Aggregator Telemetry - Type 4

The Type 4 Aggregator provides interval-based rollups of traffic statistics with fixed start and end timestamps. It is optimized for periodic reporting pipelines where compact, time-bucketed summaries are preferred over per-flow detail.

Each record contains a stats array with protocol/application dimensions, endpoint context, and upload/download counters for the interval. This format is useful for historical trend analysis, billing-oriented summaries, and destination-focused traffic monitoring.

Data Profile

Dimensions

Application
Protocol
Local IP
Local MAC
Other IP
Other port
IP protocol
IP version
VLAN ID

Metrics

Download bytes
Upload bytes
Packets

Criteria

Excludes NATed flows

Requirements

Install and configure the Netify Agent
Install and configure a Sink Plugin for receiving the telemetry
Install and configure the Aggregator Plugin
- Set the aggregator property to 4
- Modify the Sink Configuration

Source: Aggregator Plugin
Plugin Release: 1.0.87

Attributes

Please review the direction conventions documentation for context on local vs other metrics.

Timestamps

log_time_start

integer

Unix epoch timestamp (seconds) for the beginning of the aggregation interval.

log_time_end

integer

Unix epoch timestamp (seconds) for the end of the aggregation interval.

Dimensions

stats

array[object]

List of aggregated metrics buckets.

stats.application_id

integer

Netify application ID.

stats.protocol_id

integer

Netify protocol ID.

stats.ip_protocol

integer

IANA IP protocol number (for example: 6 for TCP, 17 for UDP).

stats.ip_version

integer

IP version used by traffic.

Values:

4 6

stats.other_ip

string

Other endpoint IP address.

stats.other_port

integer

Transport-layer port for the other endpoint.

stats.vlan_id

integer

VLAN identifier associated with the bucket (or 0 when untagged).

Metrics

stats.upload

integer

Total upstream bytes observed.

stats.download

integer

Total downstream bytes observed.

stats.packets

integer

Total packet count observed.

Example Data

Unlike other aggregators, Type 4 only supports the flat format.

Aggregator 4 - Flat Mode

{
  "log_time_end": 1745002614,
  "log_time_start": 1745002604,
  "stats": [
    {
      "application_id": 10909,
      "download": 935,
      "ip_protocol": 17,
      "ip_version": 4,
      "other_ip": "142.250.80.14",
      "other_port": 443,
      "packets": 5,
      "protocol_id": 188,
      "upload": 748,
      "vlan_id": 0
    },
    ...
  ]
}