sample-config.yaml

server:
  port: 9001
  metricsPort: 9002
  authCheck: none
loki:
  url: http://localhost:3100
  labels:
    - SrcK8S_Namespace
    - SrcK8S_OwnerName
    - SrcK8S_Type
    - DstK8S_Namespace
    - DstK8S_OwnerName
    - DstK8S_Type
    - K8S_FlowLayer
    - FlowDirection
    #    - _RecordType
    #    - K8S_ClusterName
    #    - SrcK8S_Zone
    #    - DstK8S_Zone
  tenantID: netobserv
  useMocks: false
prometheus:
  url: https://localhost:9090
  timeout: 30s
  skipTls: true
  # tokenPath: /tmp/oc-token.txt
  alertManager:
  # url: https://localhost:9094
  metrics:
    - enabled: false
      name: netobserv_node_egress_bytes_total
      type: counter
      valueField: Bytes
      labels:
        - SrcK8S_HostName
        - DstK8S_HostName
    - enabled: true
      name: netobserv_node_ingress_bytes_total
      type: counter
      valueField: Bytes
      labels:
        - SrcK8S_HostName
        - DstK8S_HostName
frontend:
  recordTypes:
    - flowLog
  #  - newConnection
  #  - heartbeat
  #  - endConnection
  features:
  # eBPF agent features
  #  - pktDrop
  #  - dnsTracking
  #  - flowRTT
  #  - multiNetworks
  #  - packetTranslation
  # processor features
  #  - multiCluster
  #  - zones
  portNaming:
    enable: true
    portNames:
      "3100": loki
  quickFilters:
    - name: Applications
      filter:
        flow_layer: 'app'
      default: true
    - name: Infrastructure
      filter:
        flow_layer: 'infra'
    - name: Pods network
      filter:
        src_kind: 'Pod'
        dst_kind: 'Pod'
      default: true
    - name: Services network
      filter:
        dst_kind: 'Service'
    - name: DNS
      filter:
        dns_id!: '0'
  alertNamespaces:
    - netobserv
  sampling: 50
  healthRules:
    - template: PacketDropsByKernel
      mode: recording
      description: Packet drops by kernel
      summary: Percentage of packets dropped by kernel
      variants:
        - groupBy: Namespace
          lowVolumeThreshold: "5"
          thresholds:
            info: "10"
            warning: "20"
        - groupBy: Node
          thresholds:
            info: "5"
            warning: "10"
    - template: PacketDropsByDevice
      mode: recording
      description: Packet drops by network device
      summary: Percentage of packets dropped at device level
      variants:
        - groupBy: Node
          thresholds:
            warning: "5"
    - template: DNSErrors
      mode: recording
      description: DNS resolution errors
      summary: Percentage of failed DNS queries
      variants:
        - groupBy: ""
          thresholds:
            warning: "5"
        - groupBy: Namespace
          thresholds:
            info: "5"
            warning: "10"
    - template: DNSNxDomain
      mode: recording
      description: DNS NXDOMAIN responses
      summary: Percentage of DNS queries returning NXDOMAIN
      variants:
        - groupBy: Namespace
          thresholds:
            info: "10"
            warning: "80"
    - template: NetpolDenied
      mode: recording
      description: Network policy denials
      summary: Percentage of flows denied by network policies
      variants:
        - groupBy: Namespace
          thresholds:
            info: "5"
            warning: "10"
    - template: LatencyHighTrend
      mode: recording
      description: Latency trending high
      summary: RTT increase compared to baseline
      variants:
        - groupBy: Namespace
          thresholds:
            info: "100"
    - template: ExternalEgressHighTrend
      mode: recording
      description: External egress trending high
      summary: Egress to external endpoints increase
      variants:
        - groupBy: Node
          thresholds:
            warning: "200"
        - groupBy: Namespace
          thresholds:
            info: "100"
            warning: "500"
    - template: ExternalIngressHighTrend
      mode: recording
      description: External ingress trending high
      summary: Ingress from external endpoints increase
      variants:
        - groupBy: Node
          thresholds:
            warning: "200"
        - groupBy: Namespace
          thresholds:
            info: "100"
            warning: "500"
  # The following configuration is taken from Network Observability Operator
  # see https://github.com/netobserv/network-observability-operator/blob/main/controllers/consoleplugin/config/static-frontend-config.yaml
  panels:
    # Protocol
    - Proto_Bytes
    - sum_Proto_Bytes
    - avg_Proto_Bytes
    - Proto_Packets
    - sum_Proto_Packets
    - avg_Proto_Packets
    - Proto_Flows
    # DSCP
    - Dscp_Bytes
    - Dscp_Packets
    - min_Dscp_TimeFlowRttNs
    - max_Dscp_TimeFlowRttNs
    - avg_Dscp_TimeFlowRttNs
    - p90_Dscp_TimeFlowRttNs
    - p99_Dscp_TimeFlowRttNs
    - min_Dscp_DnsLatencyMs
    - max_Dscp_DnsLatencyMs
    - avg_Dscp_DnsLatencyMs
    - p90_Dscp_DnsLatencyMs
    - p99_Dscp_DnsLatencyMs
    - Dscp_Flows
    # Port numbers
    - SrcPort_Bytes
    - sum_SrcPort_Bytes
    - SrcPort_Packets
    - sum_SrcPort_Packets
    - SrcPort_TimeFlowRttNs
    - min_SrcPort_TimeFlowRttNs
    - max_SrcPort_TimeFlowRttNs
    - avg_SrcPort_TimeFlowRttNs
    - p90_SrcPort_TimeFlowRttNs
    - p99_SrcPort_TimeFlowRttNs
    - DstPort_Bytes
    - sum_DstPort_Bytes
    - DstPort_Packets
    - sum_DstPort_Packets
    - min_DstPort_TimeFlowRttNs
    - max_DstPort_TimeFlowRttNs
    - avg_DstPort_TimeFlowRttNs
    - p90_DstPort_TimeFlowRttNs
    - p99_DstPort_TimeFlowRttNs
    # Node Directions
    - FlowDirection_Bytes
    - FlowDirection_Packets
    - FlowDirection_Flows
    # DNS capture errors
    - DnsErrno_Flows
    # Connection tracking flow count
    - numFlowLogs_Flows
    # Bytes / Packets rates on current scope
    - Bytes
    - Packets
    # flow on current scope
    - Flows
    - DnsFlows
    # TODO: implement a way to manage plurals for interfaces and UDNs
    # Interfaces Directions
    #- IfDirections_Bytes
    #- IfDirections_Packets
    #- IfDirections_Flows
    # Interfaces names
    #- Interfaces_Bytes
    #- sum_Interfaces_Bytes
    #- avg_Interfaces_Bytes
    #- Interfaces_Packets
    #- sum_Interfaces_Packets
    #- avg_Interfaces_Packets
    #- Interfaces_Flows
    # Udns
    #- Udns_Bytes
    #- Udns_Packets
    #- min_Udns_TimeFlowRttNs
    #- max_Udns_TimeFlowRttNs
    #- avg_Udns_TimeFlowRttNs
    #- p90_Udns_TimeFlowRttNs
    #- p99_Udns_TimeFlowRttNs
    #- min_Udns_DnsLatencyMs
    #- max_Udns_DnsLatencyMs
    #- avg_Udns_DnsLatencyMs
    #- p90_Udns_DnsLatencyMs
    #- p99_Udns_DnsLatencyMs
    #- Udns_Flows
  columns:
    - id: StartTime
      name: Start Time
      tooltip: Time of the first packet observed. Unlike End Time, it is not used in queries to select records in an interval.
