BETA FEATURE
This feature is currently in open beta and still in development, but we encourage you to try it out!
Set up your cloud flow logs to send them to New Relic.
Prerequisites
New Relic prerequisites
- A New Relic account. Don't have one? Sign up for free! No credit card required.
- A New Relic account ID.
- A New Relic license key.
AWS prerequisites
- AWS VPC Flow Export configured to existing S3 bucket.
- Permissions to build and publish images to Amazon ECR.
- Permissions to create a Lambda function.
- AWS CLI (v 1.9.15+) installed.
- Docker installed.
Required fields from cloud flow logs
Important
The default format for flow logs doesn't include all of the required fields that are required for ktranslate
to work properly. You must ensure that the below fields are added or the data you'll receive in New Relic will be incomplete.
Flow Record Field | Description |
---|---|
version | The VPC Flow Logs version. |
srcaddr | The source address for incoming traffic, or the IPv4 or IPv6 address of the network interface for outgoing traffic. For a network interface, the IPv4 address is always its private IPv4 address. |
dstaddr | The destination address for outgoing traffic, or the IPv4 or IPv6 address of the network interface for incoming traffic. For a network interface, the IPv4 address is always its private IPv4 address. |
srcport | The source port of the traffic. |
dstport | The destination port of the traffic. |
protocol | The IANA protocol number of the traffic. |
packets | The number of packets transferred during the flow. |
bytes | The number of bytes transferred during the flow. |
vpc-id | The ID of the VPC that contains the network interface for which the traffic is recorded. |
flow-direction | The direction of the flow with respect to the interface where traffic is captured. The possible values are |
Set up cloud flow logs monitoring in New Relic
To send your cloud flow logs to New Relic, follow these steps:
- Create a private ECR registry and upload the ktranslate image
- Create a Lambda function from the ECR image
- Validate your settings
Find and use your metrics
All cloud flow logs exported from the ktranslate
Lambda function use the KFlow
namespace, via the New Relic Event API. Currently, these are the fields populated from this integration:
Attribute | Type | Description |
---|---|---|
application | String | The class of program generating the traffic in this flow record. This is derived from the lowest numeric value from |
dest_vpc | String | The name of the VPC the traffic in this flow record is targeting, if known. |
device_name | String | The name of the VPC this flow record was exported from. |
dst_addr | String | The target IPv4 address for this flow record. |
dst_as | Numeric | The target Autonomous System Number for this flow record. |
dst_as_name | String | The target Autonomous System Name for this flow record. |
dst_endpoint | String | The target |
dst_geo | String | The target country for this flow record, if known. |
flow_direction | String | The direction of flow for this record, from the point of view of the interface where the traffic was captured. Valid options are |
in_bytes | Numeric | The number of bytes transferred for ingress flow records. |
in_pkts | Numeric | The number of packets transferred for ingress flow records. |
l4_dst_port | Numeric | The target port for this flow record. |
l4_src_port | Numeric | The source port for this flow record. |
out_bytes | Numeric | The number of bytes transferred for egress flow records. |
out_pkts | Numeric | The number of packets transferred for egress flow records. |
protocol | String | The display name of the protocol used in this flow record, derived from the numeric IANA protocol number |
provider | String | This attribute is used to uniquely identify various sources of data from |
sample_rate | Numeric | The rate at which |
source_vpc | String | The name of the VPC the traffic in this flow record originated from, if known. |
src_addr | String | The source IPv4 address for this flow record. |
src_as | Numeric | The source Autonomous System Number for this flow record. |
src_as_name | String | The source Autonomous System Name for this flow record. |
src_endpoint | String | The source |
src_geo | String | The source country for this flow record, if known. |
start_time | Numeric | The time, in Unix seconds, when the first packet of the flow was received within the aggregation interval. This might be up to 60 seconds after the packet was transmitted or received on the network interface. |
timestamp | Numeric | The time, in Unix seconds, when this flow record was received by the New Relic Event API. |
Environment variables for AWS Lambda functions
When you're configuring your AWS Lambda function, you need to set up the following environment variables:
Key | Value | Required |
---|---|---|
KENTIK_MODE |
| √ |
NEW_RELIC_API_KEY | The New Relic license key for your account | √ |
NR_ACCOUNT_ID | Your New Relic account ID | √ |
NR_REGION | The New Relic datacenter region for your account. The possible values are | |
KENTIK_SAMPLE_RATE | The rate of randomized sampling |
Tip
For S3 objects with less than 100 flow records, ktranslate
will revert to a sample rate of 1
and process every record. For S3 objects with more than 100 flow records, ktranslate
will use the configured value of KENTIK_SAMPLE_RATE
, which has a default of 1000
. Meaning that every record in the object has a 1:1000 change of being sampled.