Azure Flow Logs

Enable Azure Flow Logs support in Configuration Center > Monitoring Center > Flow Logs > Microsoft Azure. The system downloads logs periodically, converts them to IPFIX format, and sends them to your specified local collector port. This table shows the mapping between Azure Flow Logs fields and IPFIX fields. Any fields not listed here are not mapped.

Field	Maps to, in IPFIX
Source IP	IPFIX_SourceIPv4Address IPFIX_SourceIPv6Address
Destination IP	IPFIX_DestinationIPv4Address IPFIX_DestinationIPv6Address
Source Port	IPFIX_SourceTransportPort
Destination Port	IPFIX_DestinationTransportPort
Protocol	IPFIX_protocolIdentifier
Packets	IPFIX_packetTotalCount
Bytes	IPFIX_octetTotalCount
Timestamp	No mapping, replaced by computed values for IPFIX_flowStartMilliseconds IPFIX_flowEndMilliseconds
Traffic Decision	IPFIX_firewallEvent
Traffic Flow	IPFIX_flowDirection
Flow State	No mapping, used for generating values for IPFIX_flowStartMilliseconds IPFIX_flowEndMilliseconds
Virtual Network Name	No mapping, replaced by a generated value for IPFIX_ingressInterface
Subscription ID	No mapping, replaced by a generated value for IPFIX_exporterIPv4Address
Resource Group Name	No mapping, replaced by a generated value for IPFIX_exporterIPv4Address