Aggregator Telemetry - Type 1

The Type 1 Aggregator summarizes flow activity by application, protocol, local IP and local MAC. It is designed to provide compact usage totals that are easy to chart, alert on, and compare over time windows.

When privacy mode is disabled, records include local_ip and local_mac so usage can be tied to individual hosts. When privacy mode is enabled, those identifiers are omitted while aggregated counters remain available for high-level trend monitoring.

Target Usage

This aggregator is intended for use with network traffic flowing to/from the Internet. In other words, east-west traffic, broadcast traffic, and multicast is excluded from and ,

Please review the upload/download conventions documentation for context on local_ip, local_mac and upload/download.

Requirements

Aggregator Type 1 telemetry was introduced in the Aggregator Plugin in version 1.0.16. To begin streaming the telemetry:

Install and configure the Netify Agent
Install and configure a Sink Plugin for receiving the telemetry
Install and configure the Aggregator Plugin
- Set the aggregator property to 1
- Modify the Sink Configuration

Source: Aggregator Plugin
Plugin Release: 1.0.16

Flat vs. Nested Formats

The aggregator formats are available in two different formats. The flat format is well suited for importing into databases, creating CSVs, and managing other row-based solutions. The nested format is well suited for cache keys, internal data structures in memory, and other key-based solutions.

Flat

{
    "key1": "key value1",
    "key2": "key value2",
    "key3": "key value3",
    "data1": "aggregate data1",
    "data2": "aggregate data2",
    "data3": "aggregate data3"
}

Nested

{
    "key value1": {
        "key value2": {
            "key value3": {
                "data1": "aggregate data1",
                "data2": "aggregate data2",
                "data3": "aggregate data3"
            }
        }
    }
}

Attributes

application_id

string

Legacy Netify application identifier.

protocol_id

integer

Netify protocol ID.

download

integer

Total downstream bytes observed.

upload

integer

Total upstream bytes observed.

packets

integer

Total packet count observed.

local_ip

string

Local endpoint IP address. Omitted when privacy mode is enabled.

local_mac

string

Local endpoint MAC address. Omitted when privacy mode is enabled.

Privacy Mode Disabled (false)

{
    "application_id": "10910.netify.google-chat",
    "download": 67,
    "local_ip": "192.168.1.100",
    "local_mac": "00:00:00:00:00:00",
    "packets": 2,
    "protocol_id": 188,
    "upload": 71
},
{
    "application_id": "10091.netify.amazon-aws",
    "download": 68,
    "local_ip": "192.168.1.101",
    "local_mac": "11:11:11:11:11:11",
    "packets": 2,
    "protocol_id": 196,
    "upload": 66
},

Privacy Mode Enabled (true)

{
    "application_id": "10310.netify.ubiquiti",
    "download": 0,
    "packets": 1,
    "protocol_id": 31,
    "upload": 204
},
{
    "application_id": "10909.netify.google-play",
    "download": 694,
    "packets": 10,
    "protocol_id": 188,
    "upload": 769
}