L7 log data types

Calico Cloud supports multiple L7 collectors that write into the same Elasticsearch index:

• Envoy — the legacy sidecar/proxy-based collector. See Enable Envoy collector.
• eBPF — kernel TCP-layer probes capturing HTTP request/response and TLS handshake metadata. See Enable eBPF collector.
• Waypoint — Istio Ambient Mode HTTP logging via the Waypoint Proxy. See Enable Waypoint collector.

The Envoy and Waypoint collectors are both built on Envoy access logs, and the table below refers to them collectively as the Envoy-based collectors. They share the same collector_type value (envoy-access-log) and are told apart by collector_name.

The table below details the key/value pairs in the JSON blob, including their Elasticsearch datatype and which collector(s) populate each field. "All" means every collector populates the field. Descriptions prefixed with HTTP only or TLS only mark fields that are populated for events of only that protocol family.

Name	Datatype	Populated by	Description
host	keyword	All	Name of the node that collected the L7 log entry.
start_time	date	All	Start time of log collection in Unix timestamp format.
end_time	date	All	End time of log collection in Unix timestamp format.
bytes_in	long	All	Number of incoming bytes since the last export.
bytes_out	long	All	Number of outgoing bytes since the last export.
duration_mean	long	All	Mean duration time of all the requests that match this combination of L7 data in nanoseconds.
duration_max	long	All	Max duration time of all the requests that match this combination of L7 data in nanoseconds.
count	long	All	Number of requests that match this combination of L7 data.
src_name_aggr	keyword	All	Contains one of the following values: - Aggregated name of the source pod. - pvt: endpoint is not a pod. Its IP address belongs to a private subnet. - pub: endpoint is not a pod. Its IP address does not belong to a private subnet. It is probably an endpoint on the public internet.
src_namespace	keyword	All	Namespace of the source endpoint.
src_type	keyword	All	Source endpoint type. Possible values: - wep: A workload endpoint, a pod in Kubernetes. - ns: A network set. If multiple match, priority is given to NetworkSets in the workload's own namespace, then to GlobalNetworkSets, and then to NetworkSets in other namespaces. For ties between matching network sets within each category, the one with the longest-prefix match is chosen. Remaining ties are resolved alphabetically by the NetworkSet's full identity (using namespace/name or just name). - net: A Network. The IP address did not fall into a known endpoint type.
dest_name_aggr	keyword	All	Contains one of the following values: - Aggregated name of the destination pod. - pvt: endpoint is not a pod. Its IP address belongs to a private subnet. - pub: endpoint is not a pod. Its IP address does not belong to a private subnet. It is probably an endpoint on the public internet.
dest_namespace	keyword	All	Namespace of the destination endpoint.
dest_type	keyword	All	Destination endpoint type. Possible values: - wep: A workload endpoint, a pod in Kubernetes. - ns: A network set. If multiple match, priority is given to NetworkSets in the workload's own namespace, then to GlobalNetworkSets, and then to NetworkSets in other namespaces. For ties between matching network sets within each category, CIDR matches outrank domain matches and longest-prefix wins between competing CIDR matches. Remaining ties are resolved alphabetically by the NetworkSet's full identity (using namespace/name or just name). - net: A Network. The IP address did not fall into a known endpoint type.
dest_service_name	keyword	All	Name of the destination service. This may be empty if the request was not made against a service.
dest_service_namespace	keyword	All	Namespace of the destination service. This may be empty if the request was not made against a service.
dest_service_port	long	All	Destination service port.
url	keyword	All	HTTP only. URL that the request was made against.
response_code	keyword	All	HTTP only. Response code returned by the request.
method	keyword	All	HTTP only. HTTP method for the request.
user_agent	keyword	All	HTTP only. User agent of the request.
type	keyword	All	Type of request made. Possible values include tcp, tls, and html/<version>.
protocol	keyword	All	Wire-protocol family of the captured event. Possible values: http, tls.
protocol_version	keyword	All	Wire-protocol version. For HTTP events, possible values include 1.0, 1.1, and 2.
collector_type	keyword	All	Technology family of the collector that produced the event. Possible values: ebpf for the eBPF collector, and envoy-access-log for the Envoy-based collectors (Envoy and Waypoint).
collector_name	keyword	All	Specific collector that produced the event within the family. Possible values: ebpf-tcp (eBPF kernel TCP-layer collector), daemonset (Envoy collector), and waypoint (Waypoint collector).
tls_sni	keyword	eBPF	TLS only. TLS Server Name Indication sent by the client in the ClientHello.
tls_version	keyword	eBPF	TLS only. Negotiated TLS protocol version (for example, TLS 1.2, TLS 1.3).
tls_cipher_suite	keyword	eBPF	TLS only. Negotiated TLS cipher suite (for example, TLS_AES_256_GCM_SHA384).