "ntop_dst_proc_pid": { - "type": "long" - }, - "ntop_dst_proc": { - "type": "keyword" - }, - "ntop_dst_proc_user": { - "type": "keyword" - }, - "ntop_dst_father_proc_pid": { - "type": "long" - }, - "ntop_dst_father_proc": { - "type": "keyword" - }, - "ntop_rtp_rtt": { - "type": "long" - }, - "ntop_rtp_in_transit": { - "type": "long" - }, - "ntop_rtp_out_transit": { - "type": "long" - }, - "ntop_src_proc_actual_memory": { - "type": "long" - }, - "ntop_src_proc_peak_memory": { - "type": "long" - }, - "ntop_src_proc_avg_cpu_load": { - "type": "long" - }, - "ntop_src_proc_page_faults": { - "type": "long" - }, - "ntop_dst_proc_actual_memory": { - "type": "long" - }, - "ntop_dst_proc_peak_memory": { - "type": "long" - }, - "ntop_dst_proc_avg_cpu_load": { - "type": "long" - }, - "ntop_dst_proc_page_faults": { - "type": "long" - }, - "ntop_duration_in": { - "type": "long" - }, - "ntop_duration_out": { - "type": "long" - }, - "ntop_src_proc_pctg_iowait": { - "type": "long" - }, - "ntop_dst_proc_pctg_iowait": { - "type": "long" - }, - "ntop_rtp_dtmf_tones": { - "type": "keyword" - }, - "ntop_untunneled_ipv6_src_addr": { - "type": "ip" - }, - "ntop_untunneled_ipv6_dst_addr": { - "type": "ip" - }, - "ntop_dns_resp": { - "type": "keyword" - }, - "ntop_diameter_req_msg_type": { - "type": "long" - }, - "ntop_diameter_resp_msg_type": { - "type": "long" - }, - "ntop_diameter_req_origin_host": { - "type": "keyword" - }, - "ntop_diameter_resp_origin_host": { - "type": "keyword" - }, - "ntop_diameter_req_user": { - "type": "keyword" - }, - "ntop_diameter_resp_result_code": { - "type": "long" - }, - "ntop_diameter_exp_res_vendor_id": { - "type": "long" - }, - "ntop_diameter_exp_res_result_code": { - "type": "long" - }, - "ntop_s1ap_enb_ue_s1ap_id": { - "type": "long" - }, - "ntop_s1ap_mme_ue_s1ap_id": { - "type": "long" - }, - "ntop_s1ap_msg_emm_type_mme_to_enb": { - "type": "long" - }, - "ntop_s1ap_msg_esm_type_mme_to_enb": { - "type": "long" - }, - "ntop_s1ap_msg_emm_type_enb_to_mme": { - "type": "long" - }, - "ntop_s1ap_msg_esm_type_enb_to_mme": { - "type": "long" - }, - "ntop_s1ap_cause_enb_to_mme": { - "type": "long" - }, - "ntop_s1ap_detailed_cause_enb_to_mme": { - "type": "long" - }, - "ntop_tcp_win_min_in": { - "type": "long" - }, - "ntop_tcp_win_max_in": { - "type": "long" - }, - "ntop_tcp_win_mss_in": { - "type": "long" - }, - "ntop_tcp_win_scale_in": { - "type": "long" - }, - "ntop_tcp_win_min_out": { - "type": "long" - }, - "ntop_tcp_win_max_out": { - "type": "long" - }, - "ntop_tcp_win_mss_out": { - "type": "long" - }, - "ntop_tcp_win_scale_out": { - "type": "long" - }, - "ntop_dhcp_remote_id": { - "type": "keyword" - }, - "ntop_dhcp_subscriber_id": { - "type": "keyword" - }, - "ntop_src_proc_uid": { - "type": "long" - }, - "ntop_dst_proc_uid": { - "type": "long" - }, - "ntop_application": { - "type": "keyword" - }, - "ntop_user": { - "type": "keyword" - }, - "ntop_dhcp_message_type": { - "type": "keyword" - }, - "ntop_rtp_in_packets_drop": { - "type": "long" - }, - "ntop_rtp_out_packets_drop": { - "type": "long" - }, - "ntop_rtp_out_mos": { - "type": "long" - }, - "ntop_rtp_out_r_factor": { - "type": "long" - }, - "ntop_rtp_mos": { - "type": "long" - }, - "ntop_gptv2_s5_s8_gtpc_teid": { - "type": "keyword" - }, - "ntop_rtp_r_factor": { - "type": "long" - }, - "ntop_rtp_ssrc": { - "type": "long" - }, - "ntop_payload_hash": { - "type": "long" - }, - "ntop_gtpv2_c2s_s5_s8_gtpu_teid": { - "type": "long" - }, - "ntop_gtpv2_s2c_s5_s8_gtpu_teid": { - "type": "long" - }, - "ntop_gtpv2_c2s_s5_s8_gtpu_ip": { - "type": "ip" - }, - "ntop_gtpv2_s2c_s5_s8_gtpu_ip": { - "type": "ip" - }, - "ntop_src_as_map": { - "type": "keyword" - }, - "ntop_dst_as_map": { - "type": "keyword" - }, - "ntop_diameter_hop_by_hop_id": { - "type": "long" - }, - "ntop_upstream_sess_id": { - "type": "long" - }, - "ntop_downstream_sess_id": { - "type": "long" - }, - "ntop_src_long": { - "type": "float" - }, - "ntop_src_lat": { - "type": "float" - }, - "ntop_dst_long": { - "type": "float" - }, - "ntop_dst_lat": { - "type": "float" - }, - "ntop_diameter_clr_cancel_type": { - "type": "long" - }, - "ntop_diameter_clr_flags": { - "type": "long" - }, - "ntop_gtpv2_c2s_s5_s8_gtpc_ip": { - "type": "ip" - }, - "ntop_gtpv2_s2c_s5_s8_gtpc_ip": { - "type": "ip" - }, - "ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid": { - "type": "long" - }, - "ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid": { - "type": "long" - }, - "ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip": { - "type": "ip" - }, - "ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip": { - "type": "ip" - }, - "ntop_http_x_forwarded_for": { - "type": "keyword" - }, - "ntop_http_via": { - "type": "keyword" - }, - "ntop_ssdp_host": { - "type": "keyword" - }, - "ntop_ssdp_usn": { - "type": "keyword" - }, - "ntop_netbios_query": { - "type": "keyword" - }, - "ntop_netbios_query_type": { - "type": "keyword" - }, - "ntop_netbios_resp": { - "type": "keyword" - }, - "ntop_netbios_query_os": { - "type": "keyword" - }, - "ntop_ssdp_server": { - "type": "keyword" - }, - "ntop_ssdp_type": { - "type": "keyword" - }, - "ntop_ssdp_method": { - "type": "keyword" - }, - "ntop_nprobe_ipv4_addr": { - "type": "ip" - }, + "ntop_src_frags": { + "type": "long" + }, + "ntop_dst_frags": { + "type": "long" + }, + "ntop_src_to_dst_max_throughput": { + "type": "long" + }, + "ntop_src_to_dst_min_throughput": { + "type": "long" + }, + "ntop_src_to_dst_avg_throughput": { + "type": "long" + }, + "ntop_dst_to_src_max_throughput": { + "type": "long" + }, + "ntop_dst_to_src_min_throughput": { + "type": "long" + }, + "ntop_dst_to_src_avg_throughput": { + "type": "long" + }, + "ntop_packets_upto_128_bytes": { + "type": "long" + }, + "ntop_packets_128_to_256_bytes": { + "type": "long" + }, + "ntop_packets_256_to_512_bytes": { + "type": "long" + }, + "ntop_packets_512_to_1024_bytes": { + "type": "long" + }, + "ntop_packets_1024_to_1514_bytes": { + "type": "long" + }, + "ntop_packets_over_1514_bytes": { + "type": "long" + }, + "ntop_cumulative_icmp_type": { + "type": "long" + }, + "ntop_src_country": { + "type": "keyword" + }, + "ntop_src_city": { + "type": "keyword" + }, + "ntop_dst_country": { + "type": "keyword" + }, + "ntop_dst_city": { + "type": "keyword" + }, + "ntop_flow_proto_port": { + "type": "long" + }, + "ntop_tunnel_id": { + "type": "long" + }, + "ntop_longest_flow_packet": { + "type": "long" + }, + "ntop_shortest_flow_packet": { + "type": "long" + }, + "ntop_retrans_in_packets": { + "type": "long" + }, + "ntop_retrans_out_packets": { + "type": "long" + }, + "ntop_ooorder_in_packets": { + "type": "long" + }, + "ntop_ooorder_out_packets": { + "type": "long" + }, + "ntop_untunneled_protocol": { + "type": "long" + }, + "ntop_untunneled_ipv4_src_addr": { + "type": "ip" + }, + "ntop_untunneled_l4_src_port": { + "type": "long" + }, + "ntop_untunneled_ipv4_dst_addr": { + "type": "ip" + }, + "ntop_untunneled_l4_dst_port": { + "type": "long" + }, + "ntop_l7_proto": { + "type": "long" + }, + "ntop_l7_proto_name": { + "type": "keyword" + }, + "ntop_downstram_tunnel_id": { + "type": "long" + }, + "ntop_flow_user": { + "type": "keyword" + }, + "ntop_flow_server": { + "type": "keyword" + }, + "ntop_client_nw_latency_ms": { + "type": "long" + }, + "ntop_server_nw_latency_ms": { + "type": "long" + }, + "ntop_appl_latency_ms": { + "type": "long" + }, + "ntop_plugin": { + "type": "keyword" + }, + "ntop_retrans_in_bytes": { + "type": "long" + }, + "ntop_retrans_out_bytes": { + "type": "long" + }, + "ntop_sip_call_id": { + "type": "keyword" + }, + "ntop_sip_calling_party": { + "type": "keyword" + }, + "ntop_sip_called_party": { + "type": "keyword" + }, + "ntop_sip_rtp_codecs": { + "type": "keyword" + }, + "ntop_sip_invite_time": { + "type": "long" + }, + "ntop_sip_trying_time": { + "type": "long" + }, + "ntop_sip_ringing_time": { + "type": "long" + }, + "ntop_sip_ok_time": { + "type": "long" + }, + "ntop_sip_invite_failure_time": { + "type": "long" + }, + "ntop_sip_bye_time": { + "type": "long" + }, + "ntop_sip_bye_ok_time": { + "type": "long" + }, + "ntop_sip_cancel_time": { + "type": "long" + }, + "ntop_sip_cancel_ok_time": { + "type": "long" + }, + "ntop_sip_rtp_ipv4_src_addr": { + "type": "ip" + }, + "ntop_sip_rtp_l4_src_port": { + "type": "long" + }, + "ntop_sip_rtp_ipv4_dst_addr": { + "type": "ip" + }, + "ntop_sip_rtp_l4_dst_port": { + "type": "long" + }, + "ntop_sip_resp_code": { + "type": "long" + }, + "ntop_sip_reason_cause": { + "type": "long" + }, + "ntop_rtp_first_seq": { + "type": "long" + }, + "ntop_rtp_first_ts": { + "type": "long" + }, + "ntop_rtp_last_seq": { + "type": "long" + }, + "ntop_rtp_last_ts": { + "type": "long" + }, + "ntop_rtp_in_jitter": { + "type": "long" + }, + "ntop_rtp_out_jitter": { + "type": "long" + }, + "ntop_rtp_in_packets_lost": { + "type": "long" + }, + "ntop_rtp_out_packets_lost": { + "type": "long" + }, + "ntop_rtp_out_payload_type": { + "type": "long" + }, + "ntop_rtp_in_max_delta": { + "type": "long" + }, + "ntop_rtp_out_max_delta": { + "type": "long" + }, + "ntop_rtp_in_payload_type": { + "type": "long" + }, + "ntop_src_proc_id": { + "type": "long" + }, + "ntop_src_proc": { + "type": "keyword" + }, + "ntop_http_url": { + "type": "keyword" + }, + "ntop_http_ret_code": { + "type": "long" + }, + "ntop_http_referrer": { + "type": "keyword" + }, + "ntop_http_user_agent": { + "type": "keyword" + }, + "ntop_http_mime": { + "type": "keyword" + }, + "ntop_smtp_mail_from": { + "type": "keyword" + }, + "ntop_smtp_rcpt_to": { + "type": "keyword" + }, + "ntop_http_host": { + "type": "keyword" + }, + "ntop_ssl_server": { + "type": "keyword" + }, + "ntop_bittorrent_hash": { + "type": "keyword" + }, + "ntop_mysql_server_ver": { + "type": "keyword" + }, + "ntop_mysql_user": { + "type": "keyword" + }, + "ntop_mysql_db": { + "type": "keyword" + }, + "ntop_mysql_query": { + "type": "keyword" + }, + "ntop_mysql_resp": { + "type": "long" + }, + "ntop_oracle_user": { + "type": "keyword" + }, + "ntop_oracle_query": { + "type": "keyword" + }, + "ntop_oracle_resp_code": { + "type": "long" + }, + "ntop_oracle_resp_string": { + "type": "keyword" + }, + "ntop_oracle_query_duration": { + "type": "long" + }, + "ntop_dns_query": { + "type": "keyword" + }, + "ntop_dns_query_id": { + "type": "long" + }, + "ntop_dns_query_type": { + "type": "long" + }, + "ntop_dns_ret_code": { + "type": "long" + }, + "ntop_dns_answers": { + "type": "long" + }, + "ntop_pop_user": { + "type": "keyword" + }, + "ntop_gtpv1_req_msg_type": { + "type": "long" + }, + "ntop_gtpv1_resp_msg_type": { + "type": "long" + }, + "ntop_gtpv1_c2s_teid_data": { + "type": "long" + }, + "ntop_gtpv1_c2s_teid_ctrl": { + "type": "long" + }, + "ntop_gtpv1_s2c_teid_data": { + "type": "long" + }, + "ntop_gtpv1_s2c_teid_ctrl": { + "type": "long" + }, + "ntop_gtpv1_end_user_ip": { + "type": "ip" + }, + "ntop_gtpv1_end_user_imsi": { + "type": "keyword" + }, + "ntop_gtpv1_end_user_msisdn": { + "type": "keyword" + }, + "ntop_gtpv1_end_user_imei": { + "type": "keyword" + }, + "ntop_gtpv1_apn": { + "type": "keyword" + }, + "ntop_gtpv1_rai_mcc": { + "type": "long" + }, + "ntop_gtpv1_rai_mnc": { + "type": "long" + }, + "ntop_gtpv1_uli_cell_lac": { + "type": "long" + }, + "ntop_gtpv1_uli_cell_ci": { + "type": "long" + }, + "ntop_gtpv1_uli_sac": { + "type": "long" + }, + "ntop_gtpv1_rai_type": { + "type": "long" + }, + "ntop_radius_req_msg_type": { + "type": "long" + }, + "ntop_radius_resp_msg_type": { + "type": "long" + }, + "ntop_radius_user": { + "type": "keyword" + }, + "ntop_radius_calling_station_id": { + "type": "keyword" + }, + "ntop_radius_called_station_id": { + "type": "keyword" + }, + "ntop_radius_nas_ip": { + "type": "ip" + }, + "ntop_radius_nas_id": { + "type": "keyword" + }, + "ntop_radius_user_imsi": { + "type": "keyword" + }, + "ntop_radius_user_imei": { + "type": "keyword" + }, + "ntop_radius_framed_ip": { + "type": "ip" + }, + "ntop_radius_acct_sess_id": { + "type": "keyword" + }, + "ntop_radius_acct_status_type": { + "type": "keyword" + }, + "ntop_radius_acct_in_octets": { + "type": "long" + }, + "ntop_radius_acct_out_octets": { + "type": "long" + }, + "ntop_radius_acct_in_packets": { + "type": "long" + }, + "ntop_radius_acct_out_packets": { + "type": "long" + }, + "ntop_imap_login": { + "type": "keyword" + }, + "ntop_gtpv2_req_msg_type": { + "type": "long" + }, + "ntop_gtpv2_resp_msg_type": { + "type": "long" + }, + "ntop_gtpv2_c2s_s1u_gtpu_teid": { + "type": "long" + }, + "ntop_gtpv2_c2s_s1u_gtpu_ip": { + "type": "ip" + }, + "ntop_gtpv2_s2c_s1u_gtpu_teid": { + "type": "keyword" + }, + "ntop_gtpv2_s2c_s1u_gtpu_ip": { + "type": "ip" + }, + "ntop_gtpv2_end_user_imsi": { + "type": "keyword" + }, + "ntop_gtpv2_and_user_msisdn": { + "type": "keyword" + }, + "ntop_gtpv2_apn": { + "type": "keyword" + }, + "ntop_gtpv2_uli_mcc": { + "type": "long" + }, + "ntop_gtpv2_uli_mnc": { + "type": "long" + }, + "ntop_gtpv2_uli_cell_tac": { + "type": "long" + }, + "ntop_gtpv2_uli_cell_id": { + "type": "long" + }, + "ntop_gtpv2_rat_type": { + "type": "long" + }, + "ntop_gtpv2_pdn_ip": { + "type": "ip" + }, + "ntop_gtpv2_end_user_imei": { + "type": "keyword" + }, + "ntop_src_as_path_1": { + "type": "long" + }, + "ntop_src_as_path_2": { + "type": "long" + }, + "ntop_src_as_path_3": { + "type": "long" + }, + "ntop_src_as_path_4": { + "type": "long" + }, + "ntop_src_as_path_5": { + "type": "long" + }, + "ntop_src_as_path_6": { + "type": "long" + }, + "ntop_src_as_path_7": { + "type": "long" + }, + "ntop_src_as_path_8": { + "type": "long" + }, + "ntop_src_as_path_9": { + "type": "long" + }, + "ntop_src_as_path_10": { + "type": "long" + }, + "ntop_dst_as_path_1": { + "type": "long" + }, + "ntop_dst_as_path_2": { + "type": "long" + }, + "ntop_dst_as_path_3": { + "type": "long" + }, + "ntop_dst_as_path_4": { + "type": "long" + }, + "ntop_dst_as_path_5": { + "type": "long" + }, + "ntop_dst_as_path_6": { + "type": "long" + }, + "ntop_dst_as_path_7": { + "type": "long" + }, + "ntop_dst_as_path_8": { + "type": "long" + }, + "ntop_dst_as_path_9": { + "type": "long" + }, + "ntop_dst_as_path_10": { + "type": "long" + }, + "ntop_mysql_appl_latency_usec": { + "type": "long" + }, + "ntop_gtpv0_req_msg_type": { + "type": "long" + }, + "ntop_gtpv0_resp_msg_type": { + "type": "long" + }, + "ntop_gtpv0_tid": { + "type": "long" + }, + "ntop_gtpv0_end_user_ip": { + "type": "ip" + }, + "ntop_gtpv0_end_user_msisdn": { + "type": "keyword" + }, + "ntop_gtpv0_apn": { + "type": "keyword" + }, + "ntop_gtpv0_rai_mcc": { + "type": "long" + }, + "ntop_gtpv0_rai_mnc": { + "type": "long" + }, + "ntop_gtpv0_rai_cell_lac": { + "type": "long" + }, + "ntop_gtpv0_rai_cell_rac": { + "type": "long" + }, + "ntop_gtpv0_resp_cause": { + "type": "long" + }, + "ntop_gtpv1_resp_cause": { + "type": "long" + }, + "ntop_gtpv2_resp_cause": { + "type": "long" + }, + "ntop_packets_ttl_5_32": { + "type": "long" + }, + "ntop_packets_ttl_32_64": { + "type": "long" + }, + "ntop_packets_ttl_64_96": { + "type": "long" + }, + "ntop_packets_ttl_96_128": { + "type": "long" + }, + "ntop_packets_ttl_128_160": { + "type": "long" + }, + "ntop_packets_ttl_160_192": { + "type": "long" + }, + "ntop_packets_ttl_192_224": { + "type": "long" + }, + "ntop_packets_ttl_224_225": { + "type": "long" + }, + "ntop_gtpv1_rai_lac": { + "type": "long" + }, + "ntop_gtpv1_rai_rac": { + "type": "long" + }, + "ntop_gtpv1_uli_mcc": { + "type": "long" + }, + "ntop_gtpv1_uli_mnc": { + "type": "long" + }, + "ntop_packets_ttl_2_5": { + "type": "long" + }, + "ntop_packets_ttl_eq_1": { + "type": "long" + }, + "ntop_rtp_sip_call_id": { + "type": "keyword" + }, + "ntop_in_src_osi_sap": { + "type": "keyword" + }, + "ntop_out_dst_osi_sap": { + "type": "keyword" + }, + "ntop_whois_das_domain": { + "type": "keyword" + }, + "ntop_dns_ttl_answer": { + "type": "long" + }, + "ntop_dhcp_client_mac": { + "type": "keyword" + }, + "ntop_dhcp_client_ip": { + "type": "ip" + }, + "ntop_dhcp_client": { + "type": "keyword" + }, + "ntop_ftp_login": { + "type": "keyword" + }, + "ntop_ftp_password": { + "type": "keyword" + }, + "ntop_ftp_command": { + "type": "keyword" + }, + "ntop_ftp_command_ret_code": { + "type": "long" + }, + "ntop_http_method": { + "type": "keyword" + }, + "ntop_http_site": { + "type": "keyword" + }, + "ntop_sip_c_ip": { + "type": "ip" + }, + "ntop_sip_call_state": { + "type": "keyword" + }, + "ntop_rtp_in_mos": { + "type": "long" + }, + "ntop_rtp_in_r_factor": { + "type": "long" + }, + "ntop_src_proc_user": { + "type": "keyword" + }, + "ntop_src_father_proc_pid": { + "type": "long" + }, + "ntop_src_father_proc": { + "type": "keyword" + }, + "ntop_dst_proc_pid": { + "type": "long" + }, + "ntop_dst_proc": { + "type": "keyword" + }, + "ntop_dst_proc_user": { + "type": "keyword" + }, + "ntop_dst_father_proc_pid": { + "type": "long" + }, + "ntop_dst_father_proc": { + "type": "keyword" + }, + "ntop_rtp_rtt": { + "type": "long" + }, + "ntop_rtp_in_transit": { + "type": "long" + }, + "ntop_rtp_out_transit": { + "type": "long" + }, + "ntop_src_proc_actual_memory": { + "type": "long" + }, + "ntop_src_proc_peak_memory": { + "type": "long" + }, + "ntop_src_proc_avg_cpu_load": { + "type": "long" + }, + "ntop_src_proc_page_faults": { + "type": "long" + }, + "ntop_dst_proc_actual_memory": { + "type": "long" + }, + "ntop_dst_proc_peak_memory": { + "type": "long" + }, + "ntop_dst_proc_avg_cpu_load": { + "type": "long" + }, + "ntop_dst_proc_page_faults": { + "type": "long" + }, + "ntop_duration_in": { + "type": "long" + }, + "ntop_duration_out": { + "type": "long" + }, + "ntop_src_proc_pctg_iowait": { + "type": "long" + }, + "ntop_dst_proc_pctg_iowait": { + "type": "long" + }, + "ntop_rtp_dtmf_tones": { + "type": "keyword" + }, + "ntop_untunneled_ipv6_src_addr": { + "type": "ip" + }, + "ntop_untunneled_ipv6_dst_addr": { + "type": "ip" + }, + "ntop_dns_resp": { + "type": "keyword" + }, + "ntop_diameter_req_msg_type": { + "type": "long" + }, + "ntop_diameter_resp_msg_type": { + "type": "long" + }, + "ntop_diameter_req_origin_host": { + "type": "keyword" + }, + "ntop_diameter_resp_origin_host": { + "type": "keyword" + }, + "ntop_diameter_req_user": { + "type": "keyword" + }, + "ntop_diameter_resp_result_code": { + "type": "long" + }, + "ntop_diameter_exp_res_vendor_id": { + "type": "long" + }, + "ntop_diameter_exp_res_result_code": { + "type": "long" + }, + "ntop_s1ap_enb_ue_s1ap_id": { + "type": "long" + }, + "ntop_s1ap_mme_ue_s1ap_id": { + "type": "long" + }, + "ntop_s1ap_msg_emm_type_mme_to_enb": { + "type": "long" + }, + "ntop_s1ap_msg_esm_type_mme_to_enb": { + "type": "long" + }, + "ntop_s1ap_msg_emm_type_enb_to_mme": { + "type": "long" + }, + "ntop_s1ap_msg_esm_type_enb_to_mme": { + "type": "long" + }, + "ntop_s1ap_cause_enb_to_mme": { + "type": "long" + }, + "ntop_s1ap_detailed_cause_enb_to_mme": { + "type": "long" + }, + "ntop_tcp_win_min_in": { + "type": "long" + }, + "ntop_tcp_win_max_in": { + "type": "long" + }, + "ntop_tcp_win_mss_in": { + "type": "long" + }, + "ntop_tcp_win_scale_in": { + "type": "long" + }, + "ntop_tcp_win_min_out": { + "type": "long" + }, + "ntop_tcp_win_max_out": { + "type": "long" + }, + "ntop_tcp_win_mss_out": { + "type": "long" + }, + "ntop_tcp_win_scale_out": { + "type": "long" + }, + "ntop_dhcp_remote_id": { + "type": "keyword" + }, + "ntop_dhcp_subscriber_id": { + "type": "keyword" + }, + "ntop_src_proc_uid": { + "type": "long" + }, + "ntop_dst_proc_uid": { + "type": "long" + }, + "ntop_application": { + "type": "keyword" + }, + "ntop_user": { + "type": "keyword" + }, + "ntop_dhcp_message_type": { + "type": "keyword" + }, + "ntop_rtp_in_packets_drop": { + "type": "long" + }, + "ntop_rtp_out_packets_drop": { + "type": "long" + }, + "ntop_rtp_out_mos": { + "type": "long" + }, + "ntop_rtp_out_r_factor": { + "type": "long" + }, + "ntop_rtp_mos": { + "type": "long" + }, + "ntop_gptv2_s5_s8_gtpc_teid": { + "type": "keyword" + }, + "ntop_rtp_r_factor": { + "type": "long" + }, + "ntop_rtp_ssrc": { + "type": "long" + }, + "ntop_payload_hash": { + "type": "long" + }, + "ntop_gtpv2_c2s_s5_s8_gtpu_teid": { + "type": "long" + }, + "ntop_gtpv2_s2c_s5_s8_gtpu_teid": { + "type": "long" + }, + "ntop_gtpv2_c2s_s5_s8_gtpu_ip": { + "type": "ip" + }, + "ntop_gtpv2_s2c_s5_s8_gtpu_ip": { + "type": "ip" + }, + "ntop_src_as_map": { + "type": "keyword" + }, + "ntop_dst_as_map": { + "type": "keyword" + }, + "ntop