      field: TimeFlowStartMs
      default: false
      width: 15
    - id: EndTime
      name: End Time
      tooltip: Time of the last packet observed. This is what is used in queries to select records in an interval.
      field: TimeFlowEndMs
      default: true
      width: 15
    - id: RecordType
      name: Event / Type
      field: _RecordType
      filter: type
      default: true
      width: 15
    - id: _HashId
      name: Conversation Id
      field: _HashId
      filter: id
      default: true
      width: 15
    - id: ClusterName
      name: Cluster
      tooltip: The cluster ID or Name.
      field: K8S_ClusterName
      filter: cluster_name
      default: false
      width: 15
      feature: multiCluster
    - id: SrcK8S_Name
      group: Source
      name: Name
      tooltip: The source name of the related kubernetes resource.
      docURL: http://kubernetes.io/docs/user-guide/identifiers#names
      field: SrcK8S_Name
      filter: src_name
      calculated: kubeObject(SrcK8S_Type,SrcK8S_Namespace,SrcK8S_Name,0)
      default: true
      width: 15
    - id: SrcK8S_Type
      group: Source
      name: Kind
      tooltip: |-
        The  kind of the related kubernetes resource. Examples:
              - Pod
              - Service
              - Node
      field: SrcK8S_Type
      filter: src_kind
      default: false
      width: 10
    - id: SrcK8S_OwnerName
      group: Source
      name: Owner
      tooltip: The source owner name of the related kubernetes resource.
      docURL: https://kubernetes.io/docs/concepts/overview/working-with-objects/owners-dependents/
      field: SrcK8S_OwnerName
      filter: src_owner_name
      calculated: kubeObject(SrcK8S_OwnerType,SrcK8S_Namespace,SrcK8S_OwnerName,0)
      default: false
      width: 15
    - id: SrcK8S_OwnerType
      group: Source
      name: Owner Kind
      tooltip: |-
        The  owner kind of the related kubernetes resource. Examples:
              - Deployment
              - StatefulSet
              - DaemonSet
              - Job
              - CronJob
      field: SrcK8S_OwnerType
      filter: src_kind
      default: false
      width: 10
    - id: SrcK8S_Namespace
      group: Source
      name: Namespace
      tooltip: The source namespace of the related kubernetes resource.
      docURL: http://kubernetes.io/docs/user-guide/identifiers#namespaces
      field: SrcK8S_Namespace
      filter: src_namespace
      calculated: kubeObject('Namespace','',SrcK8S_Namespace,0)
      default: true
      width: 15
    - id: SrcAddr
      group: Source
      name: IP
      tooltip: The source IP address. Can be either in IPv4 or IPv6 format.
      field: SrcAddr
      filter: src_address
      default: false
      width: 10
    - id: SrcPort
      group: Source
      name: Port
      tooltip: The source port number.
      field: SrcPort
      filter: src_port
      default: true
      width: 10
    - id: SrcMac
      group: Source
      name: MAC
      tooltip: The source MAC address.
      field: SrcMac
      filter: src_mac
      default: false
      width: 10
    - id: SrcK8S_HostIP
      group: Source
      name: Node IP
      tooltip: The source node IP address. Can be either in IPv4 or IPv6 format.
      field: SrcK8S_HostIP
      filter: src_host_address
      default: false
      width: 10
    - id: SrcK8S_HostName
      group: Source
      name: Node Name
      tooltip: The source name of the node running the workload.
      docURL: https://kubernetes.io/docs/concepts/architecture/nodes/
      field: SrcK8S_HostName
      filter: src_host_name
      calculated: kubeObject('Node','',SrcK8S_HostName,0)
      default: false
      width: 15
    - id: SrcK8S_Object
      group: Source
      name: Kubernetes Object
      calculated: kubeObject(SrcK8S_Type,SrcK8S_Namespace,SrcK8S_Name,1) or concat(SrcAddr,':',SrcPort)
      default: false
      width: 15
    - id: SrcK8S_OwnerObject
      group: Source
      name: Owner Kubernetes Object
      calculated: kubeObject(SrcK8S_OwnerType,SrcK8S_Namespace,SrcK8S_OwnerName,1)
      default: false
      width: 15
    - id: SrcAddrPort
      group: Source
      name: IP & Port
      calculated: concat(SrcAddr,':',SrcPort)
      default: false
      width: 15
    - id: SrcZone
      group: Source
      name: Zone
      field: SrcK8S_Zone
      filter: src_zone
      default: false
      width: 15
      feature: zones
    - id: SrcSubnetLabel
      group: Source
      name: Subnet Label
      field: SrcSubnetLabel
      filter: src_subnet_label
      default: false
      width: 10
      feature: subnetLabels
    - id: SrcNetworkName
      group: Source
      name: Network Name
      tooltip: Network name, such as Secondary network or UDN.
      field: SrcK8S_NetworkName
      filter: src_network
      default: true
      width: 15
      feature: multiNetworks
    - id: DstK8S_Name
      group: Destination
      name: Name
      tooltip: The destination name of the related kubernetes resource.
      docURL: http://kubernetes.io/docs/user-guide/identifiers#names
      field: DstK8S_Name
      filter: dst_name
      calculated: kubeObject(DstK8S_Type,DstK8S_Namespace,DstK8S_Name,0)
      default: true
      width: 15
    - id: DstK8S_Type
      group: Destination
      name: Kind
      tooltip: |-
        The  kind of the related kubernetes resource. Examples:
              - Pod
              - Service
              - Node
      field: DstK8S_Type
      filter: dst_kind
      default: false
      width: 10
    - id: DstK8S_OwnerName
      group: Destination
      name: Owner
      tooltip: The destination owner name of the related kubernetes resource.
      docURL: https://kubernetes.io/docs/concepts/overview/working-with-objects/owners-dependents/
      field: DstK8S_OwnerName
      filter: dst_owner_name
      calculated: kubeObject(DstK8S_OwnerType,DstK8S_Namespace,DstK8S_OwnerName,0)
      default: false
      width: 15
    - id: DstK8S_OwnerType
      group: Destination
      name: Owner Kind
      tooltip: |-
        The  owner kind of the related kubernetes resource. Examples:
              - Deployment
              - StatefulSet
              - DaemonSet
              - Job
              - CronJob
      field: DstK8S_OwnerType
      filter: dst_kind
      default: false
      width: 10
    - id: DstK8S_Namespace
      group: Destination
      name: Namespace
      tooltip: The destination namespace of the related kubernetes resource.
      docURL: http://kubernetes.io/docs/user-guide/identifiers#namespaces
      field: DstK8S_Namespace
      filter: dst_namespace
      calculated: kubeObject('Namespace','',DstK8S_Namespace,0)
      default: true
      width: 15
    - id: DstAddr
      group: Destination
      name: IP
      tooltip: The destination IP address. Can be either in IPv4 or IPv6 format.
      field: DstAddr
      filter: dst_address
      default: false
      width: 10
    - id: DstPort
      group: Destination
      name: Port
      tooltip: The destination port number.
      field: DstPort
      filter: dst_port
      default: true
      width: 10
    - id: DstMac
      group: Destination
      name: MAC
      tooltip: The destination MAC address.
      field: DstMac
      filter: dst_mac
      default: false
      width: 10
    - id: DstK8S_HostIP
      group: Destination
      name: Node IP
      tooltip: The destination node IP address. Can be either in IPv4 or IPv6 format.
      field: DstK8S_HostIP
      filter: dst_host_address
      default: false
      width: 10
    - id: DstK8S_HostName
      group: Destination
      name: Node Name
      tooltip: The destination name of the node running the workload.
