# Name , DisplayName , Description _id , UID , time , Time , Round end_time to seconds. region , Region , az , Availability Zone , host , VM Hypervisor , Host running virtual machine. chost , Cloud Host , Including virtual machines, bare metal servers. vpc , VPC , l2_vpc , Forwarding VPC , VPC where the MAC address is located. subnet , Subnet , router , Router , dhcpgw , DHCP Gateway , lb , Load Balancer , lb_listener , Load Balancer Listener , natgw , NAT Gateway , redis , Redis , rds , RDS , pod_cluster , K8s Cluster , pod_ns , K8s Namespace , pod_node , K8s Node , pod_ingress , K8s Ingress , pod_service , K8s Service , pod_group_type , K8s Workload Type , pod_group , K8s Workload , Such as Deployment, StatefulSet, Daemonset, etc. pod , K8s POD , service , Service , resource_gl0_type , Type - K8s POD First , Deprecated，please use auto_instance_type. resource_gl0 , Instance - K8s POD First , Deprecated，please use auto_instance. resource_gl1_type , Type - K8s Workload First , Deprecated，please use auto_service_type. resource_gl1 , Instance - K8s Workload First , Deprecated，please use auto_service. resource_gl2_type , Type - K8s Service First , Deprecated，please use auto_service_type. resource_gl2 , Instance - K8s Service First , Deprecated，please use auto_service. auto_instance_type , Type - K8s POD First , The type of 'auto_instance'. auto_instance , Instance - K8s POD First , The instance of IP, when the instance is an IP, auto_instance_id displayed as a subnet ID. auto_service_type , Type - K8s Service First , The type of 'auto_service'. auto_service , Instance - K8s Service First , On the basis of 'auto_instance', aggregate K8s service ClusterIP and workload into service, when the instance is an IP, auto_service_id displayed as a subnet ID. gprocess , Process , tap_port_host , Tap Port Host , Deprecated，please use capture_nic_host. tap_port_chost , Tap Port Cloud Host , Deprecated，please use capture_nic_chost. tap_port_pod_node , Tap Port K8s Node , Deprecated，please use capture_nic_pod_node. capture_nic_host , Host of Capture NIC , capture_nic_chost , Cloud Host of Capture NIC , capture_nic_pod_node , K8s Node of Capture NIC , host_ip , VM Hypervisor , The management IP address of VM Hypervisor. host_hostname , VM Hypervisor , The hostname of VM Hypervisor. chost_ip , Cloud Host , The primary IP address of Cloud Host. chost_hostname , Cloud Host , The hostname of Cloud Host. pod_node_ip , K8s Node , The primary IP address of K8s Node. pod_node_hostname , K8s Node , The hostname of K8s Node. k8s.label , K8s Label , k8s.annotation , K8s Annotation , k8s.env , K8s Env , cloud.tag , Cloud Tag , os.app , OS APP , eth_type , Ether Type , vlan , VLAN TAG , mac , MAC Address , ip , IP Address , is_ipv4 , IPv4 Flag , is_internet , Internet IP Flag , Whether the IP address is an external Internet address. province , Province , The province to which the Internet IP address belongs. protocol , Network Protocol , tunnel_tier , Tunnel Tiers , tunnel_type , Tunnel Type , tunnel_tx_id , TX Tunnel ID , tunnel_rx_id , RX Tunnel ID , tunnel_tx_ip , TX Tunnel IP Address , tunnel_tx_ip_0 , TX Tunnel src IP Address , tunnel_tx_ip_1 , TX Tunnel dst IP Address , tunnel_rx_ip , RX Tunnel IP Address , tunnel_rx_ip_0 , RX Tunnel src IP Address , tunnel_rx_ip_1 , RX Tunnel dst IP Address , tunnel_tx_mac , TX Tunnel MAC Address , tunnel_tx_mac_0 , TX Tunnel src MAC Address , tunnel_tx_mac_1 , TX Tunnel dst MAC Address , tunnel_rx_mac , RX Tunnel MAC Address , tunnel_rx_mac_0 , RX Tunnel src MAC Address , tunnel_rx_mac_1 , RX Tunnel dst MAC Address , client_port , Client Port , server_port , Server Port , tcp_flags_bit , TCP Flag Set , The set of TCP flags in all packets in the current natural minute. syn_seq , Seq no. of SYN Packet , syn_ack_seq , Seq no. of SYN-ACK Packet , last_keepalive_seq , Seq no. of Heartbeat Packet , Seq number in the most recent heartbeat packet. last_keepalive_ack , Ack no. of Heartbeat Packet , Ack number in the most recent heartbeat packet. l7_protocol , Application Protocol , request_domain , Request Domain , flow_id , Flow ID , start_time , Start Time , Unit: microseconds. Indicates the start time of the flow within the current natural minute, and indicates the first packet time for a newly created flow. end_time , End Time , Unit: microseconds. Indicates the end time of the flow within the current natural minute. If the flow is closed within this minute, it is the end packet time or the timeout time of the flow state machine. close_type , Flow Close Type , status , Status , Determined by the close_type and protocol: Normal/ForceReport/Non-TCP timeout/Disconnected* = Normal, Client* = Client Error, Server*/TCP Timeout = Server Error, others = Unknown. is_new_flow , New Flow Flag , signal_source , Signal Source , tap , Traffic Access Point , Deprecated，please use capture_network_type. capture_network_type , Network Location , The network location for capturing traffic uses a fixed value (Cloud Network) to represent intra-cloud traffic, while other values indicate traditional IDC traffic (supports up to 254 custom values to represent locations of traffic mirroring). vtap , DeepFlow Agent , Deprecated，please use agent. agent , DeepFlow Agent , nat_source , NAT Source , tap_port , TAP Port Identifier , Deprecated, please use capture_nic. tap_port_name , TAP Port Name , Deprecated, please use capture_nic_name. tap_port_type , TAP Port Type , Deprecated, please use capture_nic_type. capture_nic , Capture NIC ID , When the value of tap_port_type is 'Local NIC', tap_port indicates the MAC address suffix (the last four bytes) of the tap interface. capture_nic_name , Capture NIC Name , When the value of tap_port_type is 'Local NIC', tap_port_name indicates the name of the tap interface. capture_nic_type , Capture NIC Type , Indicates the type of traffic collection location, including Local NIC (cloud traffic), NFV Gateway NIC (NFV Gateway traffic), Traffic Mirror (traditional IDC traffic), etc. tap_side , TAP Side , Deprecated, please use observation_point. observation_point , Observation Point , The logical location of the collection location in the traffic path, such as Cient NIC, Client Node, Server Node, Server NIC, etc. l2_end , Boundary of L2 Network , Indicates whether the traffic is collected on the client NIC or the server NIC. l3_end , Boundary of L3 Network , Indicates whether the traffic is collected in the Layer 2 network where the client or server is located. has_pcap , PCAP File , Whether the PCAP file is stored nat_real_ip , NAT IP Address , The real IP address before (after) NAT, the value is extracted from TOA (TCP Option Address), or calculated according to the mapping information between VIP and RIP in the cloud platform. nat_real_port , NAT Port , The real port number before NAT works, the value is extracted from TOA (TCP Option Address).