HI,
Here is the JSON that gets returned. It is returned in a single line but I had to anonymise it first, so it’s now in correct layout too. flow.client.geo.loc.coord is the data I need, with time stamps so that I can pulled data from different times.
{
"hits": [
{
"_id": "NsOH_pIBhYpifShZdNT_",
"_index": "elastiflow-flow-codex-2.4-rollover-000007",
"_score": 1,
"_source": {
"@timestamp": 1730847141153,
"as.label": [
"TS-XXXX-XXX",
"Anonymised Org (XXXXX)"
],
"flow.bytes": 5914624,
"flow.client.as.asn": "XXXXX",
"flow.client.as.label": "Anonymised Org (XXXXX)",
"flow.client.as.org": "Anonymised Org",
"flow.client.geo.city.name": "Anonymised City",
"flow.client.geo.country.code": "XX",
"flow.client.geo.country.name": "Anonymised Country",
"flow.client.geo.loc.coord": "XX.XXXX,-XX.XXXX",
"flow.client.geo.tz.name": "Anonymised/Time_Zone",
"flow.client.host.name": "anonymised-hostname.com",
"flow.client.ip.addr": "XXX.XXX.XXX.XXX",
"flow.client.ip.subnet.mask_size": "XX",
"flow.client.l4.port.id": 63935,
"flow.client.l4.port.name": "TCP/XXXX",
"flow.client.mac.addr": "XX:XX:XX:XX:XX:XX",
"flow.collect.timestamp": 1730847141153,
"flow.community.id": "anonymised_id",
"flow.conversation.id": "anonymised_conversation_id",
"flow.direction.name": "Ingress",
"flow.dst.as.asn": "XXXXX",
"flow.dst.as.label": "Anonymised Org (XXXXX)",
"flow.dst.as.org": "Anonymised Org",
"flow.dst.geo.city.name": "Anonymised City",
"flow.dst.geo.country.code": "XX",
"flow.dst.geo.country.name": "Anonymised Country",
"flow.dst.geo.loc.coord": "XX.XXXX,-XX.XXXX",
"flow.dst.geo.tz.name": "Anonymised/Time_Zone",
"flow.dst.host.name": "anonymised-hostname.com",
"flow.dst.ip.addr": "XXX.XXX.XXX.XXX",
"flow.dst.ip.subnet.mask_size": "XX",
"flow.dst.l4.port.id": 63935,
"flow.dst.l4.port.name": "TCP/XXXX",
"flow.dst.mac.addr": "XX:XX:XX:XX:XX:XX",
"flow.export.geo.city.name": "Anonymised City",
"flow.export.geo.country.code": "XX",
"flow.export.geo.country.name": "Anonymised Country",
"flow.export.geo.loc.coord": "XX.XXXX,-XX.XXXX",
"flow.export.geo.tz.name": "Anonymised/Time_Zone",
"flow.export.host.name": "anonymised-hostname.com",
"flow.export.ip.addr": "XXX.XXX.XXX.XXX",
"flow.export.l4.port.id": 49772,
"flow.export.sysuptime": 2763325000,
"flow.export.type": "sflow",
"flow.export.version.name": "sFlow vX",
"flow.export.version.ver": 5,
"flow.in.bytes": 5914624,
"flow.in.netif.index": "anonymised_index",
"flow.in.netif.name": "index: anonymised",
"flow.in.packets": 4096,
"flow.in.vlan.tag.id": "anonymised_vlan_id",
"flow.in.vlan.tag.pcp.name": "BE",
"flow.isServer": "source",
"flow.locality": "public",
"flow.meter.packet_select.interval.packets": 4096,
"flow.meter.packets_drop": 0,
"flow.meter.packets_total": 669868032,
"flow.next_hop.as.asn": "anonymised_asn",