      docURL: https://kubernetes.io/docs/concepts/architecture/nodes/
      field: DstK8S_HostName
      filter: dst_host_name
      calculated: kubeObject('Node','',DstK8S_HostName,0)
      default: false
      width: 15
    - id: DstK8S_Object
      group: Destination
      name: Kubernetes Object
      calculated: kubeObject(DstK8S_Type,DstK8S_Namespace,DstK8S_Name,1) or concat(DstAddr,':',DstPort)
      default: false
      width: 15
    - id: DstK8S_OwnerObject
      group: Destination
      name: Owner Kubernetes Object
      calculated: kubeObject(DstK8S_OwnerType,DstK8S_Namespace,DstK8S_OwnerName,1)
      default: false
      width: 15
    - id: DstAddrPort
      group: Destination
      name: IP & Port
      calculated: concat(DstAddr,':',DstPort)
      default: false
      width: 15
    - id: DstZone
      group: Destination
      name: Zone
      field: DstK8S_Zone
      filter: dst_zone
      default: false
      width: 15
      feature: zones
    - id: DstSubnetLabel
      group: Destination
      name: Subnet Label
      field: DstSubnetLabel
      filter: dst_subnet_label
      default: false
      width: 10
      feature: subnetLabels
    - id: DstNetworkName
      group: Destination
      name: Network Name
      tooltip: Network name, such as Secondary network or UDN.
      field: DstK8S_NetworkName
      filter: dst_network
      default: true
      width: 15
      feature: multiNetworks
    - id: K8S_Name
      name: Names
      calculated: '[SrcK8S_Name,DstK8S_Name]'
      filter: name
      default: false
      width: 15
    - id: K8S_Type
      name: Kinds
      calculated: '[SrcK8S_Type,DstK8S_Type]'
      filter: kind
      default: false
      width: 10
    - id: K8S_OwnerName
      name: Owners
      calculated: '[SrcK8S_OwnerName,DstK8S_OwnerName]'
      filter: owner_name
      default: false
      width: 15
    - id: K8S_OwnerType
      name: Owner Kinds
      calculated: '[SrcK8S_OwnerType,DstK8S_OwnerType]'
      filter: kind
      default: false
      width: 10
    - id: K8S_Namespace
      name: Namespaces
      calculated: '[SrcK8S_Namespace,DstK8S_Namespace]'
      filter: namespace
      default: false
      width: 15
    - id: Addr
      name: IP
      calculated: '[SrcAddr,DstAddr]'
      filter: address
      default: false
      width: 10
    - id: Port
      name: Ports
      calculated: '[SrcPort,DstPort]'
      filter: port
      default: false
      width: 10
    - id: Mac
      name: MAC
      calculated: '[SrcMac,DstMac]'
      filter: mac
      default: false
      width: 10
    - id: K8S_HostIP
      name: Node IP
      calculated: '[SrcK8S_HostIP,DstK8S_HostIP]'
      filter: host_address
      default: false
      width: 10
    - id: Sampling
      name: Sampling
      field: Sampling
      default: false
      width: 10
    - id: K8S_HostName
      name: Node Name
      calculated: '[SrcK8S_HostName,DstK8S_HostName]'
      filter: host_name
      default: false
      width: 15
    - id: K8S_Object
      name: Kubernetes Objects
      calculated: '[column.SrcK8S_Object,column.DstK8S_Object]'
      filter: resource
      default: false
      width: 15
    - id: K8S_OwnerObject
      name: Owner Kubernetes Objects
      calculated: '[column.SrcK8S_OwnerObject,column.DstK8S_OwnerObject]'
      filter: resource
      default: false
      width: 15
    - id: K8S_FlowLayer
      name: Flow layer
      field: K8S_FlowLayer
      filter: flow_layer
      default: false
      width: 15
    - id: AddrPort
      name: IPs & Ports
      calculated: '[column.SrcAddrPort,column.DstAddrPort]'
      default: false
      width: 15
    - id: Proto
      group: Protocol Info
      name: Protocol
      tooltip: The value of the protocol number in the IP packet header
      field: Proto
      filter: protocol
      default: true
      width: 10
    - id: Dscp
      group: Protocol Info
      name: DSCP
      tooltip: The value of the Differentiated Services Code Point
      field: Dscp
      filter: dscp
      default: false
      width: 10
    - id: TCPFlags
      group: Protocol Info
      name: TCP Flags
      tooltip: Logical OR combination of unique TCP flags comprised in the flow, according to RFC-9293, with additional custom values.
      field: Flags
      filter: tcp_flags
      default: false
      width: 10
    - id: TLSVersion
      group: Protocol Info
      name: TLS Version
      tooltip: TLS version found in handshake headers
      field: TLSVersion
      filter: tls_version
      default: true
      width: 10
      feature: tlsTracking
    - id: TLSCipherSuite
      group: Protocol Info
      name: TLS Cipher Suite
      field: TLSCipherSuite
      filter: tls_cipher_suite
      width: 15
      feature: tlsTracking
    - id: TLSGroup
      group: Protocol Info
      name: TLS Group
      field: TLSGroup
      filter: tls_group
      width: 10
      feature: tlsTracking
    - id: TLSTypes
      group: Protocol Info
      name: TLS Types
      tooltip: TLS packet types, such as ClientHello or AppData
      field: TLSTypes
      filter: tls_types
      width: 15
      feature: tlsTracking
    - id: IcmpType
      group: Protocol Info
      name: ICMP Type
      tooltip: The type of the ICMP message
      field: IcmpType
      filter: icmp_type
      default: false
      width: 10
    - id: IcmpCode
      group: Protocol Info
      name: ICMP Code
      tooltip: The code of the ICMP message
      field: IcmpCode
      filter: icmp_code
      default: false
      width: 10
    - id: FlowDirection
      name: Node Direction
      tooltip: The interpreted direction of the flow observed at the Node observation point.
      field: FlowDirection
      filter: node_direction
      default: false
      width: 10
    - id: Interfaces
      name: Interfaces
      tooltip: The network interfaces of the Flow.
      field: Interfaces
      filter: interfaces
      default: false
      width: 10
    - id: IfDirections
      name: Interface Directions
      tooltip: The directions of the Flow observed at the network interface observation point.
      field: IfDirections
      filter: ifdirections
      default: false
      width: 10
    - id: Udns
      name: UDN labels
      tooltip: The list of User Defined Networks.
      field: Udns
      filter: udns
      default: false
      width: 15
      feature: udnMapping
    - id: FlowDirInts
      name: Interfaces and Directions
      tooltip: Pairs of network interface and direction of the Flow observed at the network interface observation point.
      field: Interfaces
      default: false
      width: 15
    - id: Bytes
      name: Bytes
      tooltip: The total aggregated number of bytes.
      field: Bytes
      fields:
        - Bytes
        - PktDropBytes
      default: true
      width: 5
    - id: Packets
      name: Packets
      tooltip: The total aggregated number of packets.
      field: Packets
      fields:
        - Packets
        - PktDropPackets
      default: true
      width: 5
    - id: FlowDuration
      name: Duration
      tooltip: Time elapsed between Start Time and End Time.
      calculated: substract(TimeFlowEndMs,TimeFlowStartMs)
      default: false
      width: 5
    - id: CollectionTime
      name: Collection Time
      tooltip: Reception time of the record by the collector.
      calculated: multiply(TimeReceived,1000)
      field: TimeReceived
      default: false
      width: 15
    - id: CollectionLatency
      name: Collection Latency
      tooltip: Time elapsed between End Time and Collection Time.
