Aggregator Telemetry - Type 1

The Type 1 Aggregator provides a high-level view of network usage at the edge by condensing raw flow data into compact, time-based summaries. It is typically used to monitor how devices and users consume Internet resources across a LAN segment or last-mile network, enabling straightforward reporting, trend analysis, and alerting.

By aggregating traffic by application, protocol, and local endpoints, it produces lightweight telemetry that is easy to visualize and compare across time intervals without the overhead of full flow records. For use cases that require additional context - such as remote endpoints, IP protocols, and flow counts - see the Type 2 Aggregator.

Data Profile

Dimensions

Application
Protocol
Local IP
Local MAC

Metrics

Download bytes
Upload bytes
Packets

Criteria

Excludes NATed flows

Requirements

Install and configure the Netify Agent
Install and configure a Sink Plugin for receiving the telemetry
Install and configure the Aggregator Plugin
- Set the aggregator property to 1
- Modify the Sink Configuration

Source: Aggregator Plugin
Plugin Release: 1.0.16

Attributes

Please review the direction conventions documentation for context on local_ip, local_mac, and upload/download.

Timestamps

log_time_start

integer

Unix epoch timestamp (seconds) for the beginning of the aggregation interval.

log_time_end

integer

Unix epoch timestamp (seconds) for the end of the aggregation interval.

Dimensions

local_mac

string

Local endpoint MAC address. Omitted when privacy mode is enabled.

local_ip

string

Local endpoint IP address. Omitted when privacy mode is enabled.

application_id

string

Legacy Netify application identifier with both the ID and tag.

protocol_id

integer

Netify protocol ID.

Metrics

download

integer

Total downstream bytes observed.

upload

integer

Total upstream bytes observed.

packets

integer

Total packet count.

Example Data

The aggregator formats are available in two different formats. The flat format is well suited for importing into databases, creating CSVs, and managing other row-based solutions. The nested format is well suited for cache keys, internal data structures in memory, and other key-based solutions.

Aggregator 1 - Flat Mode

{
  "log_time_end": 1774715044,
  "log_time_start": 1774715039,
  "stats": [
    {
      "application_id": "156.netify.spotify",
      "download": 1596,
      "local_ip": "192.168.88.115",
      "local_mac": "c2:54:46:ae:90:ab",
      "packets": 16,
      "protocol_id": 196,
      "upload": 1467
    },
    ...
  ]
}

Aggregator 1 - Nested Mode

{
  "log_time_end": 1774715044,
  "log_time_start": 1774715039,
  "stats": {
    "c2:54:46:ae:90:ab": {
      "192.168.88.115": {
        "156.netify.spotify": {
          "196": {
            "download": 1596,
            "packets": 16,
            "upload": 1467
          }
        }
      }
    },
    ...
  }
}