flowlog

Documentation

Index

• type Action
• type Record
  • func Parse(s string) (Record, error)
• type Status

Types

type Action

type Action string

Action of the Record.

const (
	// ActionNone is the action when no data is present.
	ActionNone Action = "-"
	// ActionAccept is the action when it the connection was accepted.
	ActionAccept Action = "ACCEPT"
	// ActionReject is the action when it the connection was rejected.
	ActionReject Action = "REJECT"
)

type Record

type Record struct {
	// Version of the VPC Flow Logs.
	Version string
	// AccountID for the flow log.
	AccountID string
	// InterfaceID of the network interface for which the traffic is recorded.
	InterfaceID string
	// SourceAddress is an IPv4 or IPv6 address. The IPv4 address of the network interface is always its private IPv4 address.
	SourceAddress net.IP
	// DestinationAddress is an IPv4 or IPv6 address. The IPv4 address of the network interface is always its private IPv4 address.
	DestinationAddress net.IP
	// SourcePort of the traffic.
	SourcePort int64
	// DestinationPort of the traffic.
	DestinationPort int64
	// Protocol is the IANA protocol number of the traffic. For more information, see Assigned Internet Protocol Numbers.
	Protocol string
	// 	Packets is the number of packets transferred during the capture window.
	Packets int64
	// Bytes is the number of bytes transferred during the capture window.
	Bytes int64
	// Start time of the start of the capture window.
	Start time.Time
	// End time of the end of the capture window.
	End time.Time
	// Action associated with the traffic - ACCEPT: The recorded traffic was permitted by the security groups or network ACLs. or REJECT: The recorded traffic was not permitted by the security groups or network ACLs.
	Action Action
	// Status of the flow log: OK: Data is logging normally to the chosen destinations. NODATA: There was no network traffic to or from the network interface during the capture window. SKIPDATA: Some flow log records were skipped during the capture window. This may be because of an internal capacity constraint, or an internal error.
	Status Status
}

Record represents a network flow in your flow log.

func Parse

func Parse(s string) (Record, error)

Parse the AWS flow log Record.

type Status

type Status string

Status of the Record.

const (
	// StatusOK is a successful log.
	StatusOK Status = "OK"
	// StatusNoData is when the log has no data in the collection period.
	StatusNoData Status = "NODATA"
	// StatusSkipData is the status when records were skipped in the capture window.
	StatusSkipData Status = "SKIPDATA"
)