      calculated: substract(column.CollectionTime,TimeFlowEndMs)
      default: false
      width: 5
    - id: PktDropBytes
      name: Dropped Bytes
      tooltip: The total aggregated number of bytes dropped.
      field: PktDropBytes
      default: false
      width: 5
      feature: pktDrop
    - id: PktDropPackets
      name: Dropped Packets
      tooltip: The total aggregated number of packets dropped.
      field: PktDropPackets
      default: false
      width: 5
      feature: pktDrop
    - id: PktDropLatestState
      name: Drop State
      tooltip: TCP state on last dropped packet.
      field: PktDropLatestState
      filter: pkt_drop_state
      default: false
      width: 10
      feature: pktDrop
    - id: PktDropLatestDropCause
      name: Drop Cause
      tooltip: TCP state on last dropped packet.
      field: PktDropLatestDropCause
      filter: pkt_drop_cause
      default: false
      width: 10
      feature: pktDrop
    - id: PktDropLatestFlags
      name: Drop Flags
      tooltip: TCP flags on last dropped packet.
      field: PktDropLatestFlags
      default: false
      width: 10
      feature: pktDrop
    - id: DNSId
      group: DNS
      name: DNS Id
      tooltip: DNS request identifier.
      field: DnsId
      filter: dns_id
      default: false
      width: 5
      feature: dnsTracking
    - id: DNSName
      group: DNS
      name: DNS Name
      tooltip: DNS name.
      field: DnsName
      filter: dns_name
      default: false
      width: 15
      feature: dnsTracking
    - id: DNSLatency
      group: DNS
      name: DNS Latency
      tooltip: Time elapsed between DNS request and response.
      field: DnsLatencyMs
      filter: dns_latency
      default: true
      width: 5
      feature: dnsTracking
    - id: DNSResponseCode
      group: DNS
      name: DNS Response Code
      tooltip: DNS RCODE name from response header.
      field: DnsFlagsResponseCode
      filter: dns_flag_response_code
      default: true
      width: 5
      feature: dnsTracking
    - id: DNSErrNo
      group: DNS
      name: DNS Error
      tooltip: DNS error number returned by bpf_skb_load_bytes function.
      field: DnsErrno
      filter: dns_errno
      default: false
      width: 5
      feature: dnsTracking
    - id: TimeFlowRttMs
      name: Flow RTT
      tooltip: TCP Smoothed Round Trip Time (SRTT)
      field: TimeFlowRttNs
      filter: time_flow_rtt
      default: true
      width: 5
      feature: flowRTT
    - id: NetworkEvents
      name: Network Events
      tooltip: Network events flow monitor
      field: NetworkEvents
      filter: network_events
      default: true
      width: 15
      feature: networkEvents
    - id: XlatZoneId
      group: Xlat
      name: Xlat zone id
      field: ZoneId
      filter: xlat_zone_id
      default: true
      width: 5
      feature: packetTranslation
    - id: XlatSrcAddr
      group: Xlat
      name: Xlat source IP
      tooltip: The packet translation source IP address. Can be either in IPv4 or IPv6 format.
      field: XlatSrcAddr
      filter: xlat_src_address
      default: false
      width: 10
      feature: packetTranslation
    - id: XlatSrcPort
      group: Xlat
      name: Xlat source port
      tooltip: The packet translation source port number.
      field: XlatSrcPort
      filter: xlat_src_port
      default: false
      width: 10
      feature: packetTranslation
    - id: XlatSrcK8S_Object
      group: Xlat
      name: Xlat Src Kubernetes Object
      calculated: kubeObject(XlatSrcK8S_Type,XlatSrcK8S_Namespace,XlatSrcK8S_Name,1) or concat(XlatSrcAddr,':',XlatSrcPort)
      default: true
      width: 15
      feature: packetTranslation
    - id: XlatDstAddr
      group: Xlat
      name: Xlat destination IP
      tooltip: The packet translation destination IP address. Can be either in IPv4 or IPv6 format.
      field: XlatDstAddr
      filter: xlat_dst_address
      default: false
      width: 10
      feature: packetTranslation
    - id: XlatDstPort
      group: Xlat
      name: Xlat destination port
      tooltip: The packet translation destination port number.
      field: XlatDstPort
      filter: xlat_dst_port
      default: false
      width: 10
      feature: packetTranslation
    - id: XlatDstK8S_Object
      group: Xlat
      name: Xlat Dst Kubernetes Object
      calculated: kubeObject(XlatDstK8S_Type,XlatDstK8S_Namespace,XlatDstK8S_Name,1) or concat(XlatDstAddr,':',XlatDstPort)
      default: true
      width: 15
      feature: packetTranslation
    - id: XlatK8S_Object
      group: Xlat
      name: Xlat Kubernetes Objects
      calculated: '[column.XlatSrcK8S_Object,column.XlatDstK8S_Object]'
      default: false
      width: 15
      feature: packetTranslation
    - id: IPSecStatus
      name: IPsec Status
      tooltip: Status of the IPsec encryption (on egress, provided by the kernel function xfrm_output) or decryption (on ingress, via xfrm_input).
      field: IPSecStatus
      filter: ipsec_status
      default: true
      width: 10
      feature: ipsec
  filters:
    - id: cluster_name
      name: Cluster
      component: autocomplete
      placeholder: 'E.g: cluster-1, cluster-2'
      hint: Add cluster ID or name filter.
      feature: multiCluster
    - id: namespace
      name: Namespace
      component: autocomplete
      autoCompleteAddsQuotes: true
      category: endpoint
      placeholder: 'E.g: netobserv, kube-system'
      hint: Add kubernetes namespace filter.
      examples: |-
        Specify a single kubernetes name following these rules:
            - Containing any alphanumeric, hyphen, underscrore or dot character
            - Partial text like cluster, cluster-image, image-registry
            - Exact match using quotes like "cluster-image-registry"
            - Case sensitive match using quotes like "Deployment"
            - Starting text like cluster, "cluster-*"
            - Ending text like "*-registry"
            - Pattern like "cluster-*-registry", "c*-*-r*y", -i*e-
    - id: src_namespace
      name: Namespace
      component: autocomplete
      autoCompleteAddsQuotes: true
      category: source
      placeholder: 'E.g: netobserv, kube-system'
      hint: Add kubernetes source namespace filter.
      examples: |-
        Specify a single kubernetes name following these rules:
            - Containing any alphanumeric, hyphen, underscrore or dot character
            - Partial text like cluster, cluster-image, image-registry
            - Exact match using quotes like "cluster-image-registry"
            - Case sensitive match using quotes like "Deployment"
            - Starting text like cluster, "cluster-*"
            - Ending text like "*-registry"
            - Pattern like "cluster-*-registry", "c*-*-r*y", -i*e-
    - id: dst_namespace
      name: Namespace
      component: autocomplete
      autoCompleteAddsQuotes: true
      category: destination
      placeholder: 'E.g: netobserv, kube-system'
      hint: Add kubernetes destination namespace filter.
      examples: |-
        Specify a single kubernetes name following these rules:
            - Containing any alphanumeric, hyphen, underscrore or dot character
            - Partial text like cluster, cluster-image, image-registry
            - Exact match using quotes like "cluster-image-registry"
            - Case sensitive match using quotes like "Deployment"
            - Starting text like cluster, "cluster-*"
            - Ending text like "*-registry"
            - Pattern like "cluster-*-registry", "c*-*-r*y", -i*e-
    - id: name
      name: Name
      component: text
      category: endpoint
      placeholder: 'E.g: my-pod, my-service'
      hint: Add kubernetes name filter.
