Iptables fields
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
Module for handling the iptables logs.
Fields from the iptables logs.
iptables.ether_type-
Value of the ethernet type field identifying the network layer protocol.
type: long
iptables.flow_label-
IPv6 flow label.
type: integer
iptables.fragment_flags-
IP fragment flags. A combination of CE, DF and MF.
type: keyword
iptables.fragment_offset-
Offset of the current IP fragment.
type: long
ICMP fields.
iptables.icmp.code-
ICMP code.
type: long
iptables.icmp.id-
ICMP ID.
type: long
iptables.icmp.parameter-
ICMP parameter.
type: long
iptables.icmp.redirect-
ICMP redirect address.
type: ip
iptables.icmp.seq-
ICMP sequence number.
type: long
iptables.icmp.type-
ICMP type.
type: long
iptables.id-
Packet identifier.
type: long
iptables.incomplete_bytes-
Number of incomplete bytes.
type: long
iptables.input_device-
Device that received the packet.
type: keyword
iptables.precedence_bits-
IP precedence bits.
type: short
iptables.tos-
IP Type of Service field.
type: long
iptables.length-
Packet length.
type: long
iptables.output_device-
Device that output the packet.
type: keyword
TCP fields.
iptables.tcp.flags-
TCP flags.
type: keyword
iptables.tcp.reserved_bits-
TCP reserved bits.
type: short
iptables.tcp.seq-
TCP sequence number.
type: long
iptables.tcp.ack-
TCP Acknowledgment number.
type: long
iptables.tcp.window-
Advertised TCP window size.
type: long
iptables.ttl-
Time To Live field.
type: integer
UDP fields.
iptables.udp.length-
Length of the UDP header and payload.
type: long
Fields for Ubiquiti network devices.
iptables.ubiquiti.input_zone-
Input zone.
type: keyword
iptables.ubiquiti.output_zone-
Output zone.
type: keyword
iptables.ubiquiti.rule_number-
The rule number within the rule set.
type: keyword
iptables.ubiquiti.rule_set-
The rule set name.
type: keyword