You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/network-watcher/traffic-analytics-schema-update.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,11 +21,11 @@ ms.author: vinigam
21
21
The [Traffic Analytics Log schema](https://docs.microsoft.com/azure/network-watcher/traffic-analytics-schema) has been updated to include the following new fields: **SrcPublicIPs_s** , **DestPublicIPs_s**, **NSGRule_s**. In the next few months, the following older fields will be deprecated: **VMIP_s**, **Subscription_g**, **Region_s**, **NSGRules_s**, **Subnet_s**, **VM_s**, **NIC_s**, **PublicIPs_s**, **FlowCount_d**.
22
22
The new fields provide information about source and destination IPs and simplify queries.
23
23
24
-
Below are 3 example showing how to replace old fields with new ones.
24
+
Below are three examples showing how to replace the old fields with new ones.
We don’t have to infer Source and destination cases for Azure and External public flows from FlowDirection_s field for AzurePublic and ExternalPublic flows specifically. In case of NVA the FlowDirection_s field can be inappropriate to be used as well.
28
+
We don’t have to infer Source and destination cases for Azure and External public flows from FlowDirection_s field for AzurePublic and ExternalPublic flows specifically. In case of an NVA (Network Virtual Appliance), the FlowDirection_s field can be inappropriate to be used as well.
Earlier field was of format: <Index value 0)>|<NSG_RULENAME>|<FlowDirection>|<FlowStatus>|<FlowCountProcessedByRule>
74
74
75
-
Earlier we used to aggregate data across NSG and NSGRules. Now we do not aggregate. So NSGList_s contains only 1 NSG and NSGRules_s also used to contain only 1 rule. So we have removed the complicated formatting here and the same can be found in other fields as mentioned below:
75
+
Earlier we used to aggregate data across NSG and NSGRules. Now we do not aggregate. So NSGList_s contains only one NSG and NSGRules_s also used to contain only one rule. So we have removed the complicated formatting here and the same can be found in other fields as mentioned below:
Since we do not club data across NSG, the FlowCount_d is simply AllowedInFlows_d + DeniedInFlows_d + AllowedOutFlows_d + DeniedOutFlows_d.
103
-
Only 1 of the above 4 will be non-zero and rest three will be 0. And it would indicate that in the NIC where the flow was captured, what was the status and count of that.
103
+
Only 1 of the above 4 will be non-zero and rest three will be 0. And it would indicate the status and count in the NIC where the flow was captured.
104
104
105
-
If flow was allowed one of the “Allowed” prefixed field will be populated. Else “Denied” prefixed one.
106
-
If Flow was inbound one of the “InFlows_d” suffixed field will be populated. Else “OutFlows_d” suffixed one.
105
+
If the flow was allowed, one of the fields prefixed with “Allowed” will be populated. Else one fields prefixed with “Denied” will be populated.
106
+
If the flow was inbound, one of the fields suffixed with "\_d" like “InFlows_d” suffixed field will be populated. Else “OutFlows_d” will be populated.
107
107
108
-
Depending on above 2 conditions we know which one out of the 4 will be populated.
108
+
Depending on above 2 conditions, we know which one out of the 4 will be populated.
0 commit comments