      examples: |-
        Specify a single kubernetes name following these rules:
            - Containing any alphanumeric, hyphen, underscrore or dot character
            - Partial text like cluster, cluster-image, image-registry
            - Exact match using quotes like "cluster-image-registry"
            - Case sensitive match using quotes like "Deployment"
            - Starting text like cluster, "cluster-*"
            - Ending text like "*-registry"
            - Pattern like "cluster-*-registry", "c*-*-r*y", -i*e-
    - id: src_name
      name: Name
      component: text
      category: source
      placeholder: 'E.g: my-pod, my-service'
      hint: Add kubernetes source name filter.
      examples: |-
        Specify a single kubernetes name following these rules:
            - Containing any alphanumeric, hyphen, underscrore or dot character
            - Partial text like cluster, cluster-image, image-registry
            - Exact match using quotes like "cluster-image-registry"
            - Case sensitive match using quotes like "Deployment"
            - Starting text like cluster, "cluster-*"
            - Ending text like "*-registry"
            - Pattern like "cluster-*-registry", "c*-*-r*y", -i*e-
    - id: dst_name
      name: Name
      component: text
      category: destination
      placeholder: 'E.g: my-pod, my-service'
      hint: Add kubernetes destination name filter.
      examples: |-
        Specify a single kubernetes name following these rules:
            - Containing any alphanumeric, hyphen, underscrore or dot character
            - Partial text like cluster, cluster-image, image-registry
            - Exact match using quotes like "cluster-image-registry"
            - Case sensitive match using quotes like "Deployment"
            - Starting text like cluster, "cluster-*"
            - Ending text like "*-registry"
            - Pattern like "cluster-*-registry", "c*-*-r*y", -i*e-
    - id: kind
      name: Kind
      component: autocomplete
      autoCompleteAddsQuotes: true
      category: endpoint
      placeholder: 'E.g: Pod, Service, Deployment'
    - id: src_kind
      name: Kind
      component: autocomplete
      autoCompleteAddsQuotes: true
      category: source
      placeholder: 'E.g: Pod, Service, Deployment'
    - id: dst_kind
      name: Kind
      component: autocomplete
      autoCompleteAddsQuotes: true
      category: destination
      placeholder: 'E.g: Pod, Service, Deployment'
    - id: owner_name
      name: Owner Name
      component: text
      category: endpoint
      placeholder: 'E.g: my-deployment, my-daemonset'
      hint: Add kubernetes owner name filter.
      examples: |-
        Specify a single kubernetes name following these rules:
            - Containing any alphanumeric, hyphen, underscrore or dot character
            - Partial text like cluster, cluster-image, image-registry
            - Exact match using quotes like "cluster-image-registry"
            - Case sensitive match using quotes like "Deployment"
            - Starting text like cluster, "cluster-*"
            - Ending text like "*-registry"
            - Pattern like "cluster-*-registry", "c*-*-r*y", -i*e-
    - id: src_owner_name
      name: Owner Name
      component: text
      category: source
      placeholder: 'E.g: my-deployment, my-daemonset'
      hint: Add kubernetes source owner name filter.
      examples: |-
        Specify a single kubernetes name following these rules:
            - Containing any alphanumeric, hyphen, underscrore or dot character
            - Partial text like cluster, cluster-image, image-registry
            - Exact match using quotes like "cluster-image-registry"
            - Case sensitive match using quotes like "Deployment"
            - Starting text like cluster, "cluster-*"
            - Ending text like "*-registry"
            - Pattern like "cluster-*-registry", "c*-*-r*y", -i*e-
    - id: dst_owner_name
      name: Owner Name
      component: text
      category: destination
      placeholder: 'E.g: my-deployment, my-daemonset'
      hint: Add kubernetes destination owner name filter.
      examples: |-
        Specify a single kubernetes name following these rules:
            - Containing any alphanumeric, hyphen, underscrore or dot character
            - Partial text like cluster, cluster-image, image-registry
            - Exact match using quotes like "cluster-image-registry"
            - Case sensitive match using quotes like "Deployment"
            - Starting text like cluster, "cluster-*"
            - Ending text like "*-registry"
            - Pattern like "cluster-*-registry", "c*-*-r*y", -i*e-
    - id: zone
      name: Zone
      component: autocomplete
      category: endpoint
      placeholder: 'E.g: zone-1, zone-2'
      hint: Add zone filter.
      feature: zones
    - id: src_zone
      name: Zone
      component: autocomplete
      category: source
      placeholder: 'E.g: zone-1, zone-2'
      hint: Add source zone filter.
      feature: zones
    - id: dst_zone
      name: Zone
      component: autocomplete
      category: destination
      placeholder: 'E.g: zone-1, zone-2'
      hint: Add destination zone filter.
      feature: zones
    - id: subnet_label
      name: Subnet Label
      component: autocomplete
      category: endpoint
      placeholder: 'E.g: Pods, Services, ExternalIP'
      hint: Add subnet label filter, or an empty string to get unmatched sources.
      feature: subnetLabels
    - id: src_subnet_label
      name: Subnet Label
      component: autocomplete
      category: source
      placeholder: 'E.g: Pods, Services, ExternalIP'
      hint: Add source subnet label filter, or an empty string to get unmatched sources.
      feature: subnetLabels
    - id: dst_subnet_label
      name: Subnet Label
      component: autocomplete
      category: destination
      placeholder: 'E.g: Pods, Services, ExternalIP'
      hint: Add destination subnet label filter, or an empty string to get unmatched destinations.
      feature: subnetLabels
    - id: resource
      name: Resource
      component: autocomplete
      category: endpoint
      placeholder: 'E.g: Deployment.example.my-dep or Pod.default.my-pod'
      hint: Add kubernetes resource filter from its kind, namespace and name.
      examples: |-
        Specify a kind, namespace and name from existing:
                - Select kind first from suggestions
                - Then select namespace from suggestions
                - Finally select name from suggestions
    - id: src_resource
      name: Resource
      component: autocomplete
      category: source
      placeholder: 'E.g: Deployment.example.my-dep or Pod.default.my-pod'
      hint: Add kubernetes source resource filter from its kind, namespace and name.
      examples: |-
        Specify a kind, namespace and name from existing:
                - Select kind first from suggestions
                - Then select namespace from suggestions
                - Finally select name from suggestions
    - id: dst_resource
      name: Resource
      component: autocomplete
      category: destination
      placeholder: 'E.g: Deployment.example.my-dep or Pod.default.my-pod'
      hint: Add kubernetes destination resource filter from its kind, namespace and name.
      examples: |-
        Specify a kind, namespace and name from existing:
                - Select kind first from suggestions
                - Then select namespace from suggestions
                - Finally select name from suggestions
    - id: address
      name: IP
      component: text
      category: endpoint
      hint: Add IP or range filter.
      placeholder: 'E.g: 192.0.2.0'
      examples: |-
        Specify IP following one of these rules:
            - A single IPv4 or IPv6 address like 192.0.2.0, ::1
            - An IP address range like 192.168.0.1-192.189.10.12, 2001:db8::1-2001:db8::8
            - A CIDR specification like 192.51.100.0/24, 2001:db8::/32
    - id: src_address
      name: IP
      component: text
      category: source
      hint: Add source IP or range filter.