"flow.next_hop.as.label": "Anonymised Org (anonymised_asn)",
"flow.next_hop.as.org": "Anonymised Org",
"flow.next_hop.host.name": "anonymised-link.net",
"flow.next_hop.ip.addr": "XXX.XXX.XXX.XXX",
"flow.out.netif.index": "anonymised_index",
"flow.out.netif.name": "index: anonymised",
"flow.out.vlan.tag.id": "anonymised_vlan_id",
"flow.out.vlan.tag.pcp.name": "BE",
"flow.packets": 4096,
"flow.seq_num": "anonymised_seq_num",
"flow.server.as.asn": "XXXXX",
"flow.server.as.label": "TS-XXXX-XXX",
"flow.server.as.org": "Anonymised Org",
"flow.server.geo.city.name": "Anonymised City",
"flow.server.geo.country.code": "XX",
"flow.server.geo.country.name": "Anonymised Country",
"flow.server.geo.loc.coord": "XX.XXXX,-XX.XXXX",
"flow.server.geo.tz.name": "Anonymised/Time_Zone",
"flow.server.host.name": "anonymised-hostname.com",
"flow.server.ip.addr": "XXX.XXX.XXX.XXX",
"flow.server.ip.subnet.mask_size": "XX",
"flow.server.l4.port.id": 80,
"flow.server.l4.port.name": "http (TCP/80)",
"flow.server.mac.addr": "XX:XX:XX:XX:XX:XX",
"flow.src.as.asn": "XXXXX",
"flow.src.as.label": "Anonymised Org (XXXXX)",
"flow.src.as.org": "Anonymised Org",
"flow.src.geo.city.name": "Anonymised City",
"flow.src.geo.country.code": "XX",
"flow.src.geo.country.name": "Anonymised Country",
"flow.src.geo.loc.coord": "XX.XXXX,-XX.XXXX",
"flow.src.geo.tz.name": "Anonymised/Time_Zone",
"flow.src.host.name": "anonymised-hostname.com",
"flow.src.ip.addr": "XXX.XXX.XXX.XXX",
"flow.src.ip.subnet.mask_size": "XX",
"flow.src.l4.port.id": 80,
"flow.src.l4.port.name": "http (TCP/80)",
"flow.src.mac.addr": "XX:XX:XX:XX:XX:XX",
"geo.city.name": [
"Anonymised City",
"Anonymised City"
],
"geo.country.name": [
"Anonymised Country"
],
"ip.dscp.name": "DF",
"ip.ecn.name": "Non-ECT",
"ip.frag.flags.tags": [
"DF"
],
"ip.packet.size": 1422,
"ip.ttl": 64,
"ip.version.name": "IPv4",
"ip.version.ver": 4,
"l2.frame.size": 1444,
"l4.proto.name": "TCP",
"l4.session.established": "true",
"sflow.pen.id": 0,
"sflow.pen.name": "iana",
"sflow.sample.header_proto.name": "ETHERNET-ISO88023",
"sflow.sample.seq_num": "anonymised_sample_seq",
"sflow.sample.size": 128,
"sflow.sample.strip_size": 4,
"sflow.sample_type.name": "flow_sample",
"sflow.source_id": "anonymised_source_id",
"sflow.source_id_type.name": "Interface Index",
"sflow.sub_agent_id": 0,
"system.host.name": "anonymised-hostname.com",
"system.ip.addr": "XXX.XXX.XXX.XXX",
"tcp.ack_num": "anonymised_ack_num",
"tcp.flags.bits": 16,
"tcp.flags.tags": [
"ACK"
],
"tcp.header.size": 32,
"tcp.options.payload": "anonymised_payload",
"tcp.seq_num": "anonymised_seq_num",
"tcp.urgent_pointer": 0,
"tcp.window.size": 31746,
"vlan.c_tag.dei.state": "false",
"vlan.c_tag.id": "anonymised_vlan_id",
"vlan.c_tag.pcp.name": "BE",
"vlan.tag.id": [
"anonymised_vlan_id_1",
"anonymised_vlan_id_2"
]
}
}
]
}
