IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Cloud provider metadata fields DHCPv4 fields »
Elastic Docs ›Packetbeat Reference [6.6] ›Exported fields

Common fields

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Common fields

edit

These fields contain data about the environment in which the transaction or flow was captured.

server

The name of the server that served the transaction.

client_server

The name of the server that initiated the transaction.

service

The name of the logical service that served the transaction.

client_service

The name of the logical service that initiated the transaction.

ip

format: dotted notation.

The IP address of the server that served the transaction.

client_ip

format: dotted notation.

The IP address of the server that initiated the transaction.

real_ip

format: Dotted notation.

If the server initiating the transaction is a proxy, this field contains the original client IP address. For HTTP, for example, the IP address extracted from a configurable HTTP header, by default X-Forwarded-For. Unless this field is disabled, it always has a value, and it matches the client_ip for non proxy clients.

client_geoip fields

edit

The GeoIP information of the client.

client_geoip.location

type: geo_point

example: {lat: 51, lon: 9}

The GeoIP location of the client_ip address. This field is available only if you define a GeoIP Processor as a pipeline in the Ingest GeoIP processor plugin or using Logstash.

client_port

format: dotted notation.

The layer 4 port of the process that initiated the transaction.

transport

example: udp

The transport protocol used for the transaction. If not specified, then tcp is assumed.

type

required: True

The type of the transaction (for example, HTTP, MySQL, Redis, or RUM) or "flow" in case of flows.

port

format: dotted notation.

The layer 4 port of the process that served the transaction.

proc

The name of the process that served the transaction.

cmdline

The command-line of the process that served the transaction.

client_proc

The name of the process that initiated the transaction.

client_cmdline

The command-line of the process that initiated the transaction.

release

The software release of the service serving the transaction. This can be the commit id or a semantic version.

« Cloud provider metadata fields DHCPv4 fields »