I briefly highlighted the log file format during the demonstration, but I just want to quickly highlight what each of those parameters is defined as. So, to clarify, the default log file format is as follows:
${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status}
These parameters define the following:
- version: The version of the flow log itself
- account-id: Your AWS account ID
- interface-id: The interface ID that the log stream data applies to
- srcaddr: The IP source address
- dstaddr: The IP destination address
- srcport: The source port being used for the traffic
- dstport: The destination port being used for the traffic
- protocol: The protocol number being used for the traffic
- packets: The total number of packets sent during the capture
- bytes: The total number of bytes sent during the capture
- start: The timestamp of when the capture window started
- end: The...