      placeholder: 'E.g: 192.0.2.0'
      examples: |-
        Specify IP following one of these rules:
            - A single IPv4 or IPv6 address like 192.0.2.0, ::1
            - An IP address range like 192.168.0.1-192.189.10.12, 2001:db8::1-2001:db8::8
            - A CIDR specification like 192.51.100.0/24, 2001:db8::/32
    - id: dst_address
      name: IP
      component: text
      category: destination
      hint: Add destination IP or range filter.
      placeholder: 'E.g: 192.0.2.0'
      examples: |-
        Specify IP following one of these rules:
            - A single IPv4 or IPv6 address like 192.0.2.0, ::1
            - An IP address range like 192.168.0.1-192.189.10.12, 2001:db8::1-2001:db8::8
            - A CIDR specification like 192.51.100.0/24, 2001:db8::/32
    - id: port
      name: Port
      component: autocomplete
      category: endpoint
      hint: Add port number or name filter.
      placeholder: 'E.g: 80, 21, HTTP, FTP'
      examples: |-
        Specify a single port following one of these rules:
                - A port number like 80, 21
                - A IANA name like HTTP, FTP
      docUrl: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml
    - id: src_port
      name: Port
      component: autocomplete
      category: source
      hint: Add source port number or name filter.
      placeholder: 'E.g: 80, 21, HTTP, FTP'
      examples: |-
        Specify a single port following one of these rules:
                - A port number like 80, 21
                - A IANA name like HTTP, FTP
      docUrl: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml
    - id: dst_port
      name: Port
      component: autocomplete
      category: destination
      hint: Add destination port number or name filter.
      placeholder: 'E.g: 80, 21, HTTP, FTP'
      examples: |-
        Specify a single port following one of these rules:
                - A port number like 80, 21
                - A IANA name like HTTP, FTP
      docUrl: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml
    - id: mac
      name: MAC
      component: text
      category: endpoint
      placeholder: 'E.g: 42:01:0A:00:00:01'
      hint: Add MAC address filter.
    - id: src_mac
      name: MAC
      component: text
      category: source
      placeholder: 'E.g: 42:01:0A:00:00:01, 42:01:0A:00:00:02'
      hint: Add source MAC address filter.
    - id: dst_mac
      name: MAC
      component: text
      category: destination
      placeholder: 'E.g: 42:01:0A:00:00:01, 42:01:0A:00:00:02'
      hint: Add destination MAC address filter.
    - id: host_address
      name: Node IP
      component: text
      category: endpoint
      placeholder: 'E.g: 10.0.0.1, 10.0.0.2'
      hint: Add node IP or range filter.
      examples: |-
        Specify IP following one of these rules:
            - A single IPv4 or IPv6 address like 192.0.2.0, ::1
            - An IP address range like 192.168.0.1-192.189.10.12, 2001:db8::1-2001:db8::8
            - A CIDR specification like 192.51.100.0/24, 2001:db8::/32
    - id: src_host_address
      name: Node IP
      component: text
      category: source
      placeholder: 'E.g: 10.0.0.1, 10.0.0.2'
      hint: Add source node IP or range filter.
      examples: |-
        Specify IP following one of these rules:
            - A single IPv4 or IPv6 address like 192.0.2.0, ::1
            - An IP address range like 192.168.0.1-192.189.10.12, 2001:db8::1-2001:db8::8
            - A CIDR specification like 192.51.100.0/24, 2001:db8::/32
    - id: dst_host_address
      name: Node IP
      component: text
      category: destination
      placeholder: 'E.g: 10.0.0.1, 10.0.0.2'
      hint: Add destination node IP or range filter.
      examples: |-
        Specify IP following one of these rules:
            - A single IPv4 or IPv6 address like 192.0.2.0, ::1
            - An IP address range like 192.168.0.1-192.189.10.12, 2001:db8::1-2001:db8::8
            - A CIDR specification like 192.51.100.0/24, 2001:db8::/32
    - id: host_name
      name: Node Name
      component: text
      category: endpoint
      placeholder: 'E.g: my-node, my-node-2'
      hint: Add kubernetes node name filter.
      examples: |-
        Specify a single kubernetes name following these rules:
            - Containing any alphanumeric, hyphen, underscrore or dot character
            - Partial text like cluster, cluster-image, image-registry
            - Exact match using quotes like "cluster-image-registry"
            - Case sensitive match using quotes like "Deployment"
            - Starting text like cluster, "cluster-*"
            - Ending text like "*-registry"
            - Pattern like "cluster-*-registry", "c*-*-r*y", -i*e-
    - id: src_host_name
      name: Node Name
      component: text
      category: source
      placeholder: 'E.g: my-node, my-node-2'
      hint: Add kubernetes source node name filter.
      examples: |-
        Specify a single kubernetes name following these rules:
            - Containing any alphanumeric, hyphen, underscrore or dot character
            - Partial text like cluster, cluster-image, image-registry
            - Exact match using quotes like "cluster-image-registry"
            - Case sensitive match using quotes like "Deployment"
            - Starting text like cluster, "cluster-*"
            - Ending text like "*-registry"
            - Pattern like "cluster-*-registry", "c*-*-r*y", -i*e-
    - id: dst_host_name
      name: Node Name
      component: text
      category: destination
      placeholder: 'E.g: my-node, my-node-2'
      hint: Add kubernetes destination node name filter.
      examples: |-
        Specify a single kubernetes name following these rules:
            - Containing any alphanumeric, hyphen, underscrore or dot character
            - Partial text like cluster, cluster-image, image-registry
            - Exact match using quotes like "cluster-image-registry"
            - Case sensitive match using quotes like "Deployment"
            - Starting text like cluster, "cluster-*"
            - Ending text like "*-registry"
            - Pattern like "cluster-*-registry", "c*-*-r*y", -i*e-
    - id: network
      name: Network Name
      component: text
      category: endpoint
      hint: Add network name filter.
      feature: multiNetworks
    - id: src_network
      name: Network Name
      component: text
      category: source
      hint: Add source network name filter.
      feature: multiNetworks
    - id: dst_network
      name: Network Name
      component: text
      category: destination
      hint: Add destination network name filter.
      feature: multiNetworks
    - id: protocol
      name: Protocol
      component: autocomplete
      placeholder: 'E.g: TCP, UDP, ICMP'
      hint: Add protocol number or name filter.
      examples: |-
        Specify a single protocol following one of these rules:
                - A protocol number like 6, 17
                - A IANA name like TCP, UDP
      docUrl: https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
    - id: tls_version
      name: TLS version
      component: text
      placeholder: 'E.g: TLS 1.2'
      hint: Specify a version of TLS.
      feature: tlsTracking
    - id: tls_cipher_suite
      name: TLS cipher suite
      component: text
      placeholder: 'E.g: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256'
      hint: Specify a TLS cipher suite.
      feature: tlsTracking
    - id: tls_group
      name: TLS group
      component: text
      placeholder: 'E.g: X25519'
      hint: Specify a TLS group name.
      feature: tlsTracking
    - id: tls_types
      name: TLS packet type
      component: text
      placeholder: 'E.g: ClientHello, AppData'
      hint: Specify a TLS type of packet.
      feature: tlsTracking
    - id: dscp
      name: DSCP
      component: autocomplete
      placeholder: 'E.g: 8, 10, Low-Priority Data, High-Throughput Data'
      hint: Add Differentiated Services Code Point number or name filter.
      examples: |-
        Specify a Differentiated Services Code Point following one of these rules:
                - A DSCP number like 8, 10
                - A service class name like Low-Priority Data, High-Throughput Data
    - id: icmp_type
      name: ICMP type
      component: number
      placeholder: 'E.g: 8, 10'
      hint: Add ICMP type value as integer number filter.