_diameter_hop_by_hop_id": { + "type": "long" + }, + "ntop_upstream_sess_id": { + "type": "long" + }, + "ntop_downstream_sess_id": { + "type": "long" + }, + "ntop_src_long": { + "type": "float" + }, + "ntop_src_lat": { + "type": "float" + }, + "ntop_dst_long": { + "type": "float" + }, + "ntop_dst_lat": { + "type": "float" + }, + "ntop_diameter_clr_cancel_type": { + "type": "long" + }, + "ntop_diameter_clr_flags": { + "type": "long" + }, + "ntop_gtpv2_c2s_s5_s8_gtpc_ip": { + "type": "ip" + }, + "ntop_gtpv2_s2c_s5_s8_gtpc_ip": { + "type": "ip" + }, + "ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid": { + "type": "long" + }, + "ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid": { + "type": "long" + }, + "ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip": { + "type": "ip" + }, + "ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip": { + "type": "ip" + }, + "ntop_http_x_forwarded_for": { + "type": "keyword" + }, + "ntop_http_via": { + "type": "keyword" + }, + "ntop_ssdp_host": { + "type": "keyword" + }, + "ntop_ssdp_usn": { + "type": "keyword" + }, + "ntop_netbios_query": { + "type": "keyword" + }, + "ntop_netbios_query_type": { + "type": "keyword" + }, + "ntop_netbios_resp": { + "type": "keyword" + }, + "ntop_netbios_query_os": { + "type": "keyword" + }, + "ntop_ssdp_server": { + "type": "keyword" + }, + "ntop_ssdp_type": { + "type": "keyword" + }, + "ntop_ssdp_method": { + "type": "keyword" + }, + "ntop_nprobe_ipv4_addr": { + "type": "ip" + }, - "pan_app": { - "type": "keyword" - }, - "pan_user": { - "type": "keyword" - }, + "pan_app": { + "type": "keyword" + }, + "pan_user": { + "type": "keyword" + }, - "plixer_client_ipv4_addr": { - "type": "ip" - }, - "plixer_client_hostname": { - "type": "keyword" - }, - "plixer_partner": { - "type": "keyword" - }, - "plixer_server_hostname": { - "type": "keyword" - }, - "plixer_server_ipv4_addr": { - "type": "ip" - }, - "plixer_recipient_addr": { - "type": "keyword" - }, - "plixer_event_id": { - "type": "long" - }, - "plixer_msg_id": { - "type": "keyword" - }, - "plixer_priority": { - "type": "long" - }, - "plixer_recipient_report_status": { - "type": "long" - }, - "plixer_recipients": { - "type": "long" - }, - "plixer_origination_time": { - "type": "long" - }, - "plixer_encryption": { - "type": "long" - }, - "plixer_service_ver": { - "type": "keyword" - }, - "plixer_linked_msg_id": { - "type": "keyword" - }, - "plixer_msg_subject": { - "type": "keyword" - }, - "plixer_sender_addr": { - "type": "keyword" - }, - "plixer_date_time": { - "type": "long" - }, + "plixer_client_ipv4_addr": { + "type": "ip" + }, + "plixer_client_hostname": { + "type": "keyword" + }, + "plixer_partner": { + "type": "keyword" + }, + "plixer_server_hostname": { + "type": "keyword" + }, + "plixer_server_ipv4_addr": { + "type": "ip" + }, + "plixer_recipient_addr": { + "type": "keyword" + }, + "plixer_event_id": { + "type": "long" + }, + "plixer_msg_id": { + "type": "keyword" + }, + "plixer_priority": { + "type": "long" + }, + "plixer_recipient_report_status": { + "type": "long" + }, + "plixer_recipients": { + "type": "long" + }, + "plixer_origination_time": { + "type": "long" + }, + "plixer_encryption": { + "type": "long" + }, + "plixer_service_ver": { + "type": "keyword" + }, + "plixer_linked_msg_id": { + "type": "keyword" + }, + "plixer_msg_subject": { + "type": "keyword" + }, + "plixer_sender_addr": { + "type": "keyword" + }, + "plixer_date_time": { + "type": "long" + }, - "pluribus_latency_usec": { - "type": "long" - }, + "pluribus_latency_usec": { + "type": "long" + }, - "procera_service": { - "type": "keyword" - }, - "procera_base_service": { - "type": "keyword" - }, - "procera_in_bytes": { - "type": "long" - }, - "procera_out_bytes": { - "type": "long" - }, - "procera_in_packets": { - "type": "long" - }, - "procera_out_packets": { - "type": "long" - }, - "procera_in_shaping_latency": { - "type": "long" - }, - "procera_out_shaping_latency": { - "type": "long" - }, - "procera_in_shaping_drops": { - "type": "long" - }, - "procera_out_shaping_drops": { - "type": "long" - }, - "procera_int_rtt": { - "type": "long" - }, - "procera_ext_rtt": { - "type": "long" - }, - "procera_flow_behavior": { - "type": "keyword" - }, - "procera_content_cat": { - "type": "keyword" - }, - "procera_property": { - "type": "keyword" - }, - "procera_server_hostname": { - "type": "keyword" - }, - "procera_http_req_method": { - "type": "keyword" - }, - "procera_http_user_agent": { - "type": "keyword" - }, - "procera_http_content_type": { - "type": "keyword" - }, - "procera_http_url": { - "type": "keyword" - }, - "procera_http_referrer": { - "type": "keyword" - }, - "procera_http_resp_status": { - "type": "long" - }, - "procera_http_file_len": { - "type": "long" - }, - "procera_http_location": { - "type": "keyword" - }, - "procera_http_lang": { - "type": "keyword" - }, - "procera_subscriber": { - "type": "keyword" - }, - "procera_msisdn": { - "type": "long" - }, - "procera_imsi": { - "type": "long" - }, - "procera_rat": { - "type": "keyword" - }, - "procera_device": { - "type": "long" - }, - "procera_sgsn": { - "type": "keyword" - }, - "procera_rnc": { - "type": "long" - }, - "procera_apn": { - "type": "keyword" - }, - "procera_user_location_info": { - "type": "keyword" - }, - "procera_ggsn": { - "type": "keyword" - }, - "procera_qoe_in_int": { - "type": "float" - }, - "procera_qoe_in_ext": { - "type": "float" - }, - "procera_qoe_out_int": { - "type": "float" - }, - "procera_qoe_out_ext": { - "type": "float" - }, - "procera_local_ipv4_host": { - "type": "ip" - }, - "procera_local_ipv6_host": { - "type": "ip" - }, - "procera_remote_ipv4_host": { - "type": "ip" - }, - "procera_remote_ipv6_host": { - "type": "ip" - }, - "procera_http_req_ver": { - "type": "keyword" - }, - "procera_template": { - "type": "keyword" - }, - "procera_in_dscp": { - "type": "long" - }, - "procera_out_dscp": { - "type": "long" - }, - "procera_in_dot1q_vlanid_level_1": { - "type": "long" - }, - "procera_in_dot1q_vlanid_level_2": { - "type": "long" - }, - "procera_in_dot1q_vlanid_level_3": { - "type": "long" - }, - "procera_in_dot1q_vlanid_level_4": { - "type": "long" - }, - "procera_out_dot1q_vlanid_level_1": { - "type": "long" - }, - "procera_out_dot1q_vlanid_level_2": { - "type": "long" - }, - "procera_out_dot1q_vlanid_level_3": { - "type": "long" - }, - "procera_out_dot1q_vlanid_level_4": { - "type": "long" - }, - "procera_in_dot1q_priority_level_1": { - "type": "long" - }, - "procera_in_dot1q_priority_level_2": { - "type": "long" - }, - "procera_in_dot1q_priority_level_3": { - "type": "long" - }, - "procera_in_dot1q_priority_level_4": { - "type": "long" - }, - "procera_out_dot1q_priority_level_1": { - "type": "long" - }, - "procera_out_dot1q_priority_level_2": { - "type": "long" - }, - "procera_out_dot1q_priority_level_3": { - "type": "long" - }, - "procera_out_dot1q_priority_level_4": { - "type": "long" - }, - "procera_internal_jitter": { - "type": "long" - }, - "procera_service_object": { - "type": "keyword" - }, - "procera_remote_geoip": { - "type": "keyword" - }, + "procera_service": { + "type": "keyword" + }, + "procera_base_service": { + "type": "keyword" + }, + "procera_in_bytes": { + "type": "long" + }, + "procera_out_bytes": { + "type": "long" + }, + "procera_in_packets": { + "type": "long" + }, + "procera_out_packets": { + "type": "long" + }, + "procera_in_shaping_latency": { + "type": "long" + }, + "procera_out_shaping_latency": { + "type": "long" + }, + "procera_in_shaping_drops": { + "type": "long" + }, + "procera_out_shaping_drops": { + "type": "long" + }, + "procera_int_rtt": { + "type": "long" + }, + "procera_ext_rtt": { + "type": "long" + }, + "procera_flow_behavior": { + "type": "keyword" + }, + "procera_content_cat": { + "type": "keyword" + }, + "procera_property": { + "type": "keyword" + }, + "procera_server_hostname": { + "type": "keyword" + }, + "procera_http_req_method": { + "type": "keyword" + }, + "procera_http_user_agent": { + "type": "keyword" + }, + "procera_http_content_type": { + "type": "keyword" + }, + "procera_http_url": { + "type": "keyword" + }, + "procera_http_referrer": { + "type": "keyword" + }, + "procera_http_resp_status": { + "type": "long" + }, + "procera_http_file_len": { + "type": "long" + }, + "procera_http_location": { + "type": "keyword" + }, + "procera_http_lang": { + "type": "keyword" + }, + "procera_subscriber": { + "type": "keyword" + }, + "procera_msisdn": { + "type": "long" + }, + "procera_imsi": { + "type": "long" + }, + "procera_rat": { + "type": "keyword" + }, + "procera_device": { + "type": "long" + }, + "procera_sgsn": { + "type": "keyword" + }, + "procera_rnc": { + "type": "long" + }, + "procera_apn": { + "type": "keyword" + }, + "procera_user_location_info": { + "type": "keyword" + }, + "procera_ggsn": { + "type": "keyword" + }, + "procera_qoe_in_int": { + "type": "float" + }, + "procera_qoe_in_ext": { + "type": "float" + }, + "procera_qoe_out_int": { + "type": "float" + }, + "procera_qoe_out_ext": { + "type": "float" + }, + "procera_local_ipv4_host": { + "type": "ip" + }, + "procera_local_ipv6_host": { + "type": "ip" + }, + "procera_remote_ipv4_host": { + "type": "ip" + }, + "procera_remote_ipv6_host": { + "type": "ip" + }, + "procera_http_req_ver": { + "type": "keyword" + }, + "procera_template": { + "type": "keyword" + }, + "procera_in_dscp": { + "type": "long" + }, + "procera_out_dscp": { + "type": "long" + }, + "procera_in_dot1q_vlanid_level_1": { + "type": "long" + }, + "procera_in_dot1q_vlanid_level_2": { + "type": "long" + }, + "procera_in_dot1q_vlanid_level_3": { + "type": "long" + }, + "procera_in_dot1q_vlanid_level_4": { + "type": "long" + }, + "procera_out_dot1q_vlanid_level_1": { + "type": "long" + }, + "procera_out_dot1q_vlanid_level_2": { + "type": "long" + }, + "procera_out_dot1q_vlanid_level_3": { + "type": "long" + }, + "procera_out_dot1q_vlanid_level_4": { + "type": "long" + }, + "procera_in_dot1q_priority_level_1": { + "type": "long" + }, + "procera_in_dot1q_priority_level_2": { + "type": "long" + }, + "procera_in_dot1q_priority_level_3": { + "type": "long" + }, + "procera_in_dot1q_priority_level_4": { + "type": "long" + }, + "procera_out_dot1q_priority_level_1": { + "type": "long" + }, + "procera_out_dot1q_priority_level_2": { + "type": "long" + }, + "procera_out_dot1q_priority_level_3": { + "type": "long" + }, + "procera_out_dot1q_priority_level_4": { + "type": "long" + }, + "procera_internal_jitter": { + "type": "long" + }, + "procera_service_object": { + "type": "keyword" + }, + "procera_remote_geoip": { + "type": "keyword" + }, - "redsocks_http_hostname": { - "type": "keyword" - }, + "redsocks_http_hostname": { + "type": "keyword" + }, - "sonic_timestamp": { - "type": "long" - }, - "sonic_flow_id": { - "type": "long" - }, - "sonic_initiator_gw_mac": { - "type": "keyword" - }, - "sonic_responder_gw_mac": { - "type": "keyword" - }, - "sonic_initiator_ip": { - "type": "ip" - }, - "sonic_responder_ip": { - "type": "ip" - }, - "sonic_initiator_gw_ip": { - "type": "ip" - }, - "sonic_responder_gw_ip": { - "type": "ip" - }, - "sonic_initiator_iface": { - "type": "long" - }, - "sonic_responder_iface": { - "type": "long" - }, - "sonic_initiator_port": { - "type": "long" - }, - "sonic_responder_port": { - "type": "long" - }, - "sonic_init_to_resp_packets": { - "type": "long" - }, - "sonic_init_to_resp_bytes": { - "type": "long" - }, - "sonic_resp_to_init_packets": { - "type": "long" - }, - "sonic_resp_to_init_bytes": { - "type": "long" - }, - "sonic_flow_start_time": { - "type": "long" - }, - "sonic_flow_end_time": { - "type": "long" - }, - "sonic_internal_flags": { - "type": "long" - }, - "sonic_protocol_type": { - "type": "long" - }, - "sonic_application_id": { - "type": "long" - }, - "sonic_ips_id": { - "type": "long" - }, - "sonic_virus_id": { - "type": "long" - }, - "sonic_spyware_id": { - "type": "long" - }, - "sonic_template_id": { - "type": "long" - }, - "sonic_table": { - "type": "keyword" - }, - "sonic_column_id": { - "type": "long" - }, - "sonic_column": { - "type": "keyword" - }, - "sonic_column_type": { - "type": "long" - }, - "sonic_column_standard_ipfix_id": { - "type": "long" - }, - "sonic_user_index": { - "type": "long" - }, - "sonic_user": { - "type": "keyword" - }, - "sonic_user_id": { - "type": "long" - }, - "sonic_user_domain": { - "type": "keyword" - }, - "sonic_user_auth_type": { - "type": "long" - }, - "sonic_app_index": { - "type": "long" - }, - "sonic_app_id": { - "type": "long" - }, - "sonic_app": { - "type": "keyword" - }, - "sonic_app_cat_id": { - "type": "long" - }, - "sonic_app_cat": { - "type": "keyword" - }, - "sonic_app_sig_id": { - "type": "long" - }, - "sonic_gav_index": { - "type": "long" - }, - "sonic_gav": { - "type": "keyword" - }, - "sonic_gav_sig_id": { - "type": "long" - }, - "sonic_ips_index": { - "type": "long" - }, - "sonic_ips": { - "type": "keyword" - }, - "sonic_ips_cat_id": { - "type": "long" - }, - "sonic_ips_cat": { - "type": "keyword" - }, - "sonic_ips_sig_id": { - "type": "long" - }, - "sonic_aspy_index": { - "type": "long" - }, - "sonic_aspy": { - "type": "keyword" - }, - "sonic_aspy_prod_id": { - "type": "long" - }, - "sonic_aspy_prod": { - "type": "keyword" - }, - "sonic_aspy_sig_id": { - "type": "long" - }, - "sonic_url": { - "type": "keyword" - }, - "sonic_url_ip": { - "type": "ip" - }, - "sonic_rating_index": { - "type": "long" - }, - "sonic_rating": { - "type": "keyword" - }, - "sonic_region_id": { - "type": "long" - }, - "sonic_country_id": { - "type": "long" - }, - "sonic_country": { - "type": "keyword" - }, - "sonic_region": { - "type": "keyword" - }, - "sonic_location_ip": { - "type": "ip" - }, - "sonic_location_region_id": { - "type": "long" - }, - "sonic_location_domain": { - "type": "keyword" - }, - "sonic_if_stat_iface": { - "type": "long" - }, - "sonic_if_stat_in_packets_rate": { - "type": "long" - }, - "sonic_if_stat_out_packets_rate": { - "type": "long" - }, - "sonic_if_stat_in_bytes_rate": { - "type": "long" - }, - "sonic_if_stat_out_bytes_rate": { - "type": "long" - }, - "sonic_if_stat_in_packet_size": { - "type": "long" - }, - "sonic_if_stat_out_packet_size": { - "type": "long" - }, - "sonic_if_stat_conn_rate": { - "type": "long" - }, - "sonic_flow_init_bytes_rate": { - "type": "long" - }, - "sonic_flow_resp_bytes_rate": { - "type": "long" - }, - "sonic_flow_init_packet_rate": { - "type": "long" - }, - "sonic_flow_resp_packet_rate": { - "type": "long" - }, - "sonic_flow_init_packet_size": { - "type": "long" - }, - "sonic_flow_resp_packet_size": { - "type": "long" - }, - "sonic_if_stat_if_name": { - "type": "keyword" - }, - "sonic_if_stat_if_type": { - "type": "long" - }, - "sonic_if_stat_if_speed": { - "type": "long" - }, - "sonic_if_stat_if_state": { - "type": "long" - }, - "sonic_if_stat_if_mtu": { - "type": "long" - }, - "sonic_if_stat_if_mode": { - "type": "long" - }, - "sonic_url_flow_id": { - "type": "long" - }, - "sonic_url_time_id": { - "type": "long" - }, - "sonic_core_stat_core_id": { - "type": "long" - }, - "sonic_core_stat_core_util": { - "type": "long" - }, - "sonic_voip_flow_id": { - "type": "long" - }, - "sonic_voip_time_id": { - "type": "long" - }, - "sonic_voip_init_call_id": { - "type": "keyword" - }, - "sonic_voip_resp_call_id": { - "type": "keyword" - }, - "sonic_media_type": { - "type": "long" - }, - "sonic_media_protocol": { - "type": "long" - }, - "sonic_service": { - "type": "keyword" - }, - "sonic_service_ip_type": { - "type": "long" - }, - "sonic_service_port_begin": { - "type": "long" - }, - "sonic_service_port_end": { - "type": "long" - }, - "sonic_spam_sess_id": { - "type": "long" - }, - "sonic_spam_flow_id": { - "type": "long" - }, - "sonic_spam_time_id": { - "type": "long" - }, - "sonic_spam_spammer": { - "type": "long" - }, - "sonic_spam_type": { - "type": "long" - }, - "sonic_spam_to_email": { - "type": "keyword" - }, - "sonic_spam_from_email": { - "type": "keyword" - }, - "sonic_mem_total_ram": { - "type": "long" - }, - "sonic_mem_avail_ram": { - "type": "long" - }, - "sonic_mem_used_ram": { - "type": "long" - }, - "sonic_mem_db_ram": { - "type": "long" - }, - "sonic_mem_flows": { - "type": "long" - }, - "sonic_mem_per_flow": { - "type": "long" - }, - "sonic_dev_iface_id": { - "type": "long" - }, - "sonic_dev_ip": { - "type": "ip" - }, - "sonic_dev_mac": { - "type": "keyword" - }, - "sonic_dev_name": { - "type": "keyword" - }, - "sonic_vpn_in_spi_id": { - "type": "long" - }, - "sonic_vpn_out_spi_id": { - "type": "long" - }, - "sonic_vpn_tunnel": { - "type": "keyword" - }, - "sonic_vpn_local_gw": { - "type": "ip" - }, - "sonic_vpn_remote_gw": { - "type": "ip" - }, - "sonic_vpn_tunnel_iface_id": { - "type": "long" - }, - "sonic_vpn_policy_type": { - "type": "long" - }, - "sonic_vpn_protocol_type": { - "type": "long" - }, - "sonic_vpn_encrypt_type": { - "type": "long" - }, - "sonic_vpn_auth_type": { - "type": "long" - }, - "sonic_vpn_start_time": { - "type": "long" - }, - "sonic_vpn_end_time": { - "type": "long" - }, - "sonic_init_vpn_spi_out": { - "type": "long" - }, - "sonic_resp_vpn_spi_out": { - "type": "long" - }, - "sonic_init_to_resp_delta_packets": { - "type": "long" - }, - "sonic_init_to_resp_delta_bytes": { - "type": "long" - }, - "sonic_resp_to_init_delta_packets": { - "type": "long" - }, - "sonic_resp_to_init_delta_bytes": { - "type": "long" - }, - "sonic_flow_block_reason": { - "type": "long" - }, - "sonic_if_stat_mac": { - "type": "long" - }, - "sonic_if_stat_ip": { - "type": "ip" - }, - "sonic_if_stat_security_type": { - "type": "long" - }, - "sonic_if_stat_zone": { - "type": "keyword" - }, - "sonic_user_ip": { - "type": "ip" - }, - "sonic_url_rating_val1": { - "type": "long" - }, - "sonic_url_rating_val2": { - "type": "long" - }, - "sonic_url_rating_val3": { - "type": "long" - }, - "sonic_url_rating_val4": { - "type": "long" - }, - "sonic_app_bwm_attr": { - "type": "long" - }, - "sonic_voip_init_to_resp_lost_packets": { - "type": "long" - }, - "sonic_voip_resp_to_init_lost_packets": { - "type": "long" - }, - "sonic_voip_init_to_resp_avg_latency": { - "type": "long" - }, - "sonic_voip_init_to_resp_max_latency": { - "type": "long" - }, - "sonic_voip_resp_to_init_avg_latency": { - "type": "long" - }, - "sonic_voip_resp_to_init_max_latency": { - "type": "long" - }, - "sonic_app_content_type": { - "type": "long" - }, - "sonic_snwl_option": { - "type": "long" - }, - "sonic_app_risk_attr": { - "type": "long" - }, - "sonic_app_tech_attr": { - "type": "long" - }, - "sonic_app_attr_bit_mask": { - "type": "long" - }, - "sonic_top_apps_sigid": { - "type": "long" - }, - "sonic_top_apps_appname": { - "type": "keyword" - }, - "sonic_top_apps_rate": { - "type": "long" - }, + "sonic_timestamp": { + "type": "long" + }, + "sonic_flow_id": { + "type": "long" + }, + "sonic_initiator_gw_mac": { + "type": "keyword" + }, + "sonic_responder_gw_mac": { + "type": "keyword" + }, + "sonic_initiator_ip": { + "type": "ip" + }, + "sonic_responder_ip": { + "type": "ip" + }, + "sonic_initiator_gw_ip": { + "type": "ip" + }, + "sonic_responder_gw_ip": { + "type": "ip" + }, + "sonic_initiator_iface": { + "type": "long" + }, + "sonic_responder_iface": { + "type": "long" + }, + "sonic_initiator_port": { + "type": "long" + }, + "sonic_responder_port": { + "type": "long" + }, + "sonic_init_to_resp_packets": { + "type": "long" + }, + "sonic_init_to_resp_bytes": { + "type": "long" + }, + "sonic_resp_to_init_packets": { + "type": "long" + }, + "sonic_resp_to_init_bytes": { + "type": "long" + }, + "sonic_flow_start_time": { + "type": "long" + }, + "sonic_flow_end_time": { + "type": "long" + }, + "sonic_internal_flags": { + "type": "long" + }, + "sonic_protocol_type": { + "type": "long" + }, + "sonic_application_id": { + "type": "long" + }, + "sonic_ips_id": { + "type": "long" + }, + "sonic_virus_id": { + "type": "long" + }, + "sonic_spyware_id": { + "type": "long" + }, + "sonic_template_id": { + "type": "long" + }, + "sonic_table": { + "type": "keyword" + }, + "sonic_column_id": { + "type": "long" + }, + "sonic_column": { + "type": "keyword" + }, + "sonic_column_type": { + "type": "long" + }, + "sonic_column_standard_ipfix_id": { + "type": "long" + }, + "sonic_user_index": { + "type": "long" + }, + "sonic_user": { + "type": "keyword" + }, + "sonic_user_id": { + "type": "long" + }, + "sonic_user_domain": { + "type": "keyword" + }, + "sonic_user_auth_type": { + "type": "long" + }, + "sonic_app_index": { + "type": "long" + }, + "sonic_app_id": { + "type": "long" + }, + "sonic_app": { + "type": "keyword" + }, + "sonic_app_cat_id": { + "type": "long" + }, + "sonic_app_cat": { + "type": "keyword" + }, + "sonic_app_sig_id": { + "type": "long" + }, + "sonic_gav_index": { + "type": "long" + }, + "sonic_gav": { + "type": "keyword" + }, + "sonic_gav_sig_id": { + "type": "long" + }, + "sonic_ips_index": { + "type": "long" + }, + "sonic_ips": { + "type": "keyword" + }, + "sonic_ips_cat_id": { + "type": "long" + }, + "sonic_ips_cat": { + "type": "keyword" + }, + "sonic_ips_sig_id": { + "type": "long" + }, + "sonic_aspy_index": { + "type": "long" + }, + "sonic_aspy": { + "type": "keyword" + }, + "sonic_aspy_prod_id": { + "type": "long" + }, + "sonic_aspy_prod": { + "type": "keyword" + }, + "sonic_aspy_sig_id": { + "type": "long" + }, + "sonic_url": { + "type": "keyword" + }, + "sonic_url_ip": { + "type": "ip" + }, + "sonic_rating_index": { + "type": "long" + }, + "sonic_rating": { + "type": "keyword" + }, + "sonic_region_id": { + "type": "long" + }, + "sonic_country_id": { + "type": "long" + }, + "sonic_country": { + "type": "keyword" + }, + "sonic_region": { + "type": "keyword" + }, + "sonic_location_ip": { + "type": "ip" + }, + "sonic_location_region_id": { + "type": "long" + }, + "sonic_location_domain": { + "type": "keyword" + }, + "sonic_if_stat_iface": { + "type": "long" + }, + "sonic_if_stat_in_packets_rate": { + "type": "long" + }, + "sonic_if_stat_out_packets_rate": { + "type": "long" + }, + "sonic_if_stat_in_bytes_rate": { + "type": "long" + }, + "sonic_if_stat_out_bytes_rate": { + "type": "long" + }, + "sonic_if_stat_in_packet_size": { + "type": "long" + }, + "sonic_if_stat_out_packet_size": { + "type": "long" + }, + "sonic_if_stat_conn_rate": { + "type": "long" + }, + "sonic_flow_init_bytes_rate": { + "type": "long" + }, + "sonic_flow_resp_bytes_rate": { + "type": "long" + }, + "sonic_flow_init_packet_rate": { + "type": "long" + }, + "sonic_flow_resp_packet_rate": { + "type": "long" + }, + "sonic_flow_init_packet_size": { + "type": "long" + }, + "sonic_flow_resp_packet_size": { + "type": "long" + }, + "sonic_if_stat_if_name": { + "type": "keyword" + }, + "sonic_if_stat_if_type": { + "type": "long" + }, + "sonic_if_stat_if_speed": { + "type": "long" + }, + "sonic_if_stat_if_state": { + "type": "long" + }, + "sonic_if_stat_if_mtu": { + "type": "long" + }, + "sonic_if_stat_if_mode": { + "type": "long" + }, + "sonic_url_flow_id": { + "type": "long" + }, + "sonic_url_time_id": { + "type": "long" + }, + "sonic_core_stat_core_id": { + "type": "long" + }, + "sonic_core_stat_core_util": { + "type": "long" + }, + "sonic_voip_flow_id": { + "type": "long" + }, + "sonic_voip_time_id": { + "type": "long" + }, + "sonic_voip_init_call_id": { + "type": "keyword" + }, + "sonic_voip_resp_call_id": { + "type": "keyword" + }, + "sonic_media_type": { + "type": "long" + }, + "sonic_media_protocol": { + "type": "long" + }, + "sonic_service": { + "type": "keyword" + }, + "sonic_service_ip_type": { + "type": "long" + }, + "sonic_service_port_begin": { + "type": "long" + }, + "sonic_service_port_end": { + "type": "long" + }, + "sonic_spam_sess_id": { + "type": "long" + }, + "sonic_spam_flow_id": { + "type": "long" + }, + "sonic_spam_time_id": { + "type": "long" + }, + "sonic_spam_spammer": { + "type": "long" + }, + "sonic_spam_type": { + "type": "long" + }, + "sonic_spam_to_email": { + "type": "keyword" + }, + "sonic_spam_from_email": { + "type": "keyword" + }, + "sonic_mem_total_ram": { + "type": "long" + }, + "sonic_mem_avail_ram": { + "type": "long" + }, + "sonic_mem_used_ram": { + "type": "long" + }, + "sonic_mem_db_ram": { + "type": "long" + }, + "sonic_mem_flows": { + "type": "long" + }, + "sonic_mem_per_flow": { + "type": "long" + }, + "sonic_dev_iface_id": { + "type": "long" + }, + "sonic_dev_ip": { + "type": "ip" + }, + "sonic_dev_mac": { + "type": "keyword" + }, + "sonic_dev_name": { + "type": "keyword" + }, + "sonic_vpn_in_spi_id": { + "type": "long" + }, + "sonic_vpn_out_spi_id": { + "type": "long" + }, + "sonic_vpn_tunnel": { + "type": "keyword" + }, + "sonic_vpn_local_gw": { + "type": "ip" + }, + "sonic_vpn_remote_gw": { + "type": "ip" + }, + "sonic_vpn_tunnel_iface_id": { + "type": "long" + }, + "sonic_vpn_policy_type": { + "type": "long" + }, + "sonic_vpn_protocol_type": { + "type": "long" + }, + "sonic_vpn_encrypt_type": { + "type": "long" + }, + "sonic_vpn_auth_type": { + "type": "long" + }, + "sonic_vpn_start_time": { + "type": "long" + }, + "sonic_vpn_end_time": { + "type": "long" + }, + "sonic_init_vpn_spi_out": { + "type": "long" + }, + "sonic_resp_vpn_spi_out": { + "type": "long" + }, + "sonic_init_to_resp_delta_packets": { + "type": "long" + }, + "sonic_init_to_resp_delta_bytes": { + "type": "long" + }, + "sonic_resp_to_init_delta_packets": { + "type": "long" + }, + "sonic_resp_to_init_delta_bytes": { + "type": "long" + }, + "sonic_flow_block_reason": { + "type": "long" + }, + "sonic_if_stat_mac": { + "type": "long" + }, + "sonic_if_stat_ip": { + "type": "ip" + }, + "sonic_if_stat_security_type": { + "type": "long" + }, + "sonic_if_stat_zone": { + "type": "keyword" + }, + "sonic_user_ip": { + "type": "ip" + }, + "sonic_url_rating_val1": { + "type": "long" + }, + "sonic_url_rating_val2": { + "type": "long" + }, + "sonic_url_rating_val3": { + "type": "long" + }, + "sonic_url_rating_val4": { + "type": "long" + }, + "sonic_app_bwm_attr": { + "type": "long" + }, + "sonic_voip_init_to_resp_lost_packets": { + "type": "long" + }, + "sonic_voip_resp_to_init_lost_packets": { + "type": "long" + }, + "sonic_voip_init_to_resp_avg_latency": { + "type": "long" + }, + "sonic_voip_init_to_resp_max_latency": { + "type": "long" + }, + "sonic_voip_resp_to_init_avg_latency": { + "type": "long" + }, + "sonic_voip_resp_to_init_max_latency": { + "type": "long" + }, + "sonic_app_content_type": { + "type": "long" + }, + "sonic_snwl_option": { + "type": "long" + }, + "sonic_app_risk_attr": { + "type": "long" + }, + "sonic_app_tech_attr": { + "type": "long" + }, + "sonic_app_attr_bit_mask": { + "type": "long" + }, + "sonic_top_apps_sigid": { + "type": "long" + }, + "sonic_top_apps_appname": { + "type": "keyword" + }, + "sonic_top_apps_rate": { + "type": "long" + }, - "sophos_afc_proto": { - "type": "long" - }, - "sophos_afc_proto_name": { - "type": "keyword" - }, - "sophos_flow_direction": { - "type": "long" - }, + "sophos_afc_proto": { + "type": "long" + }, + "sophos_afc_proto_name": { + "type": "keyword" + }, + "sophos_flow_direction": { + "type": "long" + }, - "viptela_vpn_id": { - "type": "long" - }, + "viptela_vpn_id": { + "type": "long" + }, - "vmware_tenant_proto": { - "type": "long" - }, - "vmware_tenant_src_ipv4": { - "type": "ip" - }, - "vmware_tenant_dst_ipv4": { - "type": "ip" - }, - "vmware_tenant_src_ipv6": { - "type": "ip" - }, - "vmware_tenant_dst_ipv6": { - "type": "ip" - }, - "vmware_tenant_src_port": { - "type": "long" - }, - "vmware_tenant_dst_port": { - "type": "long" - }, - "vmware_egress_iface_attr": { - "type": "long" - }, - "vmware_vxlan_export_role": { - "type": "long" - }, - "vmware_ingress_iface_attr": { - "type": "long" - }, - "vmware_tunnel_type": { - "type": "long" - }, - "vmware_tunnel_key": { - "type": "keyword" - }, - "vmware_tunnel_src_ipv4_addr": { - "type": "ip" - }, - "vmware_tunnel_dst_ipv4_addr": { - "type": "ip" - }, - "vmware_tunnel_protocol_id": { - "type": "long" - }, - "vmware_tunnel_src_transport_port": { - "type": "long" - }, - "vmware_tunnel_dst_transport_port": { - "type": "long" - }, - "vmware_virt_observation_id": { - "type": "keyword" - }, + "vmware_tenant_proto": { + "type": "long" + }, + "vmware_tenant_src_ipv4": { + "type": "ip" + }, + "vmware_tenant_dst_ipv4": { + "type": "ip" + }, + "vmware_tenant_src_ipv6": { + "type": "ip" + }, + "vmware_tenant_dst_ipv6": { + "type": "ip" + }, + "vmware_tenant_src_port": { + "type": "long" + }, + "vmware_tenant_dst_port": { + "type": "long" + }, + "vmware_egress_iface_attr": { + "type": "long" + }, + "vmware_vxlan_export_role": { + "type": "long" + }, + "vmware_ingress_iface_attr": { + "type": "long" + }, + "vmware_tunnel_type": { + "type": "long" + }, + "vmware_tunnel_key": { + "type": "keyword" + }, + "vmware_tunnel_src_ipv4_addr": { + "type": "ip" + }, + "vmware_tunnel_dst_ipv4_addr": { + "type": "ip" + }, + "vmware_tunnel_protocol_id": { + "type": "long" + }, + "vmware_tunnel_src_transport_port": { + "type": "long" + }, + "vmware_tunnel_dst_transport_port": { + "type": "long" + }, + "vmware_virt_observation_id": { + "type": "keyword" + }, - "ziften_inbound": { - "type": "long" - }, - "ziften_pid": { - "type": "long" - }, - "ziften_parent_pid": { - "type": "long" - }, - "ziften_image_path": { - "type": "keyword" - }, - "ziften_filename": { - "type": "keyword" - }, - "ziften_platform": { - "type": "keyword" - }, - "ziften_agent_guid": { - "type": "keyword" - }, - "ziften_hostname": { - "type": "keyword" - }, - "ziften_unk_269": { - "type": "keyword" - }, - "ziften_file_sig": { - "type": "keyword" - }, - "ziften_file_sig_algo": { - "type": "keyword" - }, - "ziften_file_sig_algo_char": { - "type": "keyword" - }, - "ziften_user_sid": { - "type": "keyword" - }, - "ziften_parent_image_path": { - "type": "keyword" - }, - "ziften_parent_file_sig": { - "type": "keyword" - }, - "ziften_acct_id": { - "type": "long" - }, - "ziften_mod_time_secs": { - "type": "long" - }, - "ziften_command": { - "type": "keyword" - } + "ziften_inbound": { + "type": "long" + }, + "ziften_pid": { + "type": "long" + }, + "ziften_parent_pid": { + "type": "long" + }, + "ziften_image_path": { + "type": "keyword" + }, + "ziften_filename": { + "type": "keyword" + }, + "ziften_platform": { + "type": "keyword" + }, + "ziften_agent_guid": { + "type": "keyword" + }, + "ziften_hostname": { + "type": "keyword" + }, + "ziften_unk_269": { + "type": "keyword" + }, + "ziften_file_sig": { + "type": "keyword" + }, + "ziften_file_sig_algo": { + "type": "keyword" + }, + "ziften_file_sig_algo_char": { + "type": "keyword" + }, + "ziften_user_sid": { + "type": "keyword" + }, + "ziften_parent_image_path": { + "type": "keyword" + }, + "ziften_parent_file_sig": { + "type": "keyword" + }, + "ziften_acct_id": { + "type": "long" + }, + "ziften_mod_time_secs": { + "type": "long" + }, + "ziften_command": { + "type": "keyword" } - }, + } + }, - "netflow": { - "dynamic": true, - "type": "object", - "properties": { - "absoluteError": { - "type": "double" - }, - "anonymizationFlags": { - "type": "long" - }, - "anonymizationTechnique": { - "type": "long" - }, - "app_id": { - "type": "keyword" - }, - "application_description": { - "type": "keyword" - }, - "application_id": { - "type": "keyword" - }, - "application_name": { - "type": "keyword" - }, - "applicationCategoryName": { - "type": "keyword" - }, - "applicationGroupName": { - "type": "keyword" - }, - "applicationSubCategoryName": { - "type": "keyword" - }, - "bgp_ipv4_next_hop": { - "type": "ip" - }, - "bgp_ipv6_next_hop": { - "type": "ip" - }, - "bgpNextAdjacentAsNumber": { - "type": "long" - }, - "bgpPrevAdjacentAsNumber": { - "type": "long" - }, - "bgpValidityState": { - "type": "long" - }, - "biflowDirection": { - "type": "long" - }, - "collectorCertificate": { - "type": "keyword" - }, - "collectorIPv4Address": { - "type": "ip" - }, - "collectorIPv6Address": { - "type": "ip" - }, - "collectionTimeMilliseconds": { - "type": "long" - }, - "collectorTransportPort": { - "type": "long" - }, - "commonPropertiesId": { - "type": "long" - }, - "confidenceLevel": { - "type": "double" - }, - "conn_id": { - "type": "long" - }, - "connectionSumDurationSeconds": { - "type": "long" - }, - "connectionTransactionId": { - "type": "long" - }, - "dataLinkFrameSection": { - "type": "keyword" - }, - "dataLinkFrameSize": { - "type": "long" - }, - "dataLinkFrameType": { - "type": "long" - }, - "dataRecordsReliability": { - "type": "long" - }, - "destinationIPv6Prefix": { - "type": "ip" - }, - "digestHashValue": { - "type": "long" - }, - "direction": { - "type": "long" - }, - "distinctCountOfDestinationIPAddress": { - "type": "long" - }, - "distinctCountOfDestinationIPv4Address": { - "type": "long" - }, - "distinctCountOfDestinationIPv6Address": { - "type": "long" - }, - "distinctCountOfSourceIPAddress": { - "type": "long" - }, - "distinctCountOfSourceIPv4Address": { - "type": "long" - }, - "distinctCountOfSourceIPv6Address": { - "type": "long" - }, - "dot1qCustomerDEI": { - "type": "long" - }, - "dot1qCustomerDestinationMacAddress": { - "type": "keyword" - }, - "dot1qCustomerPriority": { - "type": "long" - }, - "dot1qCustomerSourceMacAddress": { - "type": "keyword" - }, - "dot1qCustomerVlanId": { - "type": "long" - }, - "dot1qDEI": { - "type": "long" - }, - "dot1qPriority": { - "type": "long" - }, - "dot1qServiceInstanceId": { - "type": "long" - }, - "dot1qServiceInstancePriority": { - "type": "long" - }, - "dot1qServiceInstanceTag": { - "type": "keyword" - }, - "dot1qVlanId": { - "type": "long" - }, - "droppedLayer2OctetDeltaCount": { - "type": "long" - }, - "droppedLayer2OctetTotalCount": { - "type": "long" - }, - "droppedOctetDeltaCount": { - "type": "long" - }, - "droppedOctetTotalCount": { - "type": "long" - }, - "droppedPacketDeltaCount": { - "type": "long" - }, - "droppedPacketTotalCount": { - "type": "long" - }, - "dst_as": { - "type": "long" - }, - "dst_mask": { - "type": "long" - }, - "dst_tos": { - "type": "long" - }, - "dst_vlan": { - "type": "long" - }, - "egressBroadcastPacketTotalCount": { - "type": "long" - }, - "egressInterfaceType": { - "type": "long" - }, - "egressPhysicalInterface": { - "type": "long" - }, - "egressUnicastPacketTotalCount": { - "type": "long" - }, - "egressVRFID": { - "type": "long" - }, - "encryptedTechnology": { - "type": "keyword" - }, - "engine_id": { - "type": "long" - }, - "engine_type": { - "type": "long" - }, - "ethernetHeaderLength": { - "type": "long" - }, - "ethernetPayloadLength": { - "type": "long" - }, - "ethernetTotalLength": { - "type": "long" - }, - "ethernetType": { - "type": "long" - }, - "event_time_msec": { - "type": "date" - }, - "exporterCertificate": { - "type": "keyword" - }, - "exporterIPv4Address": { - "type": "ip" - }, - "exporterIPv6Address": { - "type": "ip" - }, - "exporterTransportPort": { - "type": "long" - }, - "exportingProcessId": { - "type": "long" - }, - "exportInterface": { - "type": "long" - }, - "exportProtocolVersion": { - "type": "long" - }, - "exportSctpStreamId": { - "type": "long" - }, - "exportTransportProtocol": { - "type": "long" - }, - "first_switched": { - "type": "date" - }, - "flow_active_timeout": { - "type": "long" - }, - "flow_end_msec": { - "type": "long" - }, - "flow_end_reason": { - "type": "long" - }, - "flow_inactive_timeout": { - "type": "long" - }, - "flow_records": { - "type": "long" - }, - "flow_sampler_id": { - "type": "long" - }, - "flow_sampler_mode": { - "type": "long" - }, - "flow_sampler_random_interval": { - "type": "long" - }, - "flow_seq_num": { - "type": "long" - }, - "flow_start_msec": { - "type": "long" - }, - "flowDurationMicroseconds": { - "type": "long" - }, - "flowDurationMilliseconds": { - "type": "long" - }, - "flowEndDeltaMicroseconds": { - "type": "long" - }, - "flowEndMicroseconds": { - "type": "date" - }, - "flowEndNanoseconds": { - "type": "date" - }, - "flowEndSeconds": { - "type": "date" - }, - "flowKeyIndicator": { - "type": "long" - }, - "flows": { - "type": "long" - }, - "flowSamplingTimeInterval": { - "type": "long" - }, - "flowSamplingTimeSpacing": { - "type": "long" - }, - "flowSelectedFlowDeltaCount": { - "type": "long" - }, - "flowSelectedOctetDeltaCount": { - "type": "long" - }, - "flowSelectedPacketDeltaCount": { - "type": "long" - }, - "flowSelectorAlgorithm": { - "type": "long" - }, - "flowset_id": { - "type": "long" - }, - "flowStartDeltaMicroseconds": { - "type": "long" - }, - "flowStartMicroseconds": { - "type": "date" - }, - "flowStartNanoseconds": { - "type": "date" - }, - "flowStartSeconds": { - "type": "date" - }, - "forwarding_status.reason": { - "type": "long" - }, - "forwarding_status.status": { - "type": "long" - }, - "fragmentFlags": { - "type": "long" - }, - "fw_event": { - "type": "long" - }, - "fw_ext_event": { - "type": "long" - }, - "fwd_flow_delta_bytes": { - "type": "long" - }, - "greKey": { - "type": "long" - }, - "hashDigestOutput": { - "type": "long" - }, - "hashFlowDomain": { - "type": "long" - }, - "hashInitialiserValue": { - "type": "long" - }, - "hashIPPayloadOffset": { - "type": "long" - }, - "hashIPPayloadSize": { - "type": "long" - }, - "hashOutputRangeMax": { - "type": "long" - }, - "hashOutputRangeMin": { - "type": "long" - }, - "hashSelectedRangeMax": { - "type": "long" - }, - "hashSelectedRangeMin": { - "type": "long" - }, - "icmp_code": { - "type": "long" - }, - "icmp_code_ipv6": { - "type": "long" - }, - "icmp_type": { - "type": "long" - }, - "icmp_type_ipv4": { - "type": "long" - }, - "icmp_type_ipv6": { - "type": "long" - }, - "icmpTypeCodeIPv6": { - "type": "long" - }, - "if_desc": { - "type": "keyword" - }, - "if_name": { - "type": "keyword" - }, - "ignoredDataRecordTotalCount": { - "type": "long" - }, - "ignoredLayer2FrameTotalCount": { - "type": "long" - }, - "ignoredLayer2OctetTotalCount": { - "type": "long" - }, - "ignoredOctetTotalCount": { - "type": "long" - }, - "ignoredPacketTotalCount": { - "type": "long" - }, - "in_bytes": { - "type": "long" - }, - "in_dst_mac": { - "type": "keyword" - }, - "in_permanent_bytes": { - "type": "long" - }, - "in_permanent_pkts": { - "type": "long" - }, - "in_pkts": { - "type": "long" - }, - "in_src_mac": { - "type": "keyword" - }, - "informationElementDataType": { - "type": "long" - }, - "informationElementDescription": { - "type": "keyword" - }, - "informationElementId": { - "type": "long" - }, - "informationElementIndex": { - "type": "long" - }, - "informationElementName": { - "type": "keyword" - }, - "informationElementRangeBegin": { - "type": "long" - }, - "informationElementRangeEnd": { - "type": "long" - }, - "informationElementSemantics": { - "type": "long" - }, - "informationElementUnits": { - "type": "long" - }, - "ingressBroadcastPacketTotalCount": { - "type": "long" - }, - "ingressInterfaceType": { - "type": "long" - }, - "ingressMulticastPacketTotalCount": { - "type": "long" - }, - "ingressPhysicalInterface": { - "type": "long" - }, - "ingressUnicastPacketTotalCount": { - "type": "long" - }, - "ingressVRFID": { - "type": "long" - }, - "initiatorPackets": { - "type": "long" - }, - "input_snmp": { - "type": "long" - }, - "intermediateProcessId": { - "type": "long" - }, - "ip_dscp": { - "type": "long" - }, - "ip_protocol_version": { - "type": "long" - }, - "ip_tos": { - "type": "long" - }, - "ipHeaderLength": { - "type": "long" - }, - "ipHeaderPacketSection": { - "type": "keyword" - }, - "ipPayloadLength": { - "type": "long" - }, - "ipPayloadPacketSection": { - "type": "keyword" - }, - "ipPrecedence": { - "type": "long" - }, - "IPSecSPI": { - "type": "long" - }, - "ipTotalLength": { - "type": "long" - }, - "ipTTL": { - "type": "long" - }, - "ipv4_dst_addr": { - "type": "ip" - }, - "ipv4_dst_prefix": { - "type": "ip" - }, - "ipv4_ident": { - "type": "long" - }, - "ipv4_next_hop": { - "type": "ip" - }, - "ipv4_src_addr": { - "type": "ip" - }, - "ipv4_src_prefix": { - "type": "ip" - }, - "ipv4IHL": { - "type": "long" - }, - "ipv4Options": { - "type": "long" - }, - "ipv6_dst_addr": { - "type": "ip" - }, - "ipv6_dst_mask": { - "type": "long" - }, - "ipv6_flow_label": { - "type": "long" - }, - "ipv6_next_hop": { - "type": "ip" - }, - "ipv6_option_headers": { - "type": "long" - }, - "ipv6_src_addr": { - "type": "ip" - }, - "ipv6_src_mask": { - "type": "long" - }, - "isMulticast": { - "type": "long" - }, - "l4_dst_port": { - "type": "long" - }, - "l4_src_port": { - "type": "long" - }, - "last_switched": { - "type": "date" - }, - "layer2FrameDeltaCount": { - "type": "long" - }, - "layer2FrameTotalCount": { - "type": "long" - }, - "layer2OctetDeltaCount": { - "type": "long" - }, - "layer2OctetDeltaSumOfSquares": { - "type": "long" - }, - "layer2OctetTotalCount": { - "type": "long" - }, - "layer2OctetTotalSumOfSquares": { - "type": "long" - }, - "layer2SegmentId": { - "type": "long" - }, - "lineCardId": { - "type": "long" - }, - "lowerCILimit": { - "type": "double" - }, - "max_pkt_length": { - "type": "long" - }, - "max_ttl": { - "type": "long" - }, - "maxExportSeconds": { - "type": "long" - }, - "maxFlowEndMicroseconds": { - "type": "long" - }, - "maxFlowEndMilliseconds": { - "type": "long" - }, - "maxFlowEndNanoseconds": { - "type": "long" - }, - "maxFlowEndSeconds": { - "type": "long" - }, - "maximumLayer2TotalLength": { - "type": "long" - }, - "messageMD5Checksum": { - "type": "keyword" - }, - "messageScope": { - "type": "long" - }, - "meteringProcessId": { - "type": "long" - }, - "metroEvcId": { - "type": "keyword" - }, - "metroEvcType": { - "type": "long" - }, - "min_pkt_length": { - "type": "long" - }, - "min_ttl": { - "type": "long" - }, - "minExportSeconds": { - "type": "long" - }, - "minFlowStartMicroseconds": { - "type": "long" - }, - "minFlowStartMilliseconds": { - "type": "long" - }, - "minFlowStartNanoseconds": { - "type": "long" - }, - "minFlowStartSeconds": { - "type": "long" - }, - "minimumLayer2TotalLength": { - "type": "long" - }, - "monitoringIntervalEndMilliSeconds": { - "type": "long" - }, - "monitoringIntervalStartMilliSeconds": { - "type": "long" - }, - "mpls_label_stack_octets.bottom_of_stack": { - "type": "long" - }, - "mpls_label_stack_octets.experimental": { - "type": "long" - }, - "mpls_label_stack_octets.label": { - "type": "long" - }, - "mpls_label_stack_octets.ttl": { - "type": "long" - }, - "mpls_top_label_ip": { - "type": "ip" - }, - "mpls_top_label_type": { - "type": "long" - }, - "mplsLabelStackDepth": { - "type": "long" - }, - "mplsLabelStackSection": { - "type": "keyword" - }, - "mplsPayloadPacketSection": { - "type": "keyword" - }, - "mplsTopLabelExp": { - "type": "long" - }, - "mplsTopLabelIPv6Address": { - "type": "ip" - }, - "mplsTopLabelTTL": { - "type": "long" - }, - "mul_dst_bytes": { - "type": "long" - }, - "mul_dst_pkts": { - "type": "long" - }, - "mul_igmp_type": { - "type": "long" - }, - "natEvent": { - "type": "long" - }, - "natOriginatingAddressRealm": { - "type": "long" - }, - "natPoolId": { - "type": "long" - }, - "natPoolName": { - "type": "keyword" - }, - "natType": { - "type": "long" - }, - "newConnectionDeltaCount": { - "type": "long" - }, - "nextHeaderIPv6": { - "type": "long" - }, - "notSentFlowTotalCount": { - "type": "long" - }, - "notSentLayer2OctetTotalCount": { - "type": "long" - }, - "notSentOctetTotalCount": { - "type": "long" - }, - "notSentPacketTotalCount": { - "type": "long" - }, - "nprobe_proto": { - "type": "long" - }, - "nprobe_proto_name": { - "type": "keyword" - }, - "observationDomainId": { - "type": "long" - }, - "observationDomainName": { - "type": "keyword" - }, - "observationPointId": { - "type": "long" - }, - "observationPointType": { - "type": "long" - }, - "observationTimeMicroseconds": { - "type": "long" - }, - "observationTimeNanoseconds": { - "type": "long" - }, - "observationTimeSeconds": { - "type": "long" - }, - "observedFlowTotalCount": { - "type": "long" - }, - "octetDeltaSumOfSquares": { - "type": "long" - }, - "octetTotalSumOfSquares": { - "type": "long" - }, - "opaqueOctets": { - "type": "keyword" - }, - "originalExporterIPv4Address": { - "type": "ip" - }, - "originalExporterIPv6Address": { - "type": "ip" - }, - "originalFlowsCompleted": { - "type": "long" - }, - "originalFlowsInitiated": { - "type": "long" - }, - "originalFlowsPresent": { - "type": "long" - }, - "originalObservationDomainId": { - "type": "long" - }, - "out_bytes": { - "type": "long" - }, - "out_dst_mac": { - "type": "keyword" - }, - "out_pkts": { - "type": "long" - }, - "out_src_mac": { - "type": "keyword" - }, - "output_snmp": { - "type": "long" - }, - "p2pTechnology": { - "type": "keyword" - }, - "payloadLengthIPv6": { - "type": "long" - }, - "portId": { - "type": "long" - }, - "portRangeNumPorts": { - "type": "long" - }, - "portRangeStepSize": { - "type": "long" - }, - "postDot1qCustomerVlanId": { - "type": "long" - }, - "postDot1qVlanId": { - "type": "long" - }, - "postIpDiffServCodePoint": { - "type": "long" - }, - "postIpPrecedence": { - "type": "long" - }, - "postLayer2OctetDeltaCount": { - "type": "long" - }, - "postLayer2OctetTotalCount": { - "type": "long" - }, - "postMCastLayer2OctetDeltaCount": { - "type": "long" - }, - "postMCastLayer2OctetTotalCount": { - "type": "long" - }, - "postMCastPacketTotalCount": { - "type": "long" - }, - "postMCastOctetTotalCount": { - "type": "long" - }, - "postMplsTopLabelExp": { - "type": "long" - }, - "postNATPortBlockEnd": { - "type": "long" - }, - "postNATPortBlockStart": { - "type": "long" - }, - "postOctetTotalCount": { - "type": "long" - }, - "postPacketTotalCount": { - "type": "long" - }, - "privateEnterpriseNumber": { - "type": "long" - }, - "protocol": { - "type": "long" - }, - "pseudoWireControlWord": { - "type": "long" - }, - "pseudoWireDestinationIPv4Address": { - "type": "ip" - }, - "pseudoWireId": { - "type": "long" - }, - "pseudoWireType": { - "type": "long" - }, - "relativeError": { - "type": "double" - }, - "responderPackets": { - "type": "long" - }, - "rev_flow_delta_bytes": { - "type": "long" - }, - "rfc3550JitterMicroseconds": { - "type": "long" - }, - "rfc3550JitterMilliseconds": { - "type": "long" - }, - "rfc3550JitterNanoseconds": { - "type": "long" - }, - "rtpSequenceNumber": { - "type": "long" - }, - "sampler_name": { - "type": "keyword" - }, - "sampling_algorithm": { - "type": "long" - }, - "sampling_interval": { - "type": "long" - }, - "samplingFlowInterval": { - "type": "long" - }, - "samplingFlowSpacing": { - "type": "long" - }, - "samplingPacketInterval": { - "type": "long" - }, - "samplingPacketSpace": { - "type": "long" - }, - "samplingPopulation": { - "type": "long" - }, - "samplingProbability": { - "type": "double" - }, - "samplingSize": { - "type": "long" - }, - "samplingTimeInterval": { - "type": "long" - }, - "samplingTimeSpace": { - "type": "long" - }, - "scope_system": { - "type": "long" - }, - "sectionExportedOctets": { - "type": "long" - }, - "sectionOffset": { - "type": "long" - }, - "selectionSequenceId": { - "type": "long" - }, - "selectorAlgorithm": { - "type": "long" - }, - "selectorId": { - "type": "long" - }, - "selectorIDTotalFlowsObserved": { - "type": "long" - }, - "selectorIDTotalFlowsSelected": { - "type": "long" - }, - "selectorIdTotalPktsObserved": { - "type": "long" - }, - "selectorIdTotalPktsSelected": { - "type": "long" - }, - "selectorName": { - "type": "keyword" - }, - "sessionScope": { - "type": "long" - }, - "sourceIPv6Prefix": { - "type": "ip" - }, - "src_as": { - "type": "long" - }, - "src_mask": { - "type": "long" - }, - "src_tos": { - "type": "long" - }, - "src_vlan": { - "type": "long" - }, - "staIPv4Address": { - "type": "ip" - }, - "staMacAddress": { - "type": "keyword" - }, - "systemInitTimeMilliseconds": { - "type": "long" - }, - "tcp_dst_port": { - "type": "long" - }, - "tcp_flags": { - "type": "long" - }, - "tcp_src_port": { - "type": "long" - }, - "tcpAcknowledgementNumber": { - "type": "long" - }, - "tcpAckTotalCount": { - "type": "long" - }, - "tcpDestinationPort": { - "type": "long" - }, - "tcpFinTotalCount": { - "type": "long" - }, - "tcpHeaderLength": { - "type": "long" - }, - "tcpOptions": { - "type": "long" - }, - "tcpPshTotalCount": { - "type": "long" - }, - "tcpRstTotalCount": { - "type": "long" - }, - "tcpSequenceNumber": { - "type": "long" - }, - "tcpSynTotalCount": { - "type": "long" - }, - "tcpUrgentPointer": { - "type": "long" - }, - "tcpUrgTotalCount": { - "type": "long" - }, - "tcpWindowScale": { - "type": "long" - }, - "tcpWindowSize": { - "type": "long" - }, - "templateId": { - "type": "long" - }, - "total_bytes_exp": { - "type": "long" - }, - "total_flows_exp": { - "type": "long" - }, - "total_pkts_exp": { - "type": "long" - }, - "totalLengthIPv4": { - "type": "long" - }, - "transportOctetDeltaCount": { - "type": "long" - }, - "transportPacketDeltaCount": { - "type": "long" - }, - "tunnelTechnology": { - "type": "keyword" - }, - "udp_dst_port": { - "type": "long" - }, - "udp_src_port": { - "type": "long" - }, - "udpMessageLength": { - "type": "long" - }, - "upperCILimit": { - "type": "double" - }, - "user_id": { - "type": "keyword" - }, - "username": { - "type": "keyword" - }, - "userName": { - "type": "keyword" - }, - "valueDistributionMethod": { - "type": "long" - }, - "virtualStationInterfaceId": { - "type": "keyword" - }, - "virtualStationInterfaceName": { - "type": "keyword" - }, - "virtualStationName": { - "type": "keyword" - }, - "virtualStationUUID": { - "type": "keyword" - }, - "VRFname": { - "type": "keyword" - }, - "wlan_id": { - "type": "long" - }, - "wlanChannelId": { - "type": "long" - }, - "wlanSSID": { - "type": "keyword" - }, - "wtpMacAddress": { - "type": "keyword" - }, - "xlate_dst_addr_ipv4": { - "type": "ip" - }, - "xlate_dst_addr_ipv6": { - "type": "ip" - }, - "xlate_dst_port": { - "type": "long" - }, - "xlate_src_addr_ipv4": { - "type": "ip" - }, - "xlate_src_addr_ipv6": { - "type": "ip" - }, - "xlate_src_port": { - "type": "long" - }, + "netflow": { + "dynamic": true, + "type": "object", + "properties": { + "absoluteError": { + "type": "double" + }, + "anonymizationFlags": { + "type": "long" + }, + "anonymizationTechnique": { + "type": "long" + }, + "app_id": { + "type": "keyword" + }, + "application_description": { + "type": "keyword" + }, + "application_id": { + "type": "keyword" + }, + "application_name": { + "type": "keyword" + }, + "applicationCategoryName": { + "type": "keyword" + }, + "applicationGroupName": { + "type": "keyword" + }, + "applicationSubCategoryName": { + "type": "keyword" + }, + "bgp_ipv4_next_hop": { + "type": "ip" + }, + "bgp_ipv6_next_hop": { + "type": "ip" + }, + "bgpNextAdjacentAsNumber": { + "type": "long" + }, + "bgpPrevAdjacentAsNumber": { + "type": "long" + }, + "bgpValidityState": { + "type": "long" + }, + "biflowDirection": { + "type": "long" + }, + "collectorCertificate": { + "type": "keyword" + }, + "collectorIPv4Address": { + "type": "ip" + }, + "collectorIPv6Address": { + "type": "ip" + }, + "collectionTimeMilliseconds": { + "type": "long" + }, + "collectorTransportPort": { + "type": "long" + }, + "commonPropertiesId": { + "type": "long" + }, + "confidenceLevel": { + "type": "double" + }, + "conn_id": { + "type": "long" + }, + "connectionSumDurationSeconds": { + "type": "long" + }, + "connectionTransactionId": { + "type": "long" + }, + "dataLinkFrameSection": { + "type": "keyword" + }, + "dataLinkFrameSize": { + "type": "long" + }, + "dataLinkFrameType": { + "type": "long" + }, + "dataRecordsReliability": { + "type": "long" + }, + "destinationIPv6Prefix": { + "type": "ip" + }, + "digestHashValue": { + "type": "long" + }, + "direction": { + "type": "long" + }, + "distinctCountOfDestinationIPAddress": { + "type": "long" + }, + "distinctCountOfDestinationIPv4Address": { + "type": "long" + }, + "distinctCountOfDestinationIPv6Address": { + "type": "long" + }, + "distinctCountOfSourceIPAddress": { + "type": "long" + }, + "distinctCountOfSourceIPv4Address": { + "type": "long" + }, + "distinctCountOfSourceIPv6Address": { + "type": "long" + }, + "dot1qCustomerDEI": { + "type": "long" + }, + "dot1qCustomerDestinationMacAddress": { + "type": "keyword" + }, + "dot1qCustomerPriority": { + "type": "long" + }, + "dot1qCustomerSourceMacAddress": { + "type": "keyword" + }, + "dot1qCustomerVlanId": { + "type": "long" + }, + "dot1qDEI": { + "type": "long" + }, + "dot1qPriority": { + "type": "long" + }, + "dot1qServiceInstanceId": { + "type": "long" + }, + "dot1qServiceInstancePriority": { + "type": "long" + }, + "dot1qServiceInstanceTag": { + "type": "keyword" + }, + "dot1qVlanId": { + "type": "long" + }, + "droppedLayer2OctetDeltaCount": { + "type": "long" + }, + "droppedLayer2OctetTotalCount": { + "type": "long" + }, + "droppedOctetDeltaCount": { + "type": "long" + }, + "droppedOctetTotalCount": { + "type": "long" + }, + "droppedPacketDeltaCount": { + "type": "long" + }, + "droppedPacketTotalCount": { + "type": "long" + }, + "dst_as": { + "type": "long" + }, + "dst_mask": { + "type": "long" + }, + "dst_tos": { + "type": "long" + }, + "dst_vlan": { + "type": "long" + }, + "egressBroadcastPacketTotalCount": { + "type": "long" + }, + "egressInterfaceType": { + "type": "long" + }, + "egressPhysicalInterface": { + "type": "long" + }, + "egressUnicastPacketTotalCount": { + "type": "long" + }, + "egressVRFID": { + "type": "long" + }, + "encryptedTechnology": { + "type": "keyword" + }, + "engine_id": { + "type": "long" + }, + "engine_type": { + "type": "long" + }, + "ethernetHeaderLength": { + "type": "long" + }, + "ethernetPayloadLength": { + "type": "long" + }, + "ethernetTotalLength": { + "type": "long" + }, + "ethernetType": { + "type": "long" + }, + "event_time_msec": { + "type": "date" + }, + "exporterCertificate": { + "type": "keyword" + }, + "exporterIPv4Address": { + "type": "ip" + }, + "exporterIPv6Address": { + "type": "ip" + }, + "exporterTransportPort": { + "type": "long" + }, + "exportingProcessId": { + "type": "long" + }, + "exportInterface": { + "type": "long" + }, + "exportProtocolVersion": { + "type": "long" + }, + "exportSctpStreamId": { + "type": "long" + }, + "exportTransportProtocol": { + "type": "long" + }, + "first_switched": { + "type": "date" + }, + "flow_active_timeout": { + "type": "long" + }, + "flow_end_msec": { + "type": "long" + }, + "flow_end_reason": { + "type": "long" + }, + "flow_inactive_timeout": { + "type": "long" + }, + "flow_records": { + "type": "long" + }, + "flow_sampler_id": { + "type": "long" + }, + "flow_sampler_mode": { + "type": "long" + }, + "flow_sampler_random_interval": { + "type": "long" + }, + "flow_seq_num": { + "type": "long" + }, + "flow_start_msec": { + "type": "long" + }, + "flowDurationMicroseconds": { + "type": "long" + }, + "flowDurationMilliseconds": { + "type": "long" + }, + "flowEndDeltaMicroseconds": { + "type": "long" + }, + "flowEndMicroseconds": { + "type": "date" + }, + "flowEndNanoseconds": { + "type": "date" + }, + "flowEndSeconds": { + "type": "date" + }, + "flowKeyIndicator": { + "type": "long" + }, + "flows": { + "type": "long" + }, + "flowSamplingTimeInterval": { + "type": "long" + }, + "flowSamplingTimeSpacing": { + "type": "long" + }, + "flowSelectedFlowDeltaCount": { + "type": "long" + }, + "flowSelectedOctetDeltaCount": { + "type": "long" + }, + "flowSelectedPacketDeltaCount": { + "type": "long" + }, + "flowSelectorAlgorithm": { + "type": "long" + }, + "flowset_id": { + "type": "long" + }, + "flowStartDeltaMicroseconds": { + "type": "long" + }, + "flowStartMicroseconds": { + "type": "date" + }, + "flowStartNanoseconds": { + "type": "date" + }, + "flowStartSeconds": { + "type": "date" + }, + "forwarding_status.reason": { + "type": "long" + }, + "forwarding_status.status": { + "type": "long" + }, + "fragmentFlags": { + "type": "long" + }, + "fw_event": { + "type": "long" + }, + "fw_ext_event": { + "type": "long" + }, + "fwd_flow_delta_bytes": { + "type": "long" + }, + "greKey": { + "type": "long" + }, + "hashDigestOutput": { + "type": "long" + }, + "hashFlowDomain": { + "type": "long" + }, + "hashInitialiserValue": { + "type": "long" + }, + "hashIPPayloadOffset": { + "type": "long" + }, + "hashIPPayloadSize": { + "type": "long" + }, + "hashOutputRangeMax": { + "type": "long" + }, + "hashOutputRangeMin": { + "type": "long" + }, + "hashSelectedRangeMax": { + "type": "long" + }, + "hashSelectedRangeMin": { + "type": "long" + }, + "icmp_code": { + "type": "long" + }, + "icmp_code_ipv6": { + "type": "long" + }, + "icmp_type": { + "type": "long" + }, + "icmp_type_ipv4": { + "type": "long" + }, + "icmp_type_ipv6": { + "type": "long" + }, + "icmpTypeCodeIPv6": { + "type": "long" + }, + "if_desc": { + "type": "keyword" + }, + "if_name": { + "type": "keyword" + }, + "ignoredDataRecordTotalCount": { + "type": "long" + }, + "ignoredLayer2FrameTotalCount": { + "type": "long" + }, + "ignoredLayer2OctetTotalCount": { + "type": "long" + }, + "ignoredOctetTotalCount": { + "type": "long" + }, + "ignoredPacketTotalCount": { + "type": "long" + }, + "in_bytes": { + "type": "long" + }, + "in_dst_mac": { + "type": "keyword" + }, + "in_permanent_bytes": { + "type": "long" + }, + "in_permanent_pkts": { + "type": "long" + }, + "in_pkts": { + "type": "long" + }, + "in_src_mac": { + "type": "keyword" + }, + "informationElementDataType": { + "type": "long" + }, + "informationElementDescription": { + "type": "keyword" + }, + "informationElementId": { + "type": "long" + }, + "informationElementIndex": { + "type": "long" + }, + "informationElementName": { + "type": "keyword" + }, + "informationElementRangeBegin": { + "type": "long" + }, + "informationElementRangeEnd": { + "type": "long" + }, + "informationElementSemantics": { + "type": "long" + }, + "informationElementUnits": { + "type": "long" + }, + "ingressBroadcastPacketTotalCount": { + "type": "long" + }, + "ingressInterfaceType": { + "type": "long" + }, + "ingressMulticastPacketTotalCount": { + "type": "long" + }, + "ingressPhysicalInterface": { + "type": "long" + }, + "ingressUnicastPacketTotalCount": { + "type": "long" + }, + "ingressVRFID": { + "type": "long" + }, + "initiatorPackets": { + "type": "long" + }, + "input_snmp": { + "type": "long" + }, + "intermediateProcessId": { + "type": "long" + }, + "ip_dscp": { + "type": "long" + }, + "ip_protocol_version": { + "type": "long" + }, + "ip_tos": { + "type": "long" + }, + "ipHeaderLength": { + "type": "long" + }, + "ipHeaderPacketSection": { + "type": "keyword" + }, + "ipPayloadLength": { + "type": "long" + }, + "ipPayloadPacketSection": { + "type": "keyword" + }, + "ipPrecedence": { + "type": "long" + }, + "IPSecSPI": { + "type": "long" + }, + "ipTotalLength": { + "type": "long" + }, + "ipTTL": { + "type": "long" + }, + "ipv4_dst_addr": { + "type": "ip" + }, + "ipv4_dst_prefix": { + "type": "ip" + }, + "ipv4_ident": { + "type": "long" + }, + "ipv4_next_hop": { + "type": "ip" + }, + "ipv4_src_addr": { + "type": "ip" + }, + "ipv4_src_prefix": { + "type": "ip" + }, + "ipv4IHL": { + "type": "long" + }, + "ipv4Options": { + "type": "long" + }, + "ipv6_dst_addr": { + "type": "ip" + }, + "ipv6_dst_mask": { + "type": "long" + }, + "ipv6_flow_label": { + "type": "long" + }, + "ipv6_next_hop": { + "type": "ip" + }, + "ipv6_option_headers": { + "type": "long" + }, + "ipv6_src_addr": { + "type": "ip" + }, + "ipv6_src_mask": { + "type": "long" + }, + "isMulticast": { + "type": "long" + }, + "l4_dst_port": { + "type": "long" + }, + "l4_src_port": { + "type": "long" + }, + "last_switched": { + "type": "date" + }, + "layer2FrameDeltaCount": { + "type": "long" + }, + "layer2FrameTotalCount": { + "type": "long" + }, + "layer2OctetDeltaCount": { + "type": "long" + }, + "layer2OctetDeltaSumOfSquares": { + "type": "long" + }, + "layer2OctetTotalCount": { + "type": "long" + }, + "layer2OctetTotalSumOfSquares": { + "type": "long" + }, + "layer2SegmentId": { + "type": "long" + }, + "lineCardId": { + "type": "long" + }, + "lowerCILimit": { + "type": "double" + }, + "max_pkt_length": { + "type": "long" + }, + "max_ttl": { + "type": "long" + }, + "maxExportSeconds": { + "type": "long" + }, + "maxFlowEndMicroseconds": { + "type": "long" + }, + "maxFlowEndMilliseconds": { + "type": "long" + }, + "maxFlowEndNanoseconds": { + "type": "long" + }, + "maxFlowEndSeconds": { + "type": "long" + }, + "maximumLayer2TotalLength": { + "type": "long" + }, + "messageMD5Checksum": { + "type": "keyword" + }, + "messageScope": { + "type": "long" + }, + "meteringProcessId": { + "type": "long" + }, + "metroEvcId": { + "type": "keyword" + }, + "metroEvcType": { + "type": "long" + }, + "min_pkt_length": { + "type": "long" + }, + "min_ttl": { + "type": "long" + }, + "minExportSeconds": { + "type": "long" + }, + "minFlowStartMicroseconds": { + "type": "long" + }, + "minFlowStartMilliseconds": { + "type": "long" + }, + "minFlowStartNanoseconds": { + "type": "long" + }, + "minFlowStartSeconds": { + "type": "long" + }, + "minimumLayer2TotalLength": { + "type": "long" + }, + "monitoringIntervalEndMilliSeconds": { + "type": "long" + }, + "monitoringIntervalStartMilliSeconds": { + "type": "long" + }, + "mpls_label_stack_octets.bottom_of_stack": { + "type": "long" + }, + "mpls_label_stack_octets.experimental": { + "type": "long" + }, + "mpls_label_stack_octets.label": { + "type": "long" + }, + "mpls_label_stack_octets.ttl": { + "type": "long