- Packetbeat Reference: other versions:
- Overview
- Getting started with Packetbeat
- Setting up and running Packetbeat
- Upgrading Packetbeat
- Configuring Packetbeat
- Set traffic capturing options
- Set up flows to monitor network traffic
- Specify which transaction protocols to monitor
- Specify which processes to monitor
- Specify general settings
- Configure the internal queue
- Configure the output
- Specify SSL settings
- Filter and enhance the exported data
- Parse data by using ingest node
- Export GeoIP Information
- Set up project paths
- Set up the Kibana endpoint
- Load the Kibana dashboards
- Load the Elasticsearch index template
- Configure logging
- Use environment variables in the configuration
- YAML tips and gotchas
- HTTP Endpoint
- packetbeat.reference.yml
- Exported fields
- AMQP fields
- Beat fields
- Cassandra fields
- Cloud provider metadata fields
- Common fields
- DNS fields
- Docker fields
- Flow Event fields
- Host fields
- HTTP fields
- ICMP fields
- Kubernetes fields
- Memcache fields
- MongoDb fields
- MySQL fields
- NFS fields
- PostgreSQL fields
- Raw fields
- Redis fields
- Thrift-RPC fields
- TLS fields
- Transaction Event fields
- Measurements (Transactions) fields
- Monitoring Packetbeat
- Securing Packetbeat
- Visualizing Packetbeat data in Kibana
- Troubleshooting
- Contributing to Beats
Memcache fields
editMemcache fields
editMemcached-specific event fields
-
memcache.protocol_type -
type: keyword
The memcache protocol implementation. The value can be "binary" for binary-based, "text" for text-based, or "unknown" for an unknown memcache protocol type.
-
memcache.request.line -
type: keyword
The raw command line for unknown commands ONLY.
-
memcache.request.command -
type: keyword
The memcache command being requested in the memcache text protocol. For example "set" or "get". The binary protocol opcodes are translated into memcache text protocol commands.
-
memcache.response.command -
type: keyword
Either the text based protocol response message type or the name of the originating request if binary protocol is used.
-
memcache.request.type -
type: keyword
The memcache command classification. This value can be "UNKNOWN", "Load", "Store", "Delete", "Counter", "Info", "SlabCtrl", "LRUCrawler", "Stats", "Success", "Fail", or "Auth".
-
memcache.response.type -
type: keyword
The memcache command classification. This value can be "UNKNOWN", "Load", "Store", "Delete", "Counter", "Info", "SlabCtrl", "LRUCrawler", "Stats", "Success", "Fail", or "Auth". The text based protocol will employ any of these, whereas the binary based protocol will mirror the request commands only (see
memcache.response.statusfor binary protocol). -
memcache.response.error_msg -
type: keyword
The optional error message in the memcache response (text based protocol only).
-
memcache.request.opcode -
type: keyword
The binary protocol message opcode name.
-
memcache.response.opcode -
type: keyword
The binary protocol message opcode name.
-
memcache.request.opcode_value -
type: long
The binary protocol message opcode value.
-
memcache.response.opcode_value -
type: long
The binary protocol message opcode value.
-
memcache.request.opaque -
type: long
The binary protocol opaque header value used for correlating request with response messages.
-
memcache.response.opaque -
type: long
The binary protocol opaque header value used for correlating request with response messages.
-
memcache.request.vbucket -
type: long
The vbucket index sent in the binary message.
-
memcache.response.status -
type: keyword
The textual representation of the response error code (binary protocol only).
-
memcache.response.status_code -
type: long
The status code value returned in the response (binary protocol only).
-
memcache.request.keys -
type: array
The list of keys sent in the store or load commands.
-
memcache.response.keys -
type: array
The list of keys returned for the load command (if present).
-
memcache.request.count_values -
type: long
The number of values found in the memcache request message. If the command does not send any data, this field is missing.
-
memcache.response.count_values -
type: long
The number of values found in the memcache response message. If the command does not send any data, this field is missing.
-
memcache.request.values -
type: array
The list of base64 encoded values sent with the request (if present).
-
memcache.response.values -
type: array
The list of base64 encoded values sent with the response (if present).
-
memcache.request.bytes -
type: long
format: bytes
The byte count of the values being transferred.
-
memcache.response.bytes -
type: long
format: bytes
The byte count of the values being transferred.
-
memcache.request.delta -
type: long
The counter increment/decrement delta value.
-
memcache.request.initial -
type: long
The counter increment/decrement initial value parameter (binary protocol only).
-
memcache.request.verbosity -
type: long
The value of the memcache "verbosity" command.
-
memcache.request.raw_args -
type: keyword
The text protocol raw arguments for the "stats …" and "lru crawl …" commands.
-
memcache.request.source_class -
type: long
The source class id in slab reassign command.
-
memcache.request.dest_class -
type: long
The destination class id in slab reassign command.
-
memcache.request.automove -
type: keyword
The automove mode in the slab automove command expressed as a string. This value can be "standby"(=0), "slow"(=1), "aggressive"(=2), or the raw value if the value is unknown.
-
memcache.request.flags -
type: long
The memcache command flags sent in the request (if present).
-
memcache.response.flags -
type: long
The memcache message flags sent in the response (if present).
-
memcache.request.exptime -
type: long
The data expiry time in seconds sent with the memcache command (if present). If the value is <30 days, the expiry time is relative to "now", or else it is an absolute Unix time in seconds (32-bit).
-
memcache.request.sleep_us -
type: long
The sleep setting in microseconds for the lru_crawler sleep command.
-
memcache.response.value -
type: long
The counter value returned by a counter operation.
-
memcache.request.noreply -
type: boolean
Set to true if noreply was set in the request. The
memcache.responsefield will be missing. -
memcache.request.quiet -
type: boolean
Set to true if the binary protocol message is to be treated as a quiet message.
-
memcache.request.cas_unique -
type: long
The CAS (compare-and-swap) identifier if present.
-
memcache.response.cas_unique -
type: long
The CAS (compare-and-swap) identifier to be used with CAS-based updates (if present).
-
memcache.response.stats -
type: array
The list of statistic values returned. Each entry is a dictionary with the fields "name" and "value".
-
memcache.response.version -
type: keyword
The returned memcache version string.