    - id: icmp_code
      name: ICMP code
      component: number
      placeholder: 'E.g: 8, 10'
      hint: Add ICMP code value as integer number filter.
    - id: tcp_flags
      name: TCP flags
      component: autocomplete
      placeholder: 'E.g: SYN_ACK, FIN_ACK, RST_ACK'
      hint: Add TCP flags value filter.
      examples: |-
        Logical OR combination of unique TCP flags comprised in the flow, according to RFC-9293, with additional custom flags (SYN_ACK, FIN_ACK and RST_ACK).
    - id: node_direction
      name: Node Direction
      component: autocomplete
      placeholder: 'E.g: Ingress, Egress, Inner'
      hint: Add the interpreted direction of the Flow observed at the Node observation point filter.
    - id: flow_layer
      name: Flow layer
      component: text
      placeholder: 'Either infra or app'
      hint: Add the layer of Flow filter.
    - id: interfaces
      name: Network interfaces
      component: text
      placeholder: 'E.g: br-ex, ovn-k8s-mp0'
      hint: Add network interface filter.
    - id: ifdirections
      name: Interface Directions
      component: autocomplete
      placeholder: 'E.g: Ingress, Egress'
      hint: Add direction of the Flow observed at the network interface observation point filter.
    - id: udns
      name: User Defined Network
      component: autocomplete
      hint: Add user defined network name filter.
      feature: udnMapping
    - id: id
      name: Conversation Id
      component: text
      hint: Add conversation hash Id filter.
    - id: pkt_drop_state
      name: Packet drop TCP state
      component: autocomplete
      placeholder: 'E.g: ESTABLISHED, SYN_SENT, SYN_RECV'
      hint: Add TCP state filter.
      examples: |-
        Specify a single TCP state name like:
                - A _LINUX_TCP_STATES_H number like 1, 2, 3
                - A _LINUX_TCP_STATES_H TCP name like ESTABLISHED, SYN_SENT, SYN_RECV
      docUrl: https://github.com/torvalds/linux/blob/master/include/net/tcp_states.h
      feature: pktDrop
    - id: pkt_drop_cause
      name: Packet drop latest cause
      component: autocomplete
      placeholder: 'E.g: NO_SOCKET, PKT_TOO_SMALL'
      hint: Add packet drop cause filter.
      examples: |-
        Specify a single packet drop cause like:
                - A _LINUX_DROPREASON_CORE_H number like 2, 3, 4
                - A _LINUX_DROPREASON_CORE_H SKB_DROP_REASON name like NOT_SPECIFIED, NO_SOCKET, PKT_TOO_SMALL
      docUrl: https://github.com/torvalds/linux/blob/master/include/net/dropreason-core.h
      feature: pktDrop
    - id: dns_id
      name: DNS Id
      component: number
      hint: Add DNS Id filter.
      feature: dnsTracking
    - id: dns_name
      name: DNS Name
      component: text
      placeholder: 'E.g: www.example.com, www.example.org'
      hint: Add DNS name filter.
      feature: dnsTracking
    - id: dns_latency
      name: DNS Latency
      component: number
      placeholder: 'E.g: 100, 200'
      hint: Add DNS Latency in milliseconds filter.
      feature: dnsTracking
    - id: dns_flag_response_code
      name: DNS Response Code
      component: autocomplete
      placeholder: 'E.g: NoError, NXDomain, NotAuth'
      hint: Add DNS RCODE name filter.
      examples: |-
        Specify a single DNS RCODE name like:
                - A IANA RCODE number like 0, 3, 9
                - A IANA RCODE name like NoError, NXDomain, NotAuth
      docUrl: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6
      feature: dnsTracking
    - id: dns_errno
      name: DNS Error
      component: autocomplete
      hint: Add DNS error number filter.
      feature: dnsTracking
    - id: time_flow_rtt
      name: Flow RTT
      component: number
      hint: Add TCP smoothed Round Trip Time in nanoseconds filter.
      feature: flowRTT
    - id: network_events
      name: Network Events
      component: text
      hint: Add network event filter.
      feature: networkEvents
    - id: xlat_zone_id
      name: Xlat Zone Id
      component: number
      hint: Add Xlat zone ID filter.
      feature: packetTranslation
    - id: xlat_src_address
      name: Xlat source address
      component: text
      category: source
      hint: Add IP or range filter.
      feature: packetTranslation
    - id: xlat_dst_address
      name: Xlat destination address
      component: text
      category: destination
      hint: Add destination IP or range filter.
      feature: packetTranslation
    - id: xlat_src_port
      name: Xlat source port
      component: autocomplete
      category: source
      hint: Add source port number or name filter.
      feature: packetTranslation
    - id: xlat_dst_port
      name: Xlat destination port
      component: autocomplete
      category: destination
      hint: Add destination port number or name filter.
      feature: packetTranslation
    - id: ipsec_status
      name: IPsec Status
      component: text
      placeholder: 'E.g: success, error'
      hint: Add IPsec status filter.
      feature: ipsec
  scopes:
    - id: cluster
      name: Cluster
      shortName: Cl
      description: Cluster name or identifier
      labels:
        - K8S_ClusterName
      feature: multiCluster
      filter: cluster_name
      stepInto: zone
    - id: network
      name: Network
      shortName: Net
      description: Network name, such as User Defined Network
      labels:
        - SrcK8S_NetworkName
        - DstK8S_NetworkName
      feature: multiNetworks
      filters:
        - src_network
        - dst_network
      stepInto: namespace
    - id: zone
      name: Zone
      shortName: AZ
      description: Availability zone
      labels:
        - SrcK8S_Zone
        - DstK8S_Zone
      feature: zones
      groups:
        - clusters
      filters:
        - src_zone
        - dst_zone
      stepInto: host
    - id: host
      name: Node
      shortName: Node
      description: Node on which the resources are running
      labels:
        - SrcK8S_HostName
        - DstK8S_HostName
      groups:
        - networks
        - zones
        - clusters
        - clusters+zones
        - clusters+networks
        - networks+zones
      filters:
        - src_host_name
        - dst_host_name
      stepInto: resource
    - id: namespace
      name: Namespace
      shortName: NS
      description: Resource namespace
      labels:
        - SrcK8S_Namespace
        - DstK8S_Namespace
      groups:
        - clusters
        - clusters+zones
        - clusters+hosts
        - zones
        - zones+hosts
        - hosts
        - networks
        - networks+zones
        - networks+hosts
      filters:
        - src_namespace
        - dst_namespace
      stepInto: owner
    - id: owner
      name: Owner
      shortName: Own
      description: Controller owner, such as a Deployment
      labels:
        - SrcK8S_OwnerName
        - SrcK8S_OwnerType
        - DstK8S_OwnerName
        - DstK8S_OwnerType
        - SrcK8S_Namespace
        - DstK8S_Namespace
        - SrcSubnetLabel
        - DstSubnetLabel
      groups:
        - clusters
        - clusters+zones
        - clusters+hosts
        - clusters+namespaces
        - zones
        - zones+hosts
        - zones+namespaces
        - hosts
        - hosts+namespaces
        - namespaces
        - networks
        - networks+zones
        - networks+hosts
        - networks+namespaces
      filters:
        - src_owner_name
        - dst_owner_name
      stepInto: resource
    - id: resource
      name: Resource
      shortName: Res
      description: Base resource, such as a Pod, a Service or a Node
      labels:
        - SrcK8S_Name
        - SrcK8S_Type
        - SrcK8S_OwnerName
        - SrcK8S_OwnerType
        - SrcK8S_Namespace
        - SrcAddr
        - SrcK8S_HostName
        - SrcSubnetLabel
        - DstK8S_Name
        - DstK8S_Type
        - DstK8S_OwnerName
        - DstK8S_OwnerType
        - DstK8S_Namespace
        - DstAddr
        - DstK8S_HostName
        - DstSubnetLabel
      groups:
        - clusters
        - clusters+zones
        - clusters+hosts
        - clusters+namespaces
        - clusters+owners
        - zones
        - zones+hosts
        - zones+namespaces
        - zones+owners
        - hosts
        - hosts+namespaces
        - hosts+owners
        - namespaces
        - namespaces+owners
        - owners
        - networks
        - networks+zones
        - networks+hosts
        - networks+namespaces
        - networks+owners
      filters:
        - src_resource
        - dst_resource
  fields:
    - name: TimeFlowStartMs
      type: number
      description: Start timestamp of this flow, in milliseconds
    - name: TimeFlowEndMs
      type: number
      description: End timestamp of this flow, in milliseconds
    - name: TimeReceived
      type: number
      description: Timestamp when this flow was received and processed by the flow collector, in seconds
    - name: SrcK8S_Name
      type: string
      description: Name of the source Kubernetes object, such as Pod name, Service name or Node name.