" + }, + "mpls_top_label_ip": { + "type": "ip" + }, + "mpls_top_label_type": { + "type": "long" + }, + "mplsLabelStackDepth": { + "type": "long" + }, + "mplsLabelStackSection": { + "type": "keyword" + }, + "mplsPayloadPacketSection": { + "type": "keyword" + }, + "mplsTopLabelExp": { + "type": "long" + }, + "mplsTopLabelIPv6Address": { + "type": "ip" + }, + "mplsTopLabelTTL": { + "type": "long" + }, + "mul_dst_bytes": { + "type": "long" + }, + "mul_dst_pkts": { + "type": "long" + }, + "mul_igmp_type": { + "type": "long" + }, + "natEvent": { + "type": "long" + }, + "natOriginatingAddressRealm": { + "type": "long" + }, + "natPoolId": { + "type": "long" + }, + "natPoolName": { + "type": "keyword" + }, + "natType": { + "type": "long" + }, + "newConnectionDeltaCount": { + "type": "long" + }, + "nextHeaderIPv6": { + "type": "long" + }, + "notSentFlowTotalCount": { + "type": "long" + }, + "notSentLayer2OctetTotalCount": { + "type": "long" + }, + "notSentOctetTotalCount": { + "type": "long" + }, + "notSentPacketTotalCount": { + "type": "long" + }, + "nprobe_proto": { + "type": "long" + }, + "nprobe_proto_name": { + "type": "keyword" + }, + "observationDomainId": { + "type": "long" + }, + "observationDomainName": { + "type": "keyword" + }, + "observationPointId": { + "type": "long" + }, + "observationPointType": { + "type": "long" + }, + "observationTimeMicroseconds": { + "type": "long" + }, + "observationTimeNanoseconds": { + "type": "long" + }, + "observationTimeSeconds": { + "type": "long" + }, + "observedFlowTotalCount": { + "type": "long" + }, + "octetDeltaSumOfSquares": { + "type": "long" + }, + "octetTotalSumOfSquares": { + "type": "long" + }, + "opaqueOctets": { + "type": "keyword" + }, + "originalExporterIPv4Address": { + "type": "ip" + }, + "originalExporterIPv6Address": { + "type": "ip" + }, + "originalFlowsCompleted": { + "type": "long" + }, + "originalFlowsInitiated": { + "type": "long" + }, + "originalFlowsPresent": { + "type": "long" + }, + "originalObservationDomainId": { + "type": "long" + }, + "out_bytes": { + "type": "long" + }, + "out_dst_mac": { + "type": "keyword" + }, + "out_pkts": { + "type": "long" + }, + "out_src_mac": { + "type": "keyword" + }, + "output_snmp": { + "type": "long" + }, + "p2pTechnology": { + "type": "keyword" + }, + "payloadLengthIPv6": { + "type": "long" + }, + "portId": { + "type": "long" + }, + "portRangeNumPorts": { + "type": "long" + }, + "portRangeStepSize": { + "type": "long" + }, + "postDot1qCustomerVlanId": { + "type": "long" + }, + "postDot1qVlanId": { + "type": "long" + }, + "postIpDiffServCodePoint": { + "type": "long" + }, + "postIpPrecedence": { + "type": "long" + }, + "postLayer2OctetDeltaCount": { + "type": "long" + }, + "postLayer2OctetTotalCount": { + "type": "long" + }, + "postMCastLayer2OctetDeltaCount": { + "type": "long" + }, + "postMCastLayer2OctetTotalCount": { + "type": "long" + }, + "postMCastPacketTotalCount": { + "type": "long" + }, + "postMCastOctetTotalCount": { + "type": "long" + }, + "postMplsTopLabelExp": { + "type": "long" + }, + "postNATPortBlockEnd": { + "type": "long" + }, + "postNATPortBlockStart": { + "type": "long" + }, + "postOctetTotalCount": { + "type": "long" + }, + "postPacketTotalCount": { + "type": "long" + }, + "privateEnterpriseNumber": { + "type": "long" + }, + "protocol": { + "type": "long" + }, + "pseudoWireControlWord": { + "type": "long" + }, + "pseudoWireDestinationIPv4Address": { + "type": "ip" + }, + "pseudoWireId": { + "type": "long" + }, + "pseudoWireType": { + "type": "long" + }, + "relativeError": { + "type": "double" + }, + "responderPackets": { + "type": "long" + }, + "rev_flow_delta_bytes": { + "type": "long" + }, + "rfc3550JitterMicroseconds": { + "type": "long" + }, + "rfc3550JitterMilliseconds": { + "type": "long" + }, + "rfc3550JitterNanoseconds": { + "type": "long" + }, + "rtpSequenceNumber": { + "type": "long" + }, + "sampler_name": { + "type": "keyword" + }, + "sampling_algorithm": { + "type": "long" + }, + "sampling_interval": { + "type": "long" + }, + "samplingFlowInterval": { + "type": "long" + }, + "samplingFlowSpacing": { + "type": "long" + }, + "samplingPacketInterval": { + "type": "long" + }, + "samplingPacketSpace": { + "type": "long" + }, + "samplingPopulation": { + "type": "long" + }, + "samplingProbability": { + "type": "double" + }, + "samplingSize": { + "type": "long" + }, + "samplingTimeInterval": { + "type": "long" + }, + "samplingTimeSpace": { + "type": "long" + }, + "scope_system": { + "type": "long" + }, + "sectionExportedOctets": { + "type": "long" + }, + "sectionOffset": { + "type": "long" + }, + "selectionSequenceId": { + "type": "long" + }, + "selectorAlgorithm": { + "type": "long" + }, + "selectorId": { + "type": "long" + }, + "selectorIDTotalFlowsObserved": { + "type": "long" + }, + "selectorIDTotalFlowsSelected": { + "type": "long" + }, + "selectorIdTotalPktsObserved": { + "type": "long" + }, + "selectorIdTotalPktsSelected": { + "type": "long" + }, + "selectorName": { + "type": "keyword" + }, + "sessionScope": { + "type": "long" + }, + "sourceIPv6Prefix": { + "type": "ip" + }, + "src_as": { + "type": "long" + }, + "src_mask": { + "type": "long" + }, + "src_tos": { + "type": "long" + }, + "src_vlan": { + "type": "long" + }, + "staIPv4Address": { + "type": "ip" + }, + "staMacAddress": { + "type": "keyword" + }, + "systemInitTimeMilliseconds": { + "type": "long" + }, + "tcp_dst_port": { + "type": "long" + }, + "tcp_flags": { + "type": "long" + }, + "tcp_src_port": { + "type": "long" + }, + "tcpAcknowledgementNumber": { + "type": "long" + }, + "tcpAckTotalCount": { + "type": "long" + }, + "tcpDestinationPort": { + "type": "long" + }, + "tcpFinTotalCount": { + "type": "long" + }, + "tcpHeaderLength": { + "type": "long" + }, + "tcpOptions": { + "type": "long" + }, + "tcpPshTotalCount": { + "type": "long" + }, + "tcpRstTotalCount": { + "type": "long" + }, + "tcpSequenceNumber": { + "type": "long" + }, + "tcpSynTotalCount": { + "type": "long" + }, + "tcpUrgentPointer": { + "type": "long" + }, + "tcpUrgTotalCount": { + "type": "long" + }, + "tcpWindowScale": { + "type": "long" + }, + "tcpWindowSize": { + "type": "long" + }, + "templateId": { + "type": "long" + }, + "total_bytes_exp": { + "type": "long" + }, + "total_flows_exp": { + "type": "long" + }, + "total_pkts_exp": { + "type": "long" + }, + "totalLengthIPv4": { + "type": "long" + }, + "transportOctetDeltaCount": { + "type": "long" + }, + "transportPacketDeltaCount": { + "type": "long" + }, + "tunnelTechnology": { + "type": "keyword" + }, + "udp_dst_port": { + "type": "long" + }, + "udp_src_port": { + "type": "long" + }, + "udpMessageLength": { + "type": "long" + }, + "upperCILimit": { + "type": "double" + }, + "user_id": { + "type": "keyword" + }, + "username": { + "type": "keyword" + }, + "userName": { + "type": "keyword" + }, + "valueDistributionMethod": { + "type": "long" + }, + "virtualStationInterfaceId": { + "type": "keyword" + }, + "virtualStationInterfaceName": { + "type": "keyword" + }, + "virtualStationName": { + "type": "keyword" + }, + "virtualStationUUID": { + "type": "keyword" + }, + "VRFname": { + "type": "keyword" + }, + "wlan_id": { + "type": "long" + }, + "wlanChannelId": { + "type": "long" + }, + "wlanSSID": { + "type": "keyword" + }, + "wtpMacAddress": { + "type": "keyword" + }, + "xlate_dst_addr_ipv4": { + "type": "ip" + }, + "xlate_dst_addr_ipv6": { + "type": "ip" + }, + "xlate_dst_port": { + "type": "long" + }, + "xlate_src_addr_ipv4": { + "type": "ip" + }, + "xlate_src_addr_ipv6": { + "type": "ip" + }, + "xlate_src_port": { + "type": "long" + }, - "cisco_avc_p2p_tech": { - "type": "keyword" - }, - "cisco_avc_tunnel_tech": { - "type": "keyword" - }, - "cisco_avc_encrypt_tech": { - "type": "keyword" - }, - "cisco_ipt_dialing_phone": { - "type": "ip" - }, - "cisco_ipt_dialing_user": { - "type": "keyword" - }, - "cisco_ipt_dialed_phone": { - "type": "ip" - }, - "cisco_ipt_dialed_user": { - "type": "keyword" - }, - "cisco_ipt_call_duration": { - "type": "long" - }, - "cisco_ipt_call_end_reason": { - "type": "long" - }, - "cisco_ipt_calls_dialed": { - "type": "long" - }, - "cisco_ipt_calls_connected": { - "type": "long" - }, - "cisco_ipt_calls_failed": { - "type": "long" - }, - "cisco_nexus_fastpath_src_addr": { - "type": "ip" - }, - "cisco_nexus_fastpath_src_port": { - "type": "long" - }, - "cisco_nexus_fastpath_dst_addr": { - "type": "ip" - }, - "cisco_nexus_fastpath_dst_port": { - "type": "long" - }, - "cisco_endpoint_process_user": { - "type": "keyword" - }, - "cisco_endpoint_process_name": { - "type": "keyword" - }, - "cisco_endpoint_process_hash": { - "type": "keyword" - }, - "cisco_endpoint_process_parent_user": { - "type": "keyword" - }, - "cisco_endpoint_process_parent_name": { - "type": "keyword" - }, - "cisco_endpoint_process_parent_hash": { - "type": "keyword" - }, - "cisco_pfr_policy_id": { - "type": "long" - }, - "cisco_pfr_map_name": { - "type": "keyword" - }, - "cisco_pfr_reason": { - "type": "keyword" - }, - "cisco_fw_ingress_acl_id": { - "type": "keyword" - }, - "cisco_fw_egress_acl_id": { - "type": "keyword" - }, - "cisco_fw_ext_event": { - "type": "keyword" - }, - "cisco_fw_event_level": { - "type": "long" - }, - "cisco_fw_event_level_id": { - "type": "long" - }, - "cisco_fw_config_value": { - "type": "long" - }, - "cisco_fw_erm_code": { - "type": "long" - }, - "cisco_fw_erm_descr": { - "type": "keyword" - }, - "cisco_trustsec_src_id": { - "type": "keyword" - }, - "cisco_trustsec_dst_id": { - "type": "keyword" - }, - "cisco_trustsec_src_name": { - "type": "keyword" - }, - "cisco_trustsec_dst_name": { - "type": "keyword" - }, - "cisco_trustsec_switch_derived_sgt": { - "type": "keyword" - }, - "cisco_fw_blackout_secs": { - "type": "long" - }, - "cisco_fw_half_open_sessions_rate_1min_max": { - "type": "long" - }, - "cisco_fw_half_open_sessions_rate_1min": { - "type": "long" - }, - "cisco_fw_zonepair_id": { - "type": "long" - }, - "cisco_fw_sessions_max": { - "type": "long" - }, - "cisco_fw_zonepair": { - "type": "keyword" - }, - "cisco_fw_ext_event_descr": { - "type": "keyword" - }, - "cisco_fw_drop_pass_summary_packets": { - "type": "long" - }, - "cisco_fw_half_open_sessions": { - "type": "long" - }, - "cisco_waas_dre_input": { - "type": "long" - }, - "cisco_waas_dre_output": { - "type": "long" - }, - "cisco_waas_lz_input": { - "type": "long" - }, - "cisco_waas_lz_output": { - "type": "long" - }, - "cisco_waas_conn_mode": { - "type": "long" - }, - "cisco_waas_input_bytes": { - "type": "long" - }, - "cisco_waas_output_bytes": { - "type": "long" - }, - "cisco_avc_transport_short_term_packets_drop": { - "type": "long" - }, - "cisco_avc_transport_long_term_packets_drop": { - "type": "long" - }, - "cisco_avc_app_media_bytes": { - "type": "long" - }, - "cisco_avc_app_media_byte_rate": { - "type": "long" - }, - "cisco_avc_app_media_packets": { - "type": "long" - }, - "cisco_avc_app_media_packet_rate": { - "type": "long" - }, - "cisco_avc_app_media_packet_rate_variation": { - "type": "long" - }, - "cisco_avc_app_media_event": { - "type": "long" - }, - "cisco_avc_app_monitor_event": { - "type": "long" - }, - "cisco_avc_transport_packets_expected": { - "type": "long" - }, - "cisco_avc_transport_rtt": { - "type": "long" - }, - "cisco_avc_transport_packet_sets_lost": { - "type": "long" - }, - "cisco_avc_transport_short_term_packets_lost": { - "type": "long" - }, - "cisco_avc_transport_long_term_packets_lost": { - "type": "long" - }, - "cisco_avc_transport_packet_loss_rate": { - "type": "long" - }, - "cisco_avc_transport_rtp_ssrc": { - "type": "long" - }, - "cisco_avc_transport_rtp_jitter_mean": { - "type": "long" - }, - "cisco_avc_transport_rtp_jitter_min": { - "type": "long" - }, - "cisco_avc_transport_rtp_jitter_max": { - "type": "long" - }, - "cisco_avc_controlled_tc": { - "type": "long" - }, - "cisco_avc_in_policy_tc": { - "type": "long" - }, - "cisco_avc_app_media_packet_rate_variation_min": { - "type": "long" - }, - "cisco_avc_app_media_packet_rate_variation_max": { - "type": "long" - }, - "cisco_avc_transport_rtp_flows": { - "type": "long" - }, - "cisco_avc_transport_rtp_payload_type": { - "type": "long" - }, - "cisco_avc_transport_packet_loss_rate_min": { - "type": "long" - }, - "cisco_avc_transport_packet_loss_rate_max": { - "type": "long" - }, - "cisco_avc_transport_rtt_sum": { - "type": "long" - }, - "cisco_avc_transport_rtt_min": { - "type": "long" - }, - "cisco_avc_transport_rtt_max": { - "type": "long" - }, - "cisco_avc_metadata_global_session_id": { - "type": "long" - }, - "cisco_avc_metadata_multi_party_session_id": { - "type": "long" - }, - "cisco_avc_metadata_clock_rate": { - "type": "long" - }, - "cisco_avc_network_delay_avg": { - "type": "long" - }, - "cisco_avc_one_way_delay": { - "type": "long" - }, - "cisco_avc_tcp_window_size_min": { - "type": "long" - }, - "cisco_avc_tcp_window_size_max": { - "type": "long" - }, - "cisco_avc_tcp_max_segment_size": { - "type": "long" - }, - "cisco_avc_tcp_window_size_sum": { - "type": "long" - }, - "cisco_avc_rtp_jitter_interarrival_avg": { - "type": "long" - }, - "cisco_pfr_src_site_id": { - "type": "ip" - }, - "cisco_pfr_dst_site_id": { - "type": "ip" - }, - "cisco_avc_transport_byte_loss_rate": { - "type": "long" - }, - "cisco_pfr_event_tc_nomitigation_err_bw_count": { - "type": "long" - }, - "cisco_pfr_event_tc_nomitigation_err_perf_count": { - "type": "long" - }, - "cisco_pfr_dst_site_prefix": { - "type": "ip" - }, - "cisco_pfr_dst_site_prefix_mask": { - "type": "long" - }, - "cisco_pfr_label_id": { - "type": "long" - }, - "cisco_pfr_br_addr": { - "type": "ip" - }, - "cisco_pfr_state": { - "type": "long" - }, - "cisco_pfr_reason_id": { - "type": "long" - }, - "cisco_pfr_threshold": { - "type": "long" - }, - "cisco_pfr_priority": { - "type": "long" - }, - "cisco_avc_long_term_rtt": { - "type": "long" - }, - "cisco_avc_mos_below_counts": { - "type": "long" - }, - "cisco_avc_rsvp_bandwidth_pool": { - "type": "long" - }, - "cisco_avc_rollup_counter": { - "type": "long" - }, - "cisco_avc_kth_tier_percent": { - "type": "long" - }, - "cisco_avc_kth_bw_fee": { - "type": "long" - }, - "cisco_avc_src_port_min": { - "type": "long" - }, - "cisco_avc_src_port_max": { - "type": "long" - }, - "cisco_avc_dst_port_min": { - "type": "long" - }, - "cisco_avc_dst_port_max": { - "type": "long" - }, - "cisco_avc_link_capacity": { - "type": "long" - }, - "cisco_avc_ingress_bw": { - "type": "long" - }, - "cisco_avc_ingress_bw_max": { - "type": "long" - }, - "cisco_avc_egress_bw": { - "type": "long" - }, - "cisco_avc_egress_bw_max": { - "type": "long" - }, - "cisco_avc_ingress_rollup_bw": { - "type": "long" - }, - "cisco_avc_egress_rollup_bw": { - "type": "long" - }, - "cisco_avc_cost_target_bw": { - "type": "long" - }, - "cisco_avc_kth_rollup_bw": { - "type": "long" - }, - "cisco_avc_link_group_name": { - "type": "keyword" - }, - "cisco_avc_bgp_community": { - "type": "ip" - }, - "cisco_avc_bgp_prepend": { - "type": "long" - }, - "cisco_avc_cost_discard_rollup_count": { - "type": "long" - }, - "cisco_fw_user": { - "type": "keyword" - }, - "cisco_fw_xlate_src_addr_ipv4": { - "type": "ip" - }, - "cisco_fw_xlate_dst_addr_ipv4": { - "type": "ip" - }, - "cisco_fw_xlate_src_port": { - "type": "long" - }, - "cisco_fw_xlate_dst_port": { - "type": "long" - }, - "cisco_fw_event": { - "type": "keyword" - }, - "cisco_avc_client_long_lived_network_delay_max": { - "type": "long" - }, - "cisco_avc_client_long_lived_network_delay_min": { - "type": "long" - }, - "cisco_avc_server_long_lived_network_delay_max": { - "type": "long" - }, - "cisco_avc_server_long_lived_network_delay_min": { - "type": "long" - }, - "cisco_policy_qos_class_hierarchy": { - "type": "keyword" - }, - "cisco_avc_server_bytes": { - "type": "long" - }, - "cisco_avc_client_bytes": { - "type": "long" - }, - "cisco_avc_concurrent_sessions": { - "type": "long" - }, - "cisco_waas_segment": { - "type": "long" - }, - "cisco_waas_passthru_reason": { - "type": "long" - }, - "cisco_avc_server_long_lived_network_delay_sum": { - "type": "long" - }, - "cisco_avc_client_long_lived_network_delay_sum": { - "type": "long" - }, - "cisco_avc_total_long_lived_network_delay_sum": { - "type": "long" - }, - "cisco_avc_total_long_lived_network_delay_samples": { - "type": "long" - }, - "cisco_avc_server_long_lived_network_delay_samples": { - "type": "long" - }, - "cisco_avc_client_long_lived_network_delay_samples": { - "type": "long" - }, - "cisco_avc_client_packets": { - "type": "long" - }, - "cisco_avc_server_packets": { - "type": "long" - }, - "cisco_avc_client_retrans_bytes": { - "type": "long" - }, - "cisco_avc_client_retrans_packets": { - "type": "long" - }, - "cisco_avc_server_retrans_bytes": { - "type": "long" - }, - "cisco_avc_server_retrans_packets": { - "type": "long" - }, - "cisco_avc_transact_time_delta": { - "type": "long" - }, - "cisco_avc_transact_time_total": { - "type": "long" - }, - "cisco_avc_transact_time_max": { - "type": "long" - }, - "cisco_avc_transact_time_min": { - "type": "long" - }, - "cisco_avc_server_resps": { - "type": "long" - }, - "cisco_avc_resp_histogram1": { - "type": "long" - }, - "cisco_avc_resp_histogram2": { - "type": "long" - }, - "cisco_avc_resp_histogram3": { - "type": "long" - }, - "cisco_avc_resp_histogram4": { - "type": "long" - }, - "cisco_avc_resp_histogram5": { - "type": "long" - }, - "cisco_avc_resp_histogram6": { - "type": "long" - }, - "cisco_avc_resp_histogram7": { - "type": "long" - }, - "cisco_avc_server_late_resps": { - "type": "long" - }, - "cisco_avc_server_resp_time_sum": { - "type": "long" - }, - "cisco_avc_server_resp_time_max": { - "type": "long" - }, - "cisco_avc_server_resp_time_min": { - "type": "long" - }, - "cisco_avc_app_delay_sum": { - "type": "long" - }, - "cisco_avc_app_delay_max": { - "type": "long" - }, - "cisco_avc_app_delay_min": { - "type": "long" - }, - "cisco_avc_total_delay_sum": { - "type": "long" - }, - "cisco_avc_total_delay_max": { - "type": "long" - }, - "cisco_avc_total_delay_min": { - "type": "long" - }, - "cisco_avc_total_network_delay_sum": { - "type": "long" - }, - "cisco_avc_total_network_delay_max": { - "type": "long" - }, - "cisco_avc_total_network_delay_min": { - "type": "long" - }, - "cisco_avc_client_network_delay_sum": { - "type": "long" - }, - "cisco_avc_client_network_delay_max": { - "type": "long" - }, - "cisco_avc_client_network_delay_min": { - "type": "long" - }, - "cisco_avc_server_network_delay_sum": { - "type": "long" - }, - "cisco_avc_server_network_delay_max": { - "type": "long" - }, - "cisco_avc_server_network_delay_min": { - "type": "long" - }, - "cisco_avc_rtp_short_term_mos": { - "type": "long" - }, - "cisco_avc_rtp_mos": { - "type": "long" - }, - "cisco_avc_rtp_mos_total": { - "type": "long" - }, - "cisco_avc_app_http_uri_stats": { - "type": "keyword" - }, - "cisco_avc_policy_qos_queue_id": { - "type": "long" - }, - "cisco_avc_policy_qos_queue_drops": { - "type": "long" - }, - "cisco_eta_idp_old": { - "type": "long" - }, - "cisco_eta_slpt_old": { - "type": "long" - }, - "cisco_wlan_id": { - "type": "long" - }, - "cisco_avc_app_category": { - "type": "keyword" - }, - "cisco_avc_app_sub_category": { - "type": "keyword" - }, - "cisco_avc_app_group": { - "type": "keyword" - }, - "cisco_avc_app_http_host": { - "type": "keyword" - }, - "cisco_avc_client_ipv4_addr": { - "type": "ip" - }, - "cisco_avc_server_ipv4_addr": { - "type": "ip" - }, - "cisco_avc_client_ipv6_addr": { - "type": "ip" - }, - "cisco_avc_server_ipv6_addr": { - "type": "ip" - }, - "cisco_avc_client_l4_port": { - "type": "long" - }, - "cisco_avc_server_l4_port": { - "type": "long" - }, - "cisco_avc_conn_id": { - "type": "long" - }, - "cisco_avc_app_traffic_class": { - "type": "keyword" - }, - "cisco_avc_app_business_relevance": { - "type": "keyword" - }, - "cisco_nvzflow_udid": { - "type": "keyword" - }, - "cisco_nvzflow_user": { - "type": "keyword" - }, - "cisco_nvzflow_os_name": { - "type": "keyword" - }, - "cisco_nvzflow_os_ver": { - "type": "keyword" - }, - "cisco_nvzflow_sys_vendor": { - "type": "keyword" - }, - "cisco_nvzflow_sys_type": { - "type": "keyword" - }, - "cisco_nvzflow_proc_acct": { - "type": "keyword" - }, - "cisco_nvzflow_parent_proc_acct": { - "type": "keyword" - }, - "cisco_nvzflow_proc": { - "type": "keyword" - }, - "cisco_nvzflow_proc_hash": { - "type": "keyword" - }, - "cisco_nvzflow_parent_proc": { - "type": "keyword" - }, - "cisco_nvzflow_parent_proc_hash": { - "type": "keyword" - }, - "cisco_nvzflow_dns_suffix": { - "type": "keyword" - }, - "cisco_nvzflow_dst_hostname": { - "type": "keyword" - }, - "cisco_nvzflow_l4_bytes_in": { - "type": "long" - }, - "cisco_nvzflow_l4_bytes_out": { - "type": "long" - }, - "cisco_nvzflow_os_edition": { - "type": "keyword" - }, - "cisco_nvzflow_module_list": { - "type": "keyword" - }, - "cisco_nvzflow_hash_list": { - "type": "keyword" - }, - "cisco_nvzflow_coord_list": { - "type": "keyword" - }, - "cisco_nvzflow_iface_info_uid": { - "type": "long" - }, - "cisco_nvzflow_iface_index": { - "type": "long" - }, - "cisco_nvzflow_iface_type": { - "type": "long" - }, - "cisco_nvzflow_iface_name": { - "type": "keyword" - }, - "cisco_nvzflow_iface_details_list": { - "type": "keyword" - }, - "cisco_timestamp_abs_monitor_interval_start": { - "type": "long" - }, - "cisco_timestamp_abs_monitor_interval_end": { - "type": "long" - }, + "cisco_avc_p2p_tech": { + "type": "keyword" + }, + "cisco_avc_tunnel_tech": { + "type": "keyword" + }, + "cisco_avc_encrypt_tech": { + "type": "keyword" + }, + "cisco_ipt_dialing_phone": { + "type": "ip" + }, + "cisco_ipt_dialing_user": { + "type": "keyword" + }, + "cisco_ipt_dialed_phone": { + "type": "ip" + }, + "cisco_ipt_dialed_user": { + "type": "keyword" + }, + "cisco_ipt_call_duration": { + "type": "long" + }, + "cisco_ipt_call_end_reason": { + "type": "long" + }, + "cisco_ipt_calls_dialed": { + "type": "long" + }, + "cisco_ipt_calls_connected": { + "type": "long" + }, + "cisco_ipt_calls_failed": { + "type": "long" + }, + "cisco_nexus_fastpath_src_addr": { + "type": "ip" + }, + "cisco_nexus_fastpath_src_port": { + "type": "long" + }, + "cisco_nexus_fastpath_dst_addr": { + "type": "ip" + }, + "cisco_nexus_fastpath_dst_port": { + "type": "long" + }, + "cisco_endpoint_process_user": { + "type": "keyword" + }, + "cisco_endpoint_process_name": { + "type": "keyword" + }, + "cisco_endpoint_process_hash": { + "type": "keyword" + }, + "cisco_endpoint_process_parent_user": { + "type": "keyword" + }, + "cisco_endpoint_process_parent_name": { + "type": "keyword" + }, + "cisco_endpoint_process_parent_hash": { + "type": "keyword" + }, + "cisco_pfr_policy_id": { + "type": "long" + }, + "cisco_pfr_map_name": { + "type": "keyword" + }, + "cisco_pfr_reason": { + "type": "keyword" + }, + "cisco_fw_ingress_acl_id": { + "type": "keyword" + }, + "cisco_fw_egress_acl_id": { + "type": "keyword" + }, + "cisco_fw_ext_event": { + "type": "keyword" + }, + "cisco_fw_event_level": { + "type": "long" + }, + "cisco_fw_event_level_id": { + "type": "long" + }, + "cisco_fw_config_value": { + "type": "long" + }, + "cisco_fw_erm_code": { + "type": "long" + }, + "cisco_fw_erm_descr": { + "type": "keyword" + }, + "cisco_trustsec_src_id": { + "type": "keyword" + }, + "cisco_trustsec_dst_id": { + "type": "keyword" + }, + "cisco_trustsec_src_name": { + "type": "keyword" + }, + "cisco_trustsec_dst_name": { + "type": "keyword" + }, + "cisco_trustsec_switch_derived_sgt": { + "type": "keyword" + }, + "cisco_fw_blackout_secs": { + "type": "long" + }, + "cisco_fw_half_open_sessions_rate_1min_max": { + "type": "long" + }, + "cisco_fw_half_open_sessions_rate_1min": { + "type": "long" + }, + "cisco_fw_zonepair_id": { + "type": "long" + }, + "cisco_fw_sessions_max": { + "type": "long" + }, + "cisco_fw_zonepair": { + "type": "keyword" + }, + "cisco_fw_ext_event_descr": { + "type": "keyword" + }, + "cisco_fw_drop_pass_summary_packets": { + "type": "long" + }, + "cisco_fw_half_open_sessions": { + "type": "long" + }, + "cisco_waas_dre_input": { + "type": "long" + }, + "cisco_waas_dre_output": { + "type": "long" + }, + "cisco_waas_lz_input": { + "type": "long" + }, + "cisco_waas_lz_output": { + "type": "long" + }, + "cisco_waas_conn_mode": { + "type": "long" + }, + "cisco_waas_input_bytes": { + "type": "long" + }, + "cisco_waas_output_bytes": { + "type": "long" + }, + "cisco_avc_transport_short_term_packets_drop": { + "type": "long" + }, + "cisco_avc_transport_long_term_packets_drop": { + "type": "long" + }, + "cisco_avc_app_media_bytes": { + "type": "long" + }, + "cisco_avc_app_media_byte_rate": { + "type": "long" + }, + "cisco_avc_app_media_packets": { + "type": "long" + }, + "cisco_avc_app_media_packet_rate": { + "type": "long" + }, + "cisco_avc_app_media_packet_rate_variation": { + "type": "long" + }, + "cisco_avc_app_media_event": { + "type": "long" + }, + "cisco_avc_app_monitor_event": { + "type": "long" + }, + "cisco_avc_transport_packets_expected": { + "type": "long" + }, + "cisco_avc_transport_rtt": { + "type": "long" + }, + "cisco_avc_transport_packet_sets_lost": { + "type": "long" + }, + "cisco_avc_transport_short_term_packets_lost": { + "type": "long" + }, + "cisco_avc_transport_long_term_packets_lost": { + "type": "long" + }, + "cisco_avc_transport_packet_loss_rate": { + "type": "long" + }, + "cisco_avc_transport_rtp_ssrc": { + "type": "long" + }, + "cisco_avc_transport_rtp_jitter_mean": { + "type": "long" + }, + "cisco_avc_transport_rtp_jitter_min": { + "type": "long" + }, + "cisco_avc_transport_rtp_jitter_max": { + "type": "long" + }, + "cisco_avc_controlled_tc": { + "type": "long" + }, + "cisco_avc_in_policy_tc": { + "type": "long" + }, + "cisco_avc_app_media_packet_rate_variation_min": { + "type": "long" + }, + "cisco_avc_app_media_packet_rate_variation_max": { + "type": "long" + }, + "cisco_avc_transport_rtp_flows": { + "type": "long" + }, + "cisco_avc_transport_rtp_payload_type": { + "type": "long" + }, + "cisco_avc_transport_packet_loss_rate_min": { + "type": "long" + }, + "cisco_avc_transport_packet_loss_rate_max": { + "type": "long" + }, + "cisco_avc_transport_rtt_sum": { + "type": "long" + }, + "cisco_avc_transport_rtt_min": { + "type": "long" + }, + "cisco_avc_transport_rtt_max": { + "type": "long" + }, + "cisco_avc_metadata_global_session_id": { + "type": "long" + }, + "cisco_avc_metadata_multi_party_session_id": { + "type": "long" + }, + "cisco_avc_metadata_clock_rate": { + "type": "long" + }, + "cisco_avc_network_delay_avg": { + "type": "long" + }, + "cisco_avc_one_way_delay": { + "type": "long" + }, + "cisco_avc_tcp_window_size_min": { + "type": "long" + }, + "cisco_avc_tcp_window_size_max": { + "type": "long" + }, + "cisco_avc_tcp_max_segment_size": { + "type": "long" + }, + "cisco_avc_tcp_window_size_sum": { + "type": "long" + }, + "cisco_avc_rtp_jitter_interarrival_avg": { + "type": "long" + }, + "cisco_pfr_src_site_id": { + "type": "ip" + }, + "cisco_pfr_dst_site_id": { + "type": "ip" + }, + "cisco_avc_transport_byte_loss_rate": { + "type": "long" + }, + "cisco_pfr_event_tc_nomitigation_err_bw_count": { + "type": "long" + }, + "cisco_pfr_event_tc_nomitigation_err_perf_count": { + "type": "long" + }, + "cisco_pfr_dst_site_prefix": { + "type": "ip" + }, + "cisco_pfr_dst_site_prefix_mask": { + "type": "long" + }, + "cisco_pfr_label_id": { + "type": "long" + }, + "cisco_pfr_br_addr": { + "type": "ip" + }, + "cisco_pfr_state": { + "type": "long" + }, + "cisco_pfr_reason_id": { + "type": "long" + }, + "cisco_pfr_threshold": { + "type": "long" + }, + "cisco_pfr_priority": { + "type": "long" + }, + "cisco_avc_long_term_rtt": { + "type": "long" + }, + "cisco_avc_mos_below_counts": { + "type": "long" + }, + "cisco_avc_rsvp_bandwidth_pool": { + "type": "long" + }, + "cisco_avc_rollup_counter": { + "type": "long" + }, + "cisco_avc_kth_tier_percent": { + "type": "long" + }, + "cisco_avc_kth_bw_fee": { + "type": "long" + }, + "cisco_avc_src_port_min": { + "type": "long" + }, + "cisco_avc_src_port_max": { + "type": "long" + }, + "cisco_avc_dst_port_min": { + "type": "long" + }, + "cisco_avc_dst_port_max": { + "type": "long" + }, + "cisco_avc_link_capacity": { + "type": "long" + }, + "cisco_avc_ingress_bw": { + "type": "long" + }, + "cisco_avc_ingress_bw_max": { + "type": "long" + }, + "cisco_avc_egress_bw": { + "type": "long" + }, + "cisco_avc_egress_bw_max": { + "type": "long" + }, + "cisco_avc_ingress_rollup_bw": { + "type": "long" + }, + "cisco_avc_egress_rollup_bw": { + "type": "long" + }, + "cisco_avc_cost_target_bw": { + "type": "long" + }, + "cisco_avc_kth_rollup_bw": { + "type": "long" + }, + "cisco_avc_link_group_name": { + "type": "keyword" + }, + "cisco_avc_bgp_community": { + "type": "ip" + }, + "cisco_avc_bgp_prepend": { + "type": "long" + }, + "cisco_avc_cost_discard_rollup_count": { + "type": "long" + }, + "cisco_fw_user": { + "type": "keyword" + }, + "cisco_fw_xlate_src_addr_ipv4": { + "type": "ip" + }, + "cisco_fw_xlate_dst_addr_ipv4": { + "type": "ip" + }, + "cisco_fw_xlate_src_port": { + "type": "long" + }, + "cisco_fw_xlate_dst_port": { + "type": "long" + }, + "cisco_fw_event": { + "type": "keyword" + }, + "cisco_avc_client_long_lived_network_delay_max": { + "type": "long" + }, + "cisco_avc_client_long_lived_network_delay_min": { + "type": "long" + }, + "cisco_avc_server_long_lived_network_delay_max": { + "type": "long" + }, + "cisco_avc_server_long_lived_network_delay_min": { + "type": "long" + }, + "cisco_policy_qos_class_hierarchy": { + "type": "keyword" + }, + "cisco_avc_server_bytes": { + "type": "long" + }, + "cisco_avc_client_bytes": { + "type": "long" + }, + "cisco_avc_concurrent_sessions": { + "type": "long" + }, + "cisco_waas_segment": { + "type": "long" + }, + "cisco_waas_passthru_reason": { + "type": "long" + }, + "cisco_avc_server_long_lived_network_delay_sum": { + "type": "long" + }, + "cisco_avc_client_long_lived_network_delay_sum": { + "type": "long" + }, + "cisco_avc_total_long_lived_network_delay_sum": { + "type": "long" + }, + "cisco_avc_total_long_lived_network_delay_samples": { + "type": "long" + }, + "cisco_avc_server_long_lived_network_delay_samples": { + "type": "long" + }, + "cisco_avc_client_long_lived_network_delay_samples": { + "type": "long" + }, + "cisco_avc_client_packets": { + "type": "long" + }, + "cisco_avc_server_packets": { + "type": "long" + }, + "cisco_avc_client_retrans_bytes": { + "type": "long" + }, + "cisco_avc_client_retrans_packets": { + "type": "long" + }, + "cisco_avc_server_retrans_bytes": { + "type": "long" + }, + "cisco_avc_server_retrans_packets": { + "type": "long" + }, + "cisco_avc_transact_time_delta": { + "type": "long" + }, + "cisco_avc_transact_time_total": { + "type": "long" + }, + "cisco_avc_transact_time_max": { + "type": "long" + }, + "cisco_avc_transact_time_min": { + "type": "long" + }, + "cisco_avc_server_resps": { + "type": "long" + }, + "cisco_avc_resp_histogram1": { + "type": "long" + }, + "cisco_avc_resp_histogram2": { + "type": "long" + }, + "cisco_avc_resp_histogram3": { + "type": "long" + }, + "cisco_avc_resp_histogram4": { + "type": "long" + }, + "cisco_avc_resp_histogram5": { + "type": "long" + }, + "cisco_avc_resp_histogram6": { + "type": "long" + }, + "cisco_avc_resp_histogram7": { + "type": "long" + }, + "cisco_avc_server_late_resps": { + "type": "long" + }, + "cisco_avc_server_resp_time_sum": { + "type": "long" + }, + "cisco_avc_server_resp_time_max": { + "type": "long" + }, + "cisco_avc_server_resp_time_min": { + "type": "long" + }, + "cisco_avc_app_delay_sum": { + "type": "long" + }, + "cisco_avc_app_delay_max": { + "type": "long" + }, + "cisco_avc_app_delay_min": { + "type": "long" + }, + "cisco_avc_total_delay_sum": { + "type": "long" + }, + "cisco_avc_total_delay_max": { + "type": "long" + }, + "cisco_avc_total_delay_min": { + "type": "long" + }, + "cisco_avc_total_network_delay_sum": { + "type": "long" + }, + "cisco_avc_total_network_delay_max": { + "type": "long" + }, + "cisco_avc_total_network_delay_min": { + "type": "long" + }, + "cisco_avc_client_network_delay_sum": { + "type": "long" + }, + "cisco_avc_client_network_delay_max": { + "type": "long" + }, + "cisco_avc_client_network_delay_min": { + "type": "long" + }, + "cisco_avc_server_network_delay_sum": { + "type": "long" + }, + "cisco_avc_server_network_delay_max": { + "type": "long" + }, + "cisco_avc_server_network_delay_min": { + "type": "long" + }, + "cisco_avc_rtp_short_term_mos": { + "type": "long" + }, + "cisco_avc_rtp_mos": { + "type": "long" + }, + "cisco_avc_rtp_mos_total": { + "type": "long" + }, + "cisco_avc_app_http_uri_stats": { + "type": "keyword" + }, + "cisco_avc_policy_qos_queue_id": { + "type": "long" + }, + "cisco_avc_policy_qos_queue_drops": { + "type": "long" + }, + "cisco_eta_idp_old": { + "type": "long" + }, + "cisco_eta_slpt_old": { + "type": "long" + }, + "cisco_wlan_id": { + "type": "long" + }, + "cisco_avc_app_category": { + "type": "keyword" + }, + "cisco_avc_app_sub_category": { + "type": "keyword" + }, + "cisco_avc_app_group": { + "type": "keyword" + }, + "cisco_avc_app_http_host": { + "type": "keyword" + }, + "cisco_avc_client_ipv4_addr": { + "type": "ip" + }, + "cisco_avc_server_ipv4_addr": { + "type": "ip" + }, + "cisco_avc_client_ipv6_addr": { + "type": "ip" + }, + "cisco_avc_server_ipv6_addr": { + "type": "ip" + }, + "cisco_avc_client_l4_port": { + "type": "long" + }, + "cisco_avc_server_l4_port": { + "type": "long" + }, + "cisco_avc_conn_id": { + "type": "long" + }, + "cisco_avc_app_traffic_class": { + "type": "keyword" + }, + "cisco_avc_app_business_relevance": { + "type": "keyword" + }, + "cisco_nvzflow_udid": { + "type": "keyword" + }, + "cisco_nvzflow_user": { + "type": "keyword" + }, + "cisco_nvzflow_os_name": { + "type": "keyword" + }, + "cisco_nvzflow_os_ver": { + "type": "keyword" + }, + "cisco_nvzflow_sys_vendor": { + "type": "keyword" + }, + "cisco_nvzflow_sys_type": { + "type": "keyword" + }, + "cisco_nvzflow_proc_acct": { + "type": "keyword" + }, + "cisco_nvzflow_parent_proc_acct": { + "type": "keyword" + }, + "cisco_nvzflow_proc": { + "type": "keyword" + }, + "cisco_nvzflow_proc_hash": { + "type": "keyword" + }, + "cisco_nvzflow_parent_proc": { + "type": "keyword" + }, + "cisco_nvzflow_parent_proc_hash": { + "type": "keyword" + }, + "cisco_nvzflow_dns_suffix": { + "type": "keyword" + }, + "cisco_nvzflow_dst_hostname": { + "type": "keyword" + }, + "cisco_nvzflow_l4_bytes_in": { + "type": "long" + }, + "cisco_nvzflow_l4_bytes_out": { + "type": "long" + }, + "cisco_nvzflow_os_edition": { + "type": "keyword" + }, + "cisco_nvzflow_module_list": { + "type": "keyword" + }, + "cisco_nvzflow_hash_list": { + "type": "keyword" + }, + "cisco_nvzflow_coord_list": { + "type": "keyword" + }, + "cisco_nvzflow_iface_info_uid": { + "type": "long" + }, + "cisco_nvzflow_iface_index": { + "type": "long" + }, + "cisco_nvzflow_iface_type": { + "type": "long" + }, + "cisco_nvzflow_iface_name": { + "type": "keyword" + }, + "cisco_nvzflow_iface_details_list": { + "type": "keyword" + }, + "cisco_timestamp_abs_monitor_interval_start": { + "type": "long" + }, + "cisco_timestamp_abs_monitor_interval_end": { + "type": "long" + }, - "ericsson_nat_context_id": { - "type": "long" - }, - "ericsson_nat_context_name": { - "type": "keyword" - }, - "ericsson_nat_assign_ts_secs": { - "type": "long" - }, - "ericsson_nat_unassign_ts_secs": { - "type": "long" - }, - "ericsson_nat_internal_ipv4": { - "type": "ip" - }, - "ericsson_nat_external_ipv4": { - "type": "ip" - }, - "ericsson_nat_external_port_start": { - "type": "long" - }, - "ericsson_nat_external_port_end": { - "type": "long" - }, + "ericsson_nat_context_id": { + "type": "long" + }, + "ericsson_nat_context_name": { + "type": "keyword" + }, + "ericsson_nat_assign_ts_secs": { + "type": "long" + }, + "ericsson_nat_unassign_ts_secs": { + "type": "long" + }, + "ericsson_nat_internal_ipv4": { + "type": "ip" + }, + "ericsson_nat_external_ipv4": { + "type": "ip" + }, + "ericsson_nat_external_port_start": { + "type": "long" + }, + "ericsson_nat_external_port_end": { + "type": "long" + }, - "ntop_src_frags": { - "type": "long" - }, - "ntop_dst_frags": { - "type": "long" - }, - "ntop_src_to_dst_max_throughput": { - "type": "long" - }, - "ntop_src_to_dst_min_throughput": { - "type": "long" - }, - "ntop_src_to_dst_avg_throughput": { - "type": "long" - }, - "ntop_dst_to_src_max_throughput": { - "type": "long" - }, - "ntop_dst_to_src_min_throughput": { - "type": "long" - }, - "ntop_dst_to_src_avg_throughput": { - "type": "long" - }, - "ntop_packets_upto_128_bytes": { - "type": "long" - }, - "ntop_packets_128_to_256_bytes": { - "type": "long" - }, - "ntop_packets_256_to_512_bytes": { - "type": "long" - }, - "ntop_packets_512_to_1024_bytes": { - "type": "long" - }, - "ntop_packets_1024_to_1514_bytes": { - "type": "long" - }, - "ntop_packets_over_1514_bytes": { - "type": "long" - }, - "ntop_cumulative_icmp_type": { - "type": "long" - }, - "ntop_src_country": { - "type": "keyword" - }, - "ntop_src_city": { - "type": "keyword" - }, - "ntop_dst_country": { - "type": "keyword" - }, - "ntop_dst_city": { - "type": "keyword" - }, - "ntop_flow_proto_port": { - "type": "long" - }, - "ntop_tunnel_id": { - "type": "long" - }, - "ntop_longest_flow_packet": { - "type": "long" - }, - "ntop_shortest_flow_packet": { - "type": "long" - }, - "ntop_retrans_in_packets": { - "type": "long" - }, - "ntop_retrans_out_packets": { - "type": "long" - }, - "ntop_ooorder_in_packets": { - "type": "long" - }, - "ntop_ooorder_out_packets": { - "type": "long" - }, - "ntop_untunneled_protocol": { - "type": "long" - }, - "ntop_untunneled_ipv4_src_addr": { - "type": "ip" - }, - "ntop_untunneled_l4_src_port": { - "type": "long" - }, - "ntop_untunneled_ipv4_dst_addr": { - "type": "ip" - }, - "ntop_untunneled_l4_dst_port": { - "type": "long" - }, - "ntop_l7_proto": { - "type": "long" - }, - "ntop_l7_proto_name": { - "type": "keyword" - }, - "ntop_downstram_tunnel_id": { - "type": "long" - }, - "ntop_flow_user": { - "type": "keyword" - }, - "ntop_flow_server": { - "type": "keyword" - }, - "ntop_client_nw_latency_ms": { - "type": "long" - }, - "ntop_server_nw_latency_ms": { - "type": "long" - }, - "ntop_appl_latency_ms": { - "type": "long" - }, - "ntop_plugin": { - "type": "keyword" - }, - "ntop_retrans_in_bytes": { - "type": "long" - }, - "ntop_retrans_out_bytes": { - "type": "long" - }, - "ntop_sip_call_id": { - "type": "keyword" - }, - "ntop_sip_calling_party": { - "type": "keyword" - }, - "ntop_sip_called_party": { - "type": "keyword" - }, - "ntop_sip_rtp_codecs": { - "type": "keyword" - }, - "ntop_sip_invite_time": { - "type": "long" - }, - "ntop_sip_trying_time": { - "type": "long" - }, - "ntop_sip_ringing_time": { - "type": "long" - }, - "ntop_sip_ok_time": { - "type": "long" - }, - "ntop_sip_invite_failure_time": { - "type": "long" - }, - "ntop_sip_bye_time": { - "type": "long" - }, - "ntop_sip_bye_ok_time": { - "type": "long" - }, - "ntop_sip_cancel_time": { - "type": "long" - }, - "ntop_sip_cancel_ok_time": { - "type": "long" - }, - "ntop_sip_rtp_ipv4_src_addr": { - "type": "ip" - }, - "ntop_sip_rtp_l4_src_port": { - "type": "long" - }, - "ntop_sip_rtp_ipv4_dst_addr": { - "type": "ip" - }, - "ntop_sip_rtp_l4_dst_port": { - "type": "long" - }, - "ntop_sip_resp_code": { - "type": "long" - }, - "ntop_sip_reason_cause": { - "type": "long" - }, - "ntop_rtp_first_seq": { - "type": "long" - }, - "ntop_rtp_first_ts": { - "type": "long" - }, - "ntop_rtp_last_seq": { - "type": "long" - }, - "ntop_rtp_last_ts": { - "type": "long" - }, - "ntop_rtp_in_jitter": { - "type": "long" - }, - "ntop_rtp_out_jitter": { - "type": "long" - }, - "ntop_rtp_in_packets_lost": { - "type": "long" - }, - "ntop_rtp_out_packets_lost": { - "type": "long" - }, - "ntop_rtp_out_payload_type": { - "type": "long" - }, - "ntop_rtp_in_max_delta": { - "type": "long" - }, - "ntop_rtp_out_max_delta": { - "type": "long" - }, - "ntop_rtp_in_payload_type": { - "type": "long" - }, - "ntop_src_proc_id": { - "type": "long" - }, - "ntop_src_proc": { - "type": "keyword" - }, - "ntop_http_url": { - "type": "keyword" - }, - "ntop_http_ret_code": { - "type": "long" - }, - "ntop_http_referrer": { - "type": "keyword" - }, - "ntop_http_user_agent": { - "type": "keyword" - }, - "ntop_http_mime": { - "type": "keyword" - }, - "ntop_smtp_mail_from": { - "type": "keyword" - }, - "ntop_smtp_rcpt_to": { - "type": "keyword" - }, - "ntop_http_host": { - "type": "keyword" - }, - "ntop_ssl_server": { - "type": "keyword" - }, - "ntop_bittorrent_hash": { - "type": "keyword" - }, - "ntop_mysql_server_ver": { - "type": "keyword" - }, - "ntop_mysql_user": { - "type": "keyword" - }, - "ntop_mysql_db": { - "type": "keyword" - }, - "ntop_mysql_query": { - "type": "keyword" - }, - "ntop_mysql_resp": { - "type": "long" - }, - "ntop_oracle_user": { - "type": "keyword" - }, - "ntop_oracle_query": { - "type": "keyword" - }, - "ntop_oracle_resp_code": { - "type": "long" - }, - "ntop_oracle_resp_string": { - "type": "keyword" - }, - "ntop_oracle_query_duration": { - "type": "long" - }, - "ntop_dns_query": { - "type": "keyword" - }, - "ntop_dns_query_id": { - "type": "long" - }, - "ntop_dns_query_type": { - "type": "long" - }, - "ntop_dns_ret_code": { - "type": "long" - }, - "ntop_dns_answers": { - "type": "long" - }, - "ntop_pop_user": { - "type": "keyword" - }, - "ntop_gtpv1_req_msg_type": { - "type": "long" - }, - "ntop_gtpv1_resp_msg_type": { - "type": "long" - }, - "ntop_gtpv1_c2s_teid_data": { - "type": "long" - }, - "ntop_gtpv1_c2s_teid_ctrl": { - "type": "long" - }, - "ntop_gtpv1_s2c_teid_data": { - "type": "long" - }, - "ntop_gtpv1_s2c_teid_ctrl": { - "type": "long" - }, - "ntop_gtpv1_end_user_ip": { - "type": "ip" - }, - "ntop_gtpv1_end_user_imsi": { - "type": "keyword" - }, - "ntop_gtpv1_end_user_msisdn": { - "type": "keyword" - }, - "ntop_gtpv1_end_user_imei": { - "type": "keyword" - }, - "ntop_gtpv1_apn": { - "type": "keyword" - }, - "ntop_gtpv1_rai_mcc": { - "type": "long" - }, - "ntop_gtpv1_rai_mnc": { - "type": "long" - }, - "ntop_gtpv1_uli_cell_lac": { - "type": "long" - }, - "ntop_gtpv1_uli_cell_ci": { - "type": "long" - }, - "ntop_gtpv1_uli_sac": { - "type": "long" - }, - "ntop_gtpv1_rai_type": { - "type": "long" - }, - "ntop_radius_req_msg_type": { - "type": "long" - }, - "ntop_radius_resp_msg_type": { - "type": "long" - }, - "ntop_radius_user": { - "type": "keyword" - }, - "ntop_radius_calling_station_id": { - "type": "keyword" - }, - "ntop_radius_called_station_id": { - "type": "keyword" - }, - "ntop_radius_nas_ip": { - "type": "ip" - }, - "ntop_radius_nas_id": { - "type": "keyword" - }, - "ntop_radius_user_imsi": { - "type": "keyword" - }, - "ntop_radius_user_imei": { - "type": "keyword" - }, - "ntop_radius_framed_ip": { - "type": "ip" - }, - "ntop_radius_acct_sess_id": { - "type": "keyword" - }, - "ntop_radius_acct_status_type": { - "type": "keyword" - }, - "ntop_radius_acct_in_octets": { - "type": "long" - }, - "ntop_radius_acct_out_octets": { - "type": "long" - }, - "ntop_radius_acct_in_packets": { - "type": "long" - }, - "ntop_radius_acct_out_packets": { - "type": "long" - }, - "ntop_imap_login": { - "type": "keyword" - }, - "ntop_gtpv2_req_msg_type": { - "type": "long" - }, - "ntop_gtpv2_resp_msg_type": { - "type": "long" - }, - "ntop_gtpv2_c2s_s1u_gtpu_teid": { - "type": "long" - }, - "ntop_gtpv2_c2s_s1u_gtpu_ip": { - "type": "ip" - }, - "ntop_gtpv2_s2c_s1u_gtpu_teid": { - "type": "keyword" - }, - "ntop_gtpv2_s2c_s1u_gtpu_ip": { - "type": "ip" - }, - "ntop_gtpv2_end_user_imsi": { - "type": "keyword" - }, - "ntop_gtpv2_and_user_msisdn": { - "type": "keyword" - }, - "ntop_gtpv2_apn": { - "type": "keyword" - }, - "ntop_gtpv2_uli_mcc": { - "type": "long" - }, - "ntop_gtpv2_uli_mnc": { - "type": "long" - }, - "ntop_gtpv2_uli_cell_tac": { - "type": "long" - }, - "ntop_gtpv2_uli_cell_id": { - "type": "long" - }, - "ntop_gtpv2_rat_type": { - "type": "long" - }, - "ntop_gtpv2_pdn_ip": { - "type": "ip" - }, - "ntop_gtpv2_end_user_imei": { - "type": "keyword" - }, - "ntop_src_as_path_1": { - "type": "long" - }, - "ntop_src_as_path_2": { - "type": "long" - }, - "ntop_src_as_path_3": { - "type": "long" - }, - "ntop_src_as_path_4": { - "type": "long" - }, - "ntop_src_as_path_5": { - "type": "long" - }, - "ntop_src_as_path_6": { - "type": "long" - }, - "ntop_src_as_path_7": { - "type": "long" - }, - "ntop_src_as_path_8": { - "type": "long" - }, - "ntop_src_as_path_9": { - "type": "long" - }, - "ntop_src_as_path_10": { - "type": "long" - }, - "ntop_dst_as_path_1": { - "type": "long" - }, - "ntop_dst_as_path_2": { - "type": "long" - }, - "ntop_dst_as_path_3": { - "type": "long" - }, - "ntop_dst_as_path_4": { - "type": "long" - }, - "ntop_dst_as_path_5": { - "type": "long" - }, - "ntop_dst_as_path_6": { - "type": "long" - }, - "ntop_dst_as_path_7": { - "type": "long" - }, - "ntop_dst_as_path_8": { - "type": "long" - }, - "ntop_dst_as_path_9": { - "type": "long" - }, - "ntop_dst_as_path_10": { - "type": "long" - }, - "ntop_mysql_appl_latency_usec": { - "type": "long" - }, - "ntop_gtpv0_req_msg_type": { - "type": "long" - }, - "ntop_gtpv0_resp_msg_type": { - "type": "long" - }, - "ntop_gtpv0_tid": { - "type": "long" - }, - "ntop_gtpv0_end_user_ip": { - "type": "ip" - }, - "ntop_gtpv0_end_user_msisdn": { - "type": "keyword" - }, - "ntop_gtpv0_apn": { - "type": "keyword" - }, - "ntop_gtpv0_rai_mcc": { - "type": "long" - }, - "ntop_gtpv0_rai_mnc": { - "type": "long" - }, - "ntop_gtpv0_rai_cell_lac": { - "type": "long" - }, - "ntop_gtpv0_rai_cell_rac": { - "type": "long" - }, - "ntop_gtpv0_resp_cause": { - "type": "long" - }, - "ntop_gtpv1_resp_cause": { - "type": "long" - }, - "ntop_gtpv2_resp_cause": { - "type": "long" - }, - "ntop_packets_ttl_5_32": { - "type": "long" - }, - "ntop_packets_ttl_32_64": { - "type": "long" - }, - "ntop_packets_ttl_64_96": { - "type": "long" - }, - "ntop_packets_ttl_96_128": { - "type": "long" - }, - "ntop_packets_ttl_128_160": { - "type": "long" - }, - "ntop_packets_ttl_160_192": { - "type": "long" - }, - "ntop_packets_ttl_192_224": { - "type": "long" - }, - "ntop_packets_ttl_224_225": { - "type": "long" - }, - "ntop_gtpv1_rai_lac": { - "type": "long" - }, - "ntop_gtpv1_rai_rac": { - "type": "long" - }, - "ntop_gtpv1_uli_mcc": { - "type": "long" - }, - "ntop_gtpv1_uli_mnc": { - "type": "long" - }, - "ntop_packets_ttl_2_5": { - "type": "long" - }, - "ntop_packets_ttl_eq_1": { - "type": "long" - }, - "ntop_rtp_sip_call_id": { - "type": "keyword" - }, - "ntop_in_src_osi_sap": { - "type": "keyword" - }, - "ntop_out_dst_osi_sap": { - "type": "keyword" - }, - "ntop_whois_das_domain": { - "type": "keyword" - }, - "ntop_dns_ttl_answer": { - "type": "long" - }, - "ntop_dhcp_client_mac": { - "type": "keyword" - }, - "ntop_dhcp_client_ip": { - "type": "ip" - }, - "ntop_dhcp_client": { - "type": "keyword" - }, - "ntop_ftp_login": { - "type": "keyword" - }, - "ntop_ftp_password": { - "type": "keyword" - }, - "ntop_ftp_command": { - "type": "keyword" - }, - "ntop_ftp_command_ret_code": { - "type": "long" - }, - "ntop_http_method": { - "type": "keyword" - }, - "ntop_http_site": { - "type": "keyword" - }, - "ntop_sip_c_ip": { - "type": "ip" - }, - "ntop_sip_call_state": { - "type": "keyword" - }, - "ntop_rtp_in_mos": { - "type": "long" - }, - "ntop_rtp_in_r_factor": { - "type": "long" - }, - "ntop_src_proc_user": { - "type": "keyword" - }, - "ntop_src_father_proc_pid": { - "type": "long" - }, - "ntop_src_father_proc": { - "type": "keyword" - }, - "ntop_dst_proc_pid": { - "type": "long" - }, - "ntop_dst_proc": { - "type": "keyword" - }, - "ntop_dst_proc_user": { - "type": "keyword" - }, - "ntop_dst_father_proc_pid": { - "type": "long" - }, - "ntop_dst_father_proc": { - "type": "keyword" - }, - "ntop_rtp_rtt": { - "type": "long" - }, - "ntop_rtp_in_transit": { - "type": "long" - }, - "ntop_rtp_out_transit": { - "type": "long" - }, - "ntop_src_proc_actual_memory": { - "type": "long" - }, - "ntop_src_proc_peak_memory": { - "type": "long" - }, - "ntop_src_proc_avg_cpu_load": { - "type": "long" - }, - "ntop_src_proc_page_faults": { - "type": "long" - }, - "ntop_dst_proc_actual_memory": { - "type": "long" - }, - "ntop_dst_proc_peak_memory": { - "type": "long" - }, - "ntop_dst_proc_avg_cpu_load": { - "type": "long" - }, - "ntop_dst_proc_page_faults": { - "type": "long" - }, - "ntop_duration_in": { - "type": "long" - }, - "ntop_duration_out": { - "type": "long" - }, - "ntop_src_proc_pctg_iowait": { - "type": "long" - }, - "ntop_dst_proc_pctg_iowait": { - "type": "long" - }, - "ntop_rtp_dtmf_tones": { - "type": "keyword" - }, - "ntop_untunneled_ipv6_src_addr": { - "type": "ip" - }, - "ntop_untunneled_ipv6_dst_addr": { - "type": "ip" - }, - "ntop_dns_resp": { - "type": "keyword" - }, - "ntop_diameter_req_msg_type": { - "type": "long" - }, - "ntop_diameter_resp_msg_type": { - "type": "long" - }, - "ntop_diameter_req_origin_host": { - "type": "keyword" - }, - "ntop_diameter_resp_origin_host": { - "type": "keyword" - }, - "ntop_diameter_req_user": { - "type": "keyword" - }, - "ntop_diameter_resp_result_code": { - "type": "long" - }, - "ntop_diameter_exp_res_vendor_id": { - "type": "long" - }, - "ntop_diameter_exp_res_result_code": { - "type": "long" - }, - "ntop_s1ap_enb_ue_s1ap_id": { - "type": "long" - }, - "ntop_s1ap_mme_ue_s1ap_id": { - "type": "long" - }, - "ntop_s1ap_msg_emm_type_mme_to_enb": { - "type": "long" - }, - "ntop_s1ap_msg_esm_type_mme_to_enb": { - "type": "long" - }, - "ntop_s1ap_msg_emm_type_enb_to_mme": { - "type": "long" - }, - "ntop_s1ap_msg_esm_type_enb_to_mme": { - "type": "long" - }, - "ntop_s1ap_cause_enb_to_mme": { - "type": "long" - }, - "ntop_s1ap_detailed_cause_enb_to_mme": { - "type": "long" - }, - "ntop_tcp_win_min_in": { - "type": "long" - }, - "ntop_tcp_win_max_in": { - "type": "long" - }, - "ntop_tcp_win_mss_in": { - "type": "long" - }, - "ntop_tcp_win_scale_in": { - "type": "long" - }, - "ntop_tcp_win_min_out": { - "type": "long" - }, - "ntop_tcp_win_max_out": { - "type": "long" - }, - "ntop_tcp_win_mss_out": { - "type": "long" - }, - "ntop_tcp_win_scale_out": { - "type": "long" - }, - "ntop_dhcp_remote_id": { - "type": "keyword" - }, - "ntop_dhcp_subscriber_id": { - "type": "keyword" - }, - "ntop_src_proc_uid": { - "type": "long" - }, - "ntop_dst_proc_uid": { - "type": "long" - }, - "ntop_application": { - "type": "keyword" - }, - "ntop_user": { - "type": "keyword" - }, - "ntop_dhcp_message_type": { - "type": "keyword" - }, - "ntop_rtp_in_packets_drop": { - "type": "long" - }, - "ntop_rtp_out_packets_drop": { - "type": "long" - }, - "ntop_rtp_out_mos": { - "type": "long" - }, - "ntop_rtp_out_r_factor": { - "type": "long" - }, - "ntop_rtp_mos": { - "type": "long" - }, - "ntop_gptv2_s5_s8_gtpc_teid": { - "type": "keyword" - }, - "ntop_rtp_r_factor": { - "type": "long" - }, - "ntop_rtp_ssrc": { - "type": "long" - }, - "ntop_payload_hash": { - "type": "long" - }, - "ntop_gtpv2_c2s_s5_s8_gtpu_teid": { - "type": "long" - }, - "ntop_gtpv2_s2c_s5_s8_gtpu_teid": { - "type": "long" - }, - "ntop_gtpv2_c2s_s5_s8_gtpu_ip": { - "type": "ip" - }, - "ntop_gtpv2_s2c_s5_s8_gtpu_ip": { - "type": "ip" - }, - "ntop_src_as_map": { - "type": "keyword" - }, - "ntop_dst_as_map": { - "type": "keyword" - }, - "ntop_diameter_hop_by_hop_id": { - "type": "long" - }, - "ntop_upstream_sess_id": { - "type": "long" - }, - "ntop_downstream_sess_id": { - "type": "long" - }, - "ntop_src_long": { - "type": "float" - }, - "ntop_src_lat": { - "type": "float" - }, - "ntop_dst_long": { - "type": "float" - }, - "ntop_dst_lat": { - "type": "float" - }, - "ntop_diameter_clr_cancel_type": { - "type": "long" - }, - "ntop_diameter_clr_flags": { - "type": "long" - }, - "ntop_gtpv2_c2s_s5_s8_gtpc_ip": { - "type": "ip" - }, - "ntop_gtpv2_s2c_s5_s8_gtpc_ip": { - "type": "ip" - }, - "ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid": { - "type": "long" - }, - "ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid": { - "type": "long" - }, - "ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip": { - "type": "ip" - }, - "ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip": { - "type": "ip" - }, - "ntop_http_x_forwarded_for": { - "type": "keyword" - }, - "ntop_http_via": { - "type": "keyword" - }, - "ntop_ssdp_host": { - "type": "keyword" - }, - "ntop_ssdp_usn": { - "type": "keyword" - }, - "ntop_netbios_query": { - "type": "keyword" - }, - "ntop_netbios_query_type": { - "type": "keyword" - }, - "ntop_netbios_resp": { - "type": "keyword" - }, - "ntop_netbios_query_os": { - "type": "keyword" - }, - "ntop_ssdp_server": { - "type": "keyword" - }, - "ntop_ssdp_type": { - "type": "keyword" - }, - "ntop_ssdp_method": { - "type": "keyword" - }, - "ntop_nprobe_ipv4_addr": { - "type": "ip" - }, + "ntop_src_frags": { + "type": "long" + }, + "ntop_dst_frags": { + "type": "long" + }, + "ntop_src_to_dst_max_throughput": { + "type": "long" + }, + "ntop_src_to_dst_min_throughput": { + "type": "long" + }, + "ntop_src_to_dst_avg_throughput": { + "type": "long" + }, + "ntop_dst_to_src_max_throughput": { + "type": "long" + }, + "ntop_dst_to_src_min_throughput": { + "type": "long" + }, + "ntop_dst_to_src_avg_throughput": { + "type": "long" + }, + "ntop_packets_upto_128_bytes": { + "type": "long" + }, + "ntop_packets_128_to_256_bytes": { + "type": "long" + }, + "ntop_packets_256_to_512_bytes": { + "type": "long" + }, + "ntop_packets_512_to_1024_bytes": { + "type": "long" + }, + "ntop_packets_1024_to_1514_bytes": { + "type": "long" + }, + "ntop_packets_over_1514_bytes": { + "type": "long" + }, + "ntop_cumulative_icmp_type": { + "type": "long" + }, + "ntop_src_country": { + "type": "keyword" + }, + "ntop_src_city": { + "type": "keyword" + }, + "ntop_dst_country": { + "type": "keyword" + }, + "ntop_dst_city": { + "type": "keyword" + }, + "ntop_flow_proto_port": { + "type": "long" + }, + "ntop_tunnel_id": { + "type": "long" + }, + "ntop_longest_flow_packet": { + "type": "long" + }, + "ntop_shortest_flow_packet": { + "type": "long" + }, + "ntop_retrans_in_packets": { + "type": "long" + }, + "ntop_retrans_out_packets": { + "type": "long" + }, + "ntop_ooorder_in_packets": { + "type": "long" + }, + "ntop_ooorder_out_packets": { + "type": "long" + }, + "ntop_untunneled_protocol": { + "type": "long" + }, + "ntop_untunneled_ipv4_src_addr": { + "type": "ip" + }, + "ntop_untunneled_l4_src_port": { + "type": "long" + }, + "ntop_untunneled_ipv4_dst_addr": { + "type": "ip" + }, + "ntop_untunneled_l4_dst_port": { + "type": "long" + }, + "ntop_l7_proto": { + "type": "long" + }, + "ntop_l7_proto_name": { + "type": "keyword" + }, + "ntop_downstram_tunnel_id": { + "type": "long" + }, + "ntop_flow_user": { + "type": "keyword" + }, + "ntop_flow_server": { + "type": "keyword" + }, + "ntop_client_nw_latency_ms": { + "type": "long" + }, + "ntop_server_nw_latency_ms": { + "type": "long" + }, + "ntop_appl_latency_ms": { + "type": "long" + }, + "ntop_plugin": { + "type": "keyword" + }, + "ntop_retrans_in_bytes": { + "type": "long" + }, + "ntop_retrans_out_bytes": { + "type": "long" + }, + "ntop_sip_call_id": { + "type": "keyword" + }, + "ntop_sip_calling_party": { + "type": "keyword" + }, + "ntop_sip_called_party": { + "type": "keyword" + }, + "ntop_sip_rtp_codecs": { + "type": "keyword" + }, + "ntop_sip_invite_time": { + "type": "long" + }, + "ntop_sip_trying_time": { + "type": "long" + }, + "ntop_sip_ringing_time": { + "type": "long" + }, + "ntop_sip_ok_time": { + "type": "long" + }, + "ntop_sip_invite_failure_time": { + "type": "long" + }, + "ntop_sip_bye_time": { + "type": "long" + }, + "ntop_sip_bye_ok_time": { + "type": "long" + }, + "ntop_sip_cancel_time": { + "type": "long" + }, + "ntop_sip_cancel_ok_time": { + "type": "long" + }, + "ntop_sip_rtp_ipv4_src_addr": { + "type": "ip" + }, + "ntop_sip_rtp_l4_src_port": { + "type": "long" + }, + "ntop_sip_rtp_ipv4_dst_addr": { + "type": "ip" + }, + "ntop_sip_rtp_l4_dst_port": { + "type": "long" + }, + "ntop_sip_resp_code": { + "type": "long" + }, + "ntop_sip_reason_cause": { + "type": "long" + }, + "ntop_rtp_first_seq": { + "type": "long" + }, + "ntop_rtp_first_ts": { + "type": "long" + }, + "ntop_rtp_last_seq": { + "type": "long" + }, + "ntop_rtp_last_ts": { + "type": "long" + }, + "ntop_rtp_in_jitter": { + "type": "long" + }, + "ntop_rtp_out_jitter": { + "type": "long" + }, + "ntop_rtp_in_packets_lost": { + "type": "long" + }, + "ntop_rtp_out_packets_lost": { + "type": "long" + }, + "ntop_rtp_out_payload_type": { + "type": "long" + }, + "ntop_rtp_in_max_delta": { + "type": "long" + }, + "ntop_rtp_out_max_delta": { + "type": "long" + }, + "ntop_rtp_in_payload_type": { + "type": "long" + }, + "ntop_src_proc_id": { + "type": "long" + }, + "ntop_src_proc": { + "type": "keyword" + }, + "ntop_http_url": { + "type": "keyword" + }, + "ntop_http_ret_code": { + "type": "long" + }, + "ntop_http_referrer": { + "type": "keyword" + }, + "ntop_http_user_agent": { + "type": "keyword" + }, + "ntop_http_mime": { + "type": "keyword" + }, + "ntop_smtp_mail_from": { + "type": "keyword" + }, + "ntop_smtp_rcpt_to": { + "type": "keyword" + }, + "ntop_http_host": { + "type": "keyword" + }, + "ntop_ssl_server": { + "type": "keyword" + }, + "ntop_bittorrent_hash": { + "type": "keyword" + }, + "ntop_mysql_server_ver": { + "type": "keyword" + }, + "ntop_mysql_user": { + "type": "keyword" + }, + "ntop_mysql_db": { + "type": "keyword" + }, + "ntop_mysql_query": { + "type": "keyword" + }, + "ntop_mysql_resp": { + "type": "long" + }, + "ntop_oracle_user": { + "type": "keyword" + }, + "ntop_oracle_query": { + "type": "keyword" + }, + "ntop_oracle_resp_code": { + "type": "long" + }, + "ntop_oracle_resp_string": { + "type": "keyword" + }, + "ntop_oracle_query_duration": { + "type": "long" + }, + "ntop_dns_query": { + "type": "keyword" + }, + "ntop_dns_query_id": { + "type": "long" + }, + "ntop_dns_query_type": { + "type": "long" + }, + "ntop_dns_ret_code": { + "type": "long" + }, + "ntop_dns_answers": { + "type": "long" + }, + "ntop_pop_user": { + "type": "keyword" + }, + "ntop_gtpv1_req_msg_type": { + "type": "long" + }, + "ntop_gtpv1_resp_msg_type": { + "type": "long" + }, + "ntop_gtpv1_c2s_teid_data": { + "type": "long" + }, + "ntop_gtpv1_c2s_teid_ctrl": { + "type": "long" + }, + "ntop_gtpv1_s2c_teid_data": { + "type": "long" + }, + "ntop_gtpv1_s2c_teid_ctrl": { + "type": "long" + }, + "ntop_gtpv1_end_user_ip": { + "type": "ip" + }, + "ntop_gtpv1_end_user_imsi": { + "type": "keyword" + }, + "ntop_gtpv1_end_user_msisdn": { + "type": "keyword" + }, + "ntop_gtpv1_end_user_imei": { + "type": "keyword" + }, + "ntop_gtpv1_apn": { + "type": "keyword" + }, + "ntop_gtpv1_rai_mcc": { + "type": "long" + }, + "ntop_gtpv1_rai_mnc": { + "type": "long" + }, + "ntop_gtpv1_uli_cell_lac": { + "type": "long" + }, + "ntop_gtpv1_uli_cell_ci": { + "type": "long" + }, + "ntop_gtpv1_uli_sac": { + "type": "long" + }, + "ntop_gtpv1_rai_type": { + "type": "long" + }, + "ntop_radius_req_msg_type": { + "type": "long" + }, + "ntop_radius_resp_msg_type": { + "type": "long" + }, + "ntop_radius_user": { + "type": "keyword" + }, + "ntop_radius_calling_station_id": { + "type": "keyword" + }, + "ntop_radius_called_station_id": { + "type": "keyword" + }, + "ntop_radius_nas_ip": { + "type": "ip" + }, + "ntop_radius_nas_id": { + "type": "keyword" + }, + "ntop_radius_user_imsi": { + "type": "keyword" + }, + "ntop_radius_user_imei": { + "type": "keyword" + }, + "ntop_radius_framed_ip": { + "type": "ip" + }, + "ntop_radius_acct_sess_id": { + "type": "keyword" + }, + "ntop_radius_acct_status_type": { + "type": "keyword" + }, + "ntop_radius_acct_in_octets": { + "type": "long" + }, + "ntop_radius_acct_out_octets": { + "type": "long" + }, + "ntop_radius_acct_in_packets": { + "type": "long" + }, + "ntop_radius_acct_out_packets": { + "type": "long" + }, + "ntop_imap_login": { + "type": "keyword" + }, + "ntop_gtpv2_req_msg_type": { + "type": "long" + }, + "ntop_gtpv2_resp_msg_type": { + "type": "long" + }, + "ntop_gtpv2_c2s_s1u_gtpu_teid": { + "type": "long" + }, + "ntop_gtpv2_c2s_s1u_gtpu_ip": { + "type": "ip" + }, + "ntop_gtpv2_s2c_s1u_gtpu_teid": { + "type": "keyword" + }, + "ntop_gtpv2_s2c_s1u_gtpu_ip": { + "type": "ip" + }, + "ntop_gtpv2_end_user_imsi": { + "type": "keyword" + }, + "ntop_gtpv2_and_user_msisdn": { + "type": "keyword" + }, + "ntop_gtpv2_apn": { + "type": "keyword" + }, + "ntop_gtpv2_uli_mcc": { + "type": "long" + }, + "ntop_gtpv2_uli_mnc": { + "type": "long" + }, + "ntop_gtpv2_uli_cell_tac": { + "type": "long" + }, + "ntop_gtpv2_uli_cell_id": { + "type": "long" + }, + "ntop_gtpv2_rat_type": { + "type": "long" + }, + "ntop_gtpv2_pdn_ip": { + "type": "ip" + }, + "ntop_gtpv2_end_user_imei": { + "type": "keyword" + }, + "ntop_src_as_path_1": { + "type": "long" + }, + "ntop_src_as_path_2": { + "type": "long" + }, + "ntop_src_as_path_3": { + "type": "long" + }, + "ntop_src_as_path_4": { + "type": "long" + }, + "ntop_src_as_path_5": { + "type": "long" + }, + "ntop_src_as_path_6": { + "type": "long" + }, + "ntop_src_as_path_7": { + "type": "long" + }, + "ntop_src_as_path_8": { + "type": "long" + }, + "ntop_src_as_path_9": { + "type": "long" + }, + "ntop_src_as_path_10": { + "type": "long" + }, + "ntop_dst_as_path_1": { + "type": "