# Attribute Reference

This document is a quick reference for all flow span attributes in Mermin. For design rationale and the full specification, see [Semantic Conventions](https://docs.mermin.dev/concepts/semantic-conventions).

## Overview

Each network flow is represented as a single OpenTelemetry Span with:

* **Span Name**: `flow_<network.type>_<network.transport>` (e.g., `flow_ipv4_tcp`)
* **Span Kind**: `CLIENT` (forward/initiator), `SERVER` (reverse/responder), or `INTERNAL` (unknown)

## Example Span (OTLP JSON)

Below is an example of what a flow span might look like in OTLP JSON format.

{% code fullWidth="false" %}

```json
{
  "name": "flow_ipv4_tcp",
  "kind": "SPAN_KIND_CLIENT",
  "startTimeUnixNano": "1727149620000000000",
  "endTimeUnixNano": "1727149680000000000",
  "attributes": [
    { "key": "flow.community_id", "value": { "stringValue": "1:LQU9qZlK+B+2dM2I2n1kI/M5a/g=" } },
    { "key": "flow.direction", "value": { "stringValue": "forward" } },
    { "key": "flow.end_reason", "value": { "stringValue": "active_timeout" } },
    { "key": "flow.bytes.delta", "value": { "intValue": "1024" } },
    { "key": "flow.packets.delta", "value": { "intValue": "10" } },
    { "key": "flow.reverse.bytes.delta", "value": { "intValue": "32768" } },
    { "key": "flow.reverse.packets.delta", "value": { "intValue": "85" } },
    { "key": "source.address", "value": { "stringValue": "10.1.1.5" } },
    { "key": "source.port", "value": { "intValue": "54211" } },
    { "key": "source.k8s.pod.name", "value": { "stringValue": "frontend-abcde" } },
    { "key": "source.k8s.namespace.name", "value": { "stringValue": "production" } },
    { "key": "destination.address", "value": { "stringValue": "10.1.2.10" } },
    { "key": "destination.port", "value": { "intValue": "80" } },
    { "key": "destination.k8s.pod.name", "value": { "stringValue": "backend-xyz" } },
    { "key": "destination.k8s.namespace.name", "value": { "stringValue": "production" } },
    { "key": "network.transport", "value": { "stringValue": "tcp" } },
    { "key": "network.type", "value": { "stringValue": "ipv4" } },
    { "key": "flow.tcp.flags.bits", "value": { "intValue": "18" } },
    { "key": "flow.tcp.flags.tags", "value": { "arrayValue": { "values": [
      { "stringValue": "SYN" },
      { "stringValue": "ACK" }
    ]}}},
    { "key": "flow.reverse.tcp.flags.bits", "value": { "intValue": "18" } },
    { "key": "flow.reverse.tcp.flags.tags", "value": { "arrayValue": { "values": [
      { "stringValue": "SYN" },
      { "stringValue": "ACK" }
    ]}}},
    { "key": "flow.tcp.rndtrip.latency", "value": { "intValue": "2500000" } }
  ]
}
```

{% endcode %}

## Requirement Level Legend

The following symbols are used in the "Required" column to indicate [OpenTelemetry attribute requirement levels](https://opentelemetry.io/docs/specs/semconv/general/attribute-requirement-level/):

<table><thead><tr><th width="99.93359375">Symbol</th><th width="199.79296875">Requirement Level</th><th>Description</th></tr></thead><tbody><tr><td>✓</td><td>Required</td><td>All instrumentations MUST populate the attribute</td></tr><tr><td>?</td><td>Conditionally Required</td><td>MUST populate when the specified condition is satisfied</td></tr><tr><td>~</td><td>Recommended</td><td>SHOULD add by default if readily available and efficient</td></tr><tr><td>○</td><td>Opt-In</td><td>SHOULD populate only if user configures instrumentation to do so</td></tr></tbody></table>

## General Flow Attributes

> Note on Timestamps: The span's standard `start_time_unix_nano` and `end_time_unix_nano` fields are used to mark the beginning and end of the flow span's observation window. These are analogous to the `flowStart*` and `flowEnd*` fields in IPFIX records and are not duplicated as attributes.