    - name: SrcK8S_Type
      type: string
      description: Kind of the source Kubernetes object, such as Pod, Service or Node.
    - name: SrcK8S_OwnerName
      type: string
      description: Name of the source owner, such as Deployment name, StatefulSet name, etc.
    - name: SrcK8S_OwnerType
      type: string
      description: Kind of the source owner, such as Deployment, StatefulSet, etc.
    - name: SrcK8S_Namespace
      type: string
      description: Source namespace
    - name: SrcAddr
      type: string
      format: IP
      description: Source IP address (ipv4 or ipv6)
    - name: SrcPort
      type: number
      description: Source port
    - name: SrcMac
      type: string
      description: Source MAC address
    - name: SrcK8S_HostIP
      type: string
      format: IP
      description: Source node IP
    - name: SrcK8S_HostName
      type: string
      description: Source node name
    - name: SrcK8S_Zone
      type: string
      description: Source availability zone
    - name: SrcSubnetLabel
      type: string
      description: Source subnet label
    - name: SrcK8S_NetworkName
      type: string
      description: Source network name
    - name: DstK8S_Name
      type: string
      description: Name of the destination Kubernetes object, such as Pod name, Service name or Node name.
    - name: DstK8S_Type
      type: string
      description: Kind of the destination Kubernetes object, such as Pod, Service or Node.
    - name: DstK8S_OwnerName
      type: string
      description: Name of the destination owner, such as Deployment name, StatefulSet name, etc.
    - name: DstK8S_OwnerType
      type: string
      description: Kind of the destination owner, such as Deployment, StatefulSet, etc.
    - name: DstK8S_Namespace
      type: string
      description: Destination namespace
    - name: DstAddr
      type: string
      format: IP
      description: Destination IP address (ipv4 or ipv6)
    - name: DstPort
      type: number
      description: Destination port
    - name: DstMac
      type: string
      description: Destination MAC address
    - name: DstK8S_HostIP
      type: string
      format: IP
      description: Destination node IP
    - name: DstK8S_HostName
      type: string
      description: Destination node name
    - name: DstK8S_Zone
      type: string
      description: Destination availability zone
    - name: DstSubnetLabel
      type: string
      description: Destination subnet label
    - name: DstK8S_NetworkName
      type: string
      description: Destination network name
    - name: K8S_FlowLayer
      type: string
      description: "Flow layer: 'app' or 'infra'"
    - name: Proto
      type: number
      description: L4 protocol
    - name: TLSVersion
      type: string
      description: TLS version
    - name: TLSTypes
      type: string[]
      description: TLS message types (bitfield)
    - name: TLSCipherSuite
      type: string
      description: TLS cipher suite
    - name: TLSGroup
      type: string
      description: TLS group name
    - name: Dscp
      type: number
      description: Differentiated Services Code Point (DSCP) value
    - name: Sampling
      type: number
      description: Sampling interval used for this flow
    - name: IcmpType
      type: number
      description: ICMP type
    - name: IcmpCode
      type: number
      description: ICMP code
    - name: FlowDirection
      type: number
      description: |
        Flow interpreted direction from the node observation point. Can be one of: +
        - 0: Ingress (incoming traffic, from the node observation point) +
        - 1: Egress (outgoing traffic, from the node observation point) +
        - 2: Inner (with the same source and destination node)
    - name: IfDirections
      type: number[]
      description: |
        Flow directions from the network interface observation point. Can be one of: +
        - 0: Ingress (interface incoming traffic) +
        - 1: Egress (interface outgoing traffic)
    - name: Interfaces
      type: string[]
      description: Network interfaces
    - name: Udns
      type: string[]
      description: List of User Defined Networks
    - name: Flags
      type: string[]
      description: |
        List of TCP flags comprised in the flow, according to RFC-9293, with additional custom flags to represent the following per-packet combinations: +
        - SYN_ACK +
        - FIN_ACK +
        - RST_ACK
    - name: Bytes
      type: number
      description: Number of bytes
    - name: Packets
      type: number
      description: Number of packets
    - name: PktDropBytes
      type: number
      description: Number of bytes dropped by the kernel
    - name: PktDropPackets
      type: number
      description: Number of packets dropped by the kernel
    - name: PktDropLatestState
      type: string
      description: TCP state on last dropped packet
    - name: PktDropLatestDropCause
      type: string
      description: Latest drop cause
    - name: PktDropLatestFlags
      type: number
      description: TCP flags on last dropped packet
    - name: DnsId
      type: number
      description: DNS record id
    - name: DnsName
      type: string
      description: DNS queried name
    - name: DnsLatencyMs
      type: number
      description: Time between a DNS request and response, in milliseconds
    - name: DnsFlags
      type: number
      description: DNS flags for DNS record
    - name: DnsFlagsResponseCode
      type: string
      description: Parsed DNS header RCODEs name
    - name: DnsErrno
      type: number
      description: Error number returned from DNS tracker ebpf hook function
    - name: TimeFlowRttNs
      type: number
      description: TCP Smoothed Round Trip Time (SRTT), in nanoseconds
    - name: NetworkEvents
      type: string[]
      docType: object[]
      description: |
        Network events, such as network policy actions, composed of nested fields: +
        - Feature (such as "acl" for network policies) +
        - Type (such as an "AdminNetworkPolicy") +
        - Namespace (namespace where the event applies, if any) +
        - Name (name of the resource that triggered the event) +
        - Action (such as "allow" or "drop") +
        - Direction (Ingress or Egress)
    - name: ZoneId
      type: number
      description: packet translation zone id
    - name: XlatSrcPort
      type: number
      description: packet translation source port
    - name: XlatDstPort
      type: number
      description: packet translation destination port
    - name: XlatSrcAddr
      type: string
      description: packet translation source address
    - name: XlatDstAddr
      type: string
      description: packet translation destination address
    - name: K8S_ClusterName
      type: string
      description: Cluster name or identifier
    - name: IPSecStatus
      type: string
      description: Status of the IPsec encryption (on egress, given by the kernel xfrm_output function) or decryption (on ingress, via xfrm_input)
    - name: _RecordType
      type: string
      description: "Type of record: `flowLog` for regular flow logs, or `newConnection`, `heartbeat`, `endConnection` for conversation tracking"
    - name: _HashId
      type: string
      description: In conversation tracking, the conversation identifier