long" + }, + "ntop_dst_as_path_2": { + "type": "long" + }, + "ntop_dst_as_path_3": { + "type": "long" + }, + "ntop_dst_as_path_4": { + "type": "long" + }, + "ntop_dst_as_path_5": { + "type": "long" + }, + "ntop_dst_as_path_6": { + "type": "long" + }, + "ntop_dst_as_path_7": { + "type": "long" + }, + "ntop_dst_as_path_8": { + "type": "long" + }, + "ntop_dst_as_path_9": { + "type": "long" + }, + "ntop_dst_as_path_10": { + "type": "long" + }, + "ntop_mysql_appl_latency_usec": { + "type": "long" + }, + "ntop_gtpv0_req_msg_type": { + "type": "long" + }, + "ntop_gtpv0_resp_msg_type": { + "type": "long" + }, + "ntop_gtpv0_tid": { + "type": "long" + }, + "ntop_gtpv0_end_user_ip": { + "type": "ip" + }, + "ntop_gtpv0_end_user_msisdn": { + "type": "keyword" + }, + "ntop_gtpv0_apn": { + "type": "keyword" + }, + "ntop_gtpv0_rai_mcc": { + "type": "long" + }, + "ntop_gtpv0_rai_mnc": { + "type": "long" + }, + "ntop_gtpv0_rai_cell_lac": { + "type": "long" + }, + "ntop_gtpv0_rai_cell_rac": { + "type": "long" + }, + "ntop_gtpv0_resp_cause": { + "type": "long" + }, + "ntop_gtpv1_resp_cause": { + "type": "long" + }, + "ntop_gtpv2_resp_cause": { + "type": "long" + }, + "ntop_packets_ttl_5_32": { + "type": "long" + }, + "ntop_packets_ttl_32_64": { + "type": "long" + }, + "ntop_packets_ttl_64_96": { + "type": "long" + }, + "ntop_packets_ttl_96_128": { + "type": "long" + }, + "ntop_packets_ttl_128_160": { + "type": "long" + }, + "ntop_packets_ttl_160_192": { + "type": "long" + }, + "ntop_packets_ttl_192_224": { + "type": "long" + }, + "ntop_packets_ttl_224_225": { + "type": "long" + }, + "ntop_gtpv1_rai_lac": { + "type": "long" + }, + "ntop_gtpv1_rai_rac": { + "type": "long" + }, + "ntop_gtpv1_uli_mcc": { + "type": "long" + }, + "ntop_gtpv1_uli_mnc": { + "type": "long" + }, + "ntop_packets_ttl_2_5": { + "type": "long" + }, + "ntop_packets_ttl_eq_1": { + "type": "long" + }, + "ntop_rtp_sip_call_id": { + "type": "keyword" + }, + "ntop_in_src_osi_sap": { + "type": "keyword" + }, + "ntop_out_dst_osi_sap": { + "type": "keyword" + }, + "ntop_whois_das_domain": { + "type": "keyword" + }, + "ntop_dns_ttl_answer": { + "type": "long" + }, + "ntop_dhcp_client_mac": { + "type": "keyword" + }, + "ntop_dhcp_client_ip": { + "type": "ip" + }, + "ntop_dhcp_client": { + "type": "keyword" + }, + "ntop_ftp_login": { + "type": "keyword" + }, + "ntop_ftp_password": { + "type": "keyword" + }, + "ntop_ftp_command": { + "type": "keyword" + }, + "ntop_ftp_command_ret_code": { + "type": "long" + }, + "ntop_http_method": { + "type": "keyword" + }, + "ntop_http_site": { + "type": "keyword" + }, + "ntop_sip_c_ip": { + "type": "ip" + }, + "ntop_sip_call_state": { + "type": "keyword" + }, + "ntop_rtp_in_mos": { + "type": "long" + }, + "ntop_rtp_in_r_factor": { + "type": "long" + }, + "ntop_src_proc_user": { + "type": "keyword" + }, + "ntop_src_father_proc_pid": { + "type": "long" + }, + "ntop_src_father_proc": { + "type": "keyword" + }, + "ntop_dst_proc_pid": { + "type": "long" + }, + "ntop_dst_proc": { + "type": "keyword" + }, + "ntop_dst_proc_user": { + "type": "keyword" + }, + "ntop_dst_father_proc_pid": { + "type": "long" + }, + "ntop_dst_father_proc": { + "type": "keyword" + }, + "ntop_rtp_rtt": { + "type": "long" + }, + "ntop_rtp_in_transit": { + "type": "long" + }, + "ntop_rtp_out_transit": { + "type": "long" + }, + "ntop_src_proc_actual_memory": { + "type": "long" + }, + "ntop_src_proc_peak_memory": { + "type": "long" + }, + "ntop_src_proc_avg_cpu_load": { + "type": "long" + }, + "ntop_src_proc_page_faults": { + "type": "long" + }, + "ntop_dst_proc_actual_memory": { + "type": "long" + }, + "ntop_dst_proc_peak_memory": { + "type": "long" + }, + "ntop_dst_proc_avg_cpu_load": { + "type": "long" + }, + "ntop_dst_proc_page_faults": { + "type": "long" + }, + "ntop_duration_in": { + "type": "long" + }, + "ntop_duration_out": { + "type": "long" + }, + "ntop_src_proc_pctg_iowait": { + "type": "long" + }, + "ntop_dst_proc_pctg_iowait": { + "type": "long" + }, + "ntop_rtp_dtmf_tones": { + "type": "keyword" + }, + "ntop_untunneled_ipv6_src_addr": { + "type": "ip" + }, + "ntop_untunneled_ipv6_dst_addr": { + "type": "ip" + }, + "ntop_dns_resp": { + "type": "keyword" + }, + "ntop_diameter_req_msg_type": { + "type": "long" + }, + "ntop_diameter_resp_msg_type": { + "type": "long" + }, + "ntop_diameter_req_origin_host": { + "type": "keyword" + }, + "ntop_diameter_resp_origin_host": { + "type": "keyword" + }, + "ntop_diameter_req_user": { + "type": "keyword" + }, + "ntop_diameter_resp_result_code": { + "type": "long" + }, + "ntop_diameter_exp_res_vendor_id": { + "type": "long" + }, + "ntop_diameter_exp_res_result_code": { + "type": "long" + }, + "ntop_s1ap_enb_ue_s1ap_id": { + "type": "long" + }, + "ntop_s1ap_mme_ue_s1ap_id": { + "type": "long" + }, + "ntop_s1ap_msg_emm_type_mme_to_enb": { + "type": "long" + }, + "ntop_s1ap_msg_esm_type_mme_to_enb": { + "type": "long" + }, + "ntop_s1ap_msg_emm_type_enb_to_mme": { + "type": "long" + }, + "ntop_s1ap_msg_esm_type_enb_to_mme": { + "type": "long" + }, + "ntop_s1ap_cause_enb_to_mme": { + "type": "long" + }, + "ntop_s1ap_detailed_cause_enb_to_mme": { + "type": "long" + }, + "ntop_tcp_win_min_in": { + "type": "long" + }, + "ntop_tcp_win_max_in": { + "type": "long" + }, + "ntop_tcp_win_mss_in": { + "type": "long" + }, + "ntop_tcp_win_scale_in": { + "type": "long" + }, + "ntop_tcp_win_min_out": { + "type": "long" + }, + "ntop_tcp_win_max_out": { + "type": "long" + }, + "ntop_tcp_win_mss_out": { + "type": "long" + }, + "ntop_tcp_win_scale_out": { + "type": "long" + }, + "ntop_dhcp_remote_id": { + "type": "keyword" + }, + "ntop_dhcp_subscriber_id": { + "type": "keyword" + }, + "ntop_src_proc_uid": { + "type": "long" + }, + "ntop_dst_proc_uid": { + "type": "long" + }, + "ntop_application": { + "type": "keyword" + }, + "ntop_user": { + "type": "keyword" + }, + "ntop_dhcp_message_type": { + "type": "keyword" + }, + "ntop_rtp_in_packets_drop": { + "type": "long" + }, + "ntop_rtp_out_packets_drop": { + "type": "long" + }, + "ntop_rtp_out_mos": { + "type": "long" + }, + "ntop_rtp_out_r_factor": { + "type": "long" + }, + "ntop_rtp_mos": { + "type": "long" + }, + "ntop_gptv2_s5_s8_gtpc_teid": { + "type": "keyword" + }, + "ntop_rtp_r_factor": { + "type": "long" + }, + "ntop_rtp_ssrc": { + "type": "long" + }, + "ntop_payload_hash": { + "type": "long" + }, + "ntop_gtpv2_c2s_s5_s8_gtpu_teid": { + "type": "long" + }, + "ntop_gtpv2_s2c_s5_s8_gtpu_teid": { + "type": "long" + }, + "ntop_gtpv2_c2s_s5_s8_gtpu_ip": { + "type": "ip" + }, + "ntop_gtpv2_s2c_s5_s8_gtpu_ip": { + "type": "ip" + }, + "ntop_src_as_map": { + "type": "keyword" + }, + "ntop_dst_as_map": { + "type": "keyword" + }, + "ntop_diameter_hop_by_hop_id": { + "type": "long" + }, + "ntop_upstream_sess_id": { + "type": "long" + }, + "ntop_downstream_sess_id": { + "type": "long" + }, + "ntop_src_long": { + "type": "float" + }, + "ntop_src_lat": { + "type": "float" + }, + "ntop_dst_long": { + "type": "float" + }, + "ntop_dst_lat": { + "type": "float" + }, + "ntop_diameter_clr_cancel_type": { + "type": "long" + }, + "ntop_diameter_clr_flags": { + "type": "long" + }, + "ntop_gtpv2_c2s_s5_s8_gtpc_ip": { + "type": "ip" + }, + "ntop_gtpv2_s2c_s5_s8_gtpc_ip": { + "type": "ip" + }, + "ntop_gtpv2_c2s_s5_s8_sgw_gtpu_teid": { + "type": "long" + }, + "ntop_gtpv2_s2c_s5_s8_sgw_gtpu_teid": { + "type": "long" + }, + "ntop_gtpv2_c2s_s5_s8_sgw_gtpu_ip": { + "type": "ip" + }, + "ntop_gtpv2_s2c_s5_s8_sgw_gtpu_ip": { + "type": "ip" + }, + "ntop_http_x_forwarded_for": { + "type": "keyword" + }, + "ntop_http_via": { + "type": "keyword" + }, + "ntop_ssdp_host": { + "type": "keyword" + }, + "ntop_ssdp_usn": { + "type": "keyword" + }, + "ntop_netbios_query": { + "type": "keyword" + }, + "ntop_netbios_query_type": { + "type": "keyword" + }, + "ntop_netbios_resp": { + "type": "keyword" + }, + "ntop_netbios_query_os": { + "type": "keyword" + }, + "ntop_ssdp_server": { + "type": "keyword" + }, + "ntop_ssdp_type": { + "type": "keyword" + }, + "ntop_ssdp_method": { + "type": "keyword" + }, + "ntop_nprobe_ipv4_addr": { + "type": "ip" + }, - "pan_app": { - "type": "keyword" - }, - "pan_user": { - "type": "keyword" - }, + "pan_app": { + "type": "keyword" + }, + "pan_user": { + "type": "keyword" + }, - "riverbed_passthru_reason": { - "type": "keyword" - }, - "riverbed_wan_visibility": { - "type": "keyword" - }, - "riverbed_cfe_inpath_addr": { - "type": "ip" - }, - "riverbed_sfe_inpath_addr": { - "type": "ip" - }, - "riverbed_cfe_tcp_port": { - "type": "long" - }, - "riverbed_cfe_tcp_port_name": { - "type": "keyword" - }, - "riverbed_sfe_tcp_port": { - "type": "long" - }, - "riverbed_sfe_tcp_port_name": { - "type": "keyword" - }, - "riverbed_outer_inpath_addr": { - "type": "ip" - }, - "riverbed_outer_tcp_port": { - "type": "long" - }, - "riverbed_outer_tcp_port_name": { - "type": "keyword" - }, - "riverbed_retrans_packets": { - "type": "long" - }, - "riverbed_retrans_bytes": { - "type": "long" - }, - "riverbed_tcp_conn_rtt": { - "type": "long" - }, - "riverbed_fe_type": { - "type": "keyword" - }, - "riverbed_unk_51130": { - "type": "long" - }, + "riverbed_passthru_reason": { + "type": "keyword" + }, + "riverbed_wan_visibility": { + "type": "keyword" + }, + "riverbed_cfe_inpath_addr": { + "type": "ip" + }, + "riverbed_sfe_inpath_addr": { + "type": "ip" + }, + "riverbed_cfe_tcp_port": { + "type": "long" + }, + "riverbed_cfe_tcp_port_name": { + "type": "keyword" + }, + "riverbed_sfe_tcp_port": { + "type": "long" + }, + "riverbed_sfe_tcp_port_name": { + "type": "keyword" + }, + "riverbed_outer_inpath_addr": { + "type": "ip" + }, + "riverbed_outer_tcp_port": { + "type": "long" + }, + "riverbed_outer_tcp_port_name": { + "type": "keyword" + }, + "riverbed_retrans_packets": { + "type": "long" + }, + "riverbed_retrans_bytes": { + "type": "long" + }, + "riverbed_tcp_conn_rtt": { + "type": "long" + }, + "riverbed_fe_type": { + "type": "keyword" + }, + "riverbed_unk_51130": { + "type": "long" + }, - "streamcore_wan_rtt": { - "type": "long" - }, - "streamcore_net_app_resp_time": { - "type": "long" - }, - "streamcore_total_app_resp_time": { - "type": "long" - }, - "streamcore_tcp_retrans_rate": { - "type": "long" - }, - "streamcore_call_direction": { - "type": "long" - }, - "streamcore_hostname": { - "type": "keyword" - }, - "streamcore_url": { - "type": "keyword" - }, - "streamcore_ssl_cn": { - "type": "keyword" - }, - "streamcore_ssl_org": { - "type": "keyword" - }, - "streamcore_mos_lq": { - "type": "long" - }, - "streamcore_net_delay": { - "type": "long" - }, - "streamcore_net_loss": { - "type": "long" - }, - "streamcore_net_jitter": { - "type": "long" - }, - "streamcore_net_discard": { - "type": "long" - }, - "streamcore_rtp_clockrate_in": { - "type": "long" - }, - "streamcore_rtp_clockrate_out": { - "type": "long" - }, - "streamcore_codec_in": { - "type": "long" - }, - "streamcore_codec_out": { - "type": "long" - }, - "streamcore_id_rule_1": { - "type": "long" - }, - "streamcore_id_rule_2": { - "type": "long" - }, - "streamcore_id_rule_3": { - "type": "long" - }, - "streamcore_id_rule_4": { - "type": "long" - }, - "streamcore_id_rule_5": { - "type": "long" - }, - "streamcore_id_rule_6": { - "type": "long" - }, - "streamcore_id_rule_7": { - "type": "long" - }, - "streamcore_id_rule_8": { - "type": "long" - }, - "streamcore_id_rule_9": { - "type": "long" - }, - "streamcore_id_rule_10": { - "type": "long" - } + "streamcore_wan_rtt": { + "type": "long" + }, + "streamcore_net_app_resp_time": { + "type": "long" + }, + "streamcore_total_app_resp_time": { + "type": "long" + }, + "streamcore_tcp_retrans_rate": { + "type": "long" + }, + "streamcore_call_direction": { + "type": "long" + }, + "streamcore_hostname": { + "type": "keyword" + }, + "streamcore_url": { + "type": "keyword" + }, + "streamcore_ssl_cn": { + "type": "keyword" + }, + "streamcore_ssl_org": { + "type": "keyword" + }, + "streamcore_mos_lq": { + "type": "long" + }, + "streamcore_net_delay": { + "type": "long" + }, + "streamcore_net_loss": { + "type": "long" + }, + "streamcore_net_jitter": { + "type": "long" + }, + "streamcore_net_discard": { + "type": "long" + }, + "streamcore_rtp_clockrate_in": { + "type": "long" + }, + "streamcore_rtp_clockrate_out": { + "type": "long" + }, + "streamcore_codec_in": { + "type": "long" + }, + "streamcore_codec_out": { + "type": "long" + }, + "streamcore_id_rule_1": { + "type": "long" + }, + "streamcore_id_rule_2": { + "type": "long" + }, + "streamcore_id_rule_3": { + "type": "long" + }, + "streamcore_id_rule_4": { + "type": "long" + }, + "streamcore_id_rule_5": { + "type": "long" + }, + "streamcore_id_rule_6": { + "type": "long" + }, + "streamcore_id_rule_7": { + "type": "long" + }, + "streamcore_id_rule_8": { + "type": "long" + }, + "streamcore_id_rule_9": { + "type": "long" + }, + "streamcore_id_rule_10": { + "type": "long" } - }, + } + }, - "sflow": { - "dynamic": true, - "type": "object", - "properties": { - "agent_ip": { - "type": "ip" - }, - "drops": { - "type": "long" - }, - "dst_ip": { - "type": "ip" - }, - "dst_mac": { - "type": "keyword" - }, - "dst_mask_len": { - "type": "long" - }, - "dst_port": { - "type": "long" - }, - "dst_priority": { - "type": "long" - }, - "dst_vlan": { - "type": "long" - }, - "eth_dst": { - "type": "keyword" - }, - "eth_src": { - "type": "keyword" - }, - "eth_type": { - "type": "long" - }, - "flow_sequence_number": { - "type": "long" - }, - "frame_length": { - "type": "long" - }, - "frame_length_times_sampling_rate": { - "type": "long" - }, - "header_size": { - "type": "long" - }, - "input_interface": { - "type": "long" - }, - "input_interface_format": { - "type": "long" - }, - "input_interface_value": { - "type": "long" - }, - "ip_address_next_hop_router": { - "type": "ip" - }, - "ip_checksum": { - "type": "long" - }, - "ip_dscp": { - "type": "long" - }, - "ip_ecn": { - "type": "long" - }, - "ip_flags": { - "type": "long" - }, - "ip_fragment_offset": { - "type": "long" - }, - "ip_header_length": { - "type": "long" - }, - "ip_identification": { - "type": "long" - }, - "ip_next_header": { - "type": "long" - }, - "ip_options": { - "type": "long" - }, - "ip_packet_length": { - "type": "long" - }, - "ip_priority": { - "type": "long" - }, - "ip_protocol": { - "type": "long" - }, - "ip_total_length": { - "type": "long" - }, - "ip_ttl": { - "type": "long" - }, - "ip_type": { - "type": "long" - }, - "ip_version": { - "type": "long" - }, - "output_interface": { - "type": "long" - }, - "output_interface_format": { - "type": "long" - }, - "output_interface_value": { - "type": "long" - }, - "packet_length": { - "type": "long" - }, - "padded": { - "type": "long" - }, - "protocol": { - "type": "keyword" - }, - "protocol_name": { - "type": "keyword" - }, - "sample_length": { - "type": "long" - }, - "sample_pool": { - "type": "long" - }, - "sample_seq_number": { - "type": "long" - }, - "sampling_rate": { - "type": "long" - }, - "sequence_number": { - "type": "long" - }, - "sflow_type": { - "type": "keyword" - }, - "sflow_version": { - "type": "long" - }, - "size_header": { - "type": "long" - }, - "source_id_index": { - "type": "long" - }, - "source_id_index_name": { - "type": "keyword" - }, - "source_id_type": { - "type": "keyword" - }, - "src_ip": { - "type": "ip" - }, - "src_mac": { - "type": "keyword" - }, - "src_mask_len": { - "type": "long" - }, - "src_port": { - "type": "long" - }, - "src_priority": { - "type": "long" - }, - "src_vlan": { - "type": "long" - }, - "stripped": { - "type": "long" - }, - "sub_agent_id": { - "type": "long" - }, - "tcp_ack_number": { - "type": "long" - }, - "tcp_checksum": { - "type": "long" - }, - "tcp_flags": { - "type": "long" - }, - "tcp_header_length": { - "type": "long" - }, - "tcp_is_ack": { - "type": "integer" - }, - "tcp_is_cwr": { - "type": "integer" - }, - "tcp_is_ecn_echo": { - "type": "integer" - }, - "tcp_is_fin": { - "type": "integer" - }, - "tcp_is_nonce": { - "type": "integer" - }, - "tcp_is_push": { - "type": "integer" - }, - "tcp_is_reset": { - "type": "integer" - }, - "tcp_is_syn": { - "type": "integer" - }, - "tcp_is_urgent": { - "type": "integer" - }, - "tcp_options": { - "type": "long" - }, - "tcp_reserved": { - "type": "long" - }, - "tcp_seq_number": { - "type": "long" - }, - "tcp_urgent_pointer": { - "type": "long" - }, - "tcp_window_size": { - "type": "long" - }, - "udp_checksum": { - "type": "long" - }, - "udp_length": { - "type": "long" - }, - "uptime_in_ms": { - "type": "long" - }, - "vlan_cfi": { - "type": "long" - }, - "vlan_id": { - "type": "long" - }, - "vlan_priority": { - "type": "long" - }, - "vlan_type": { - "type": "long" - } + "sflow": { + "dynamic": true, + "type": "object", + "properties": { + "agent_ip": { + "type": "ip" + }, + "drops": { + "type": "long" + }, + "dst_ip": { + "type": "ip" + }, + "dst_mac": { + "type": "keyword" + }, + "dst_mask_len": { + "type": "long" + }, + "dst_port": { + "type": "long" + }, + "dst_priority": { + "type": "long" + }, + "dst_vlan": { + "type": "long" + }, + "eth_dst": { + "type": "keyword" + }, + "eth_src": { + "type": "keyword" + }, + "eth_type": { + "type": "long" + }, + "flow_sequence_number": { + "type": "long" + }, + "frame_length": { + "type": "long" + }, + "frame_length_times_sampling_rate": { + "type": "long" + }, + "header_size": { + "type": "long" + }, + "input_interface": { + "type": "long" + }, + "input_interface_format": { + "type": "long" + }, + "input_interface_value": { + "type": "long" + }, + "ip_address_next_hop_router": { + "type": "ip" + }, + "ip_checksum": { + "type": "long" + }, + "ip_dscp": { + "type": "long" + }, + "ip_ecn": { + "type": "long" + }, + "ip_flags": { + "type": "long" + }, + "ip_fragment_offset": { + "type": "long" + }, + "ip_header_length": { + "type": "long" + }, + "ip_identification": { + "type": "long" + }, + "ip_next_header": { + "type": "long" + }, + "ip_options": { + "type": "long" + }, + "ip_packet_length": { + "type": "long" + }, + "ip_priority": { + "type": "long" + }, + "ip_protocol": { + "type": "long" + }, + "ip_total_length": { + "type": "long" + }, + "ip_ttl": { + "type": "long" + }, + "ip_type": { + "type": "long" + }, + "ip_version": { + "type": "long" + }, + "output_interface": { + "type": "long" + }, + "output_interface_format": { + "type": "long" + }, + "output_interface_value": { + "type": "long" + }, + "packet_length": { + "type": "long" + }, + "padded": { + "type": "long" + }, + "protocol": { + "type": "keyword" + }, + "protocol_name": { + "type": "keyword" + }, + "sample_length": { + "type": "long" + }, + "sample_pool": { + "type": "long" + }, + "sample_seq_number": { + "type": "long" + }, + "sampling_rate": { + "type": "long" + }, + "sequence_number": { + "type": "long" + }, + "sflow_type": { + "type": "keyword" + }, + "sflow_version": { + "type": "long" + }, + "size_header": { + "type": "long" + }, + "source_id_index": { + "type": "long" + }, + "source_id_index_name": { + "type": "keyword" + }, + "source_id_type": { + "type": "keyword" + }, + "src_ip": { + "type": "ip" + }, + "src_mac": { + "type": "keyword" + }, + "src_mask_len": { + "type": "long" + }, + "src_port": { + "type": "long" + }, + "src_priority": { + "type": "long" + }, + "src_vlan": { + "type": "long" + }, + "stripped": { + "type": "long" + }, + "sub_agent_id": { + "type": "long" + }, + "tcp_ack_number": { + "type": "long" + }, + "tcp_checksum": { + "type": "long" + }, + "tcp_flags": { + "type": "long" + }, + "tcp_header_length": { + "type": "long" + }, + "tcp_is_ack": { + "type": "integer" + }, + "tcp_is_cwr": { + "type": "integer" + }, + "tcp_is_ecn_echo": { + "type": "integer" + }, + "tcp_is_fin": { + "type": "integer" + }, + "tcp_is_nonce": { + "type": "integer" + }, + "tcp_is_push": { + "type": "integer" + }, + "tcp_is_reset": { + "type": "integer" + }, + "tcp_is_syn": { + "type": "integer" + }, + "tcp_is_urgent": { + "type": "integer" + }, + "tcp_options": { + "type": "long" + }, + "tcp_reserved": { + "type": "long" + }, + "tcp_seq_number": { + "type": "long" + }, + "tcp_urgent_pointer": { + "type": "long" + }, + "tcp_window_size": { + "type": "long" + }, + "udp_checksum": { + "type": "long" + }, + "udp_length": { + "type": "long" + }, + "uptime_in_ms": { + "type": "long" + }, + "vlan_cfi": { + "type": "long" + }, + "vlan_id": { + "type": "long" + }, + "vlan_priority": { + "type": "long" + }, + "vlan_type": { + "type": "long" } } }