<table data-full-width="true"><thead><tr><th>Proposed Field Name</th><th width="96.08203125">Data Type</th><th>Description</th><th>Notes / Decisions</th><th width="96.21875">Std OTel</th><th width="96.0078125">Required</th></tr></thead><tbody><tr><td><code>flow.community_id</code></td><td><code>string</code></td><td>The Community ID hash of the flow's five-tuple.</td><td>A common way to identify a network flow across different monitoring points.</td><td></td><td>✓</td></tr><tr><td><code>flow.direction</code></td><td><code>string</code></td><td>The inferred direction of the flow from the observer's perspective.</td><td>One of: <code>forward</code>, <code>reverse</code>, or <code>unknown</code>. Mirrors IPFIX biflow concepts. See <a href="https://github.com/elastiflow/mermin/blob/main/docs/.gitbook/includes/semantic-conventions.md#flow-direction">Flow Direction</a> for details.</td><td></td><td>✓</td></tr><tr><td><code>flow.connection.state</code></td><td><code>string</code></td><td>The state of the connection (e.g., TCP state) at the time the flow was generated.</td><td>For TCP, this would be one of the standard states like <code>established</code>, <code>time_wait</code>, etc. Similar to network.connection.state but from a flow perspective.</td><td></td><td>? TCP only</td></tr><tr><td><code>flow.end_reason</code></td><td><code>string</code></td><td>The reason the flow record was exported (e.g., <code>active_timeout</code>, <code>end_of_flow_detected</code>).</td><td>Stored as a human-readable text enum based on <a href="https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-flow-end-reason">ipfix end reason</a>.</td><td></td><td>✓</td></tr></tbody></table>

## L2-L4 Attributes

<table data-full-width="true"><thead><tr><th>Proposed Field Name</th><th width="95.9921875">Data Type</th><th>Description</th><th>Notes / Decisions</th><th width="96.04296875">Std OTel</th><th width="95.78125">Required</th></tr></thead><tbody><tr><td><code>source.address</code></td><td><code>string</code></td><td>Source IP address.</td><td></td><td>✓</td><td>✓</td></tr><tr><td><code>source.port</code></td><td><code>long</code></td><td>Source port number.</td><td></td><td>✓</td><td>✓</td></tr><tr><td><code>destination.address</code></td><td><code>string</code></td><td>Destination IP address.</td><td></td><td>✓</td><td>✓</td></tr><tr><td><code>destination.port</code></td><td><code>long</code></td><td>Destination port number.</td><td></td><td>✓</td><td>✓</td></tr><tr><td><code>network.transport</code></td><td><code>string</code></td><td>The transport protocol of the flow (e.g., <code>tcp</code>, <code>udp</code>).</td><td>Lowercase IANA protocol name string.</td><td>✓</td><td>✓</td></tr><tr><td><code>network.type</code></td><td><code>string</code></td><td>The network protocol type (EtherType) of the flow (e.g., <code>ipv4</code>, <code>ipv6</code>).</td><td></td><td>✓</td><td>✓</td></tr><tr><td><code>network.interface.index</code></td><td><code>long</code></td><td>The index value of the network interface where the flow was observed.</td><td></td><td>✓</td><td>~</td></tr><tr><td><code>network.interface.name</code></td><td><code>string</code></td><td>The name of the network interface where the flow was observed.</td><td></td><td>✓</td><td>~</td></tr><tr><td><code>network.interface.mac</code></td><td><code>string</code></td><td>Source MAC address.</td><td>Lowercased, 6 hexadecimal values separated by colons.</td><td></td><td>~</td></tr><tr><td><code>flow.ip.dscp.id</code></td><td><code>long</code></td><td>Differentiated Services Code Point (DSCP) value from the IP header (forward direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.ip.dscp.name</code></td><td><code>string</code></td><td>Lowercase DSCP standard name (forward direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.ip.ecn.id</code></td><td><code>long</code></td><td>Explicit Congestion Notification (ECN) value from the IP header (forward direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.ip.ecn.name</code></td><td><code>string</code></td><td>Lowercase ECN standard name (forward direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.ip.ttl</code></td><td><code>long</code></td><td>Time to Live (IPv4) or Hop Limit (IPv6) value (forward direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.ip.flow_label</code></td><td><code>long</code></td><td>Flow Label from the IPv6 header (forward direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.ip.dscp.id</code></td><td><code>long</code></td><td>Differentiated Services Code Point (DSCP) value from the IP header (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.ip.dscp.name</code></td><td><code>string</code></td><td>Lowercase DSCP standard name (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.ip.ecn.id</code></td><td><code>long</code></td><td>Explicit Congestion Notification (ECN) value from the IP header (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.ip.ecn.name</code></td><td><code>string</code></td><td>Lowercase ECN standard name (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.ip.ttl</code></td><td><code>long</code></td><td>Time to Live (IPv4) or Hop Limit (IPv6) value (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.ip.flow_label</code></td><td><code>long</code></td><td>Flow Label from the IPv6 header (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.icmp.type.id</code></td><td><code>long</code></td><td>ICMP message type id.</td><td>Based on IANA standard names.</td><td></td><td>~</td></tr><tr><td><code>flow.icmp.type.name</code></td><td><code>string</code></td><td>Lowercase ICMP message type name.</td><td>Based on IANA standard names.</td><td></td><td>~</td></tr><tr><td><code>flow.icmp.code.id</code></td><td><code>long</code></td><td>ICMP message code id.</td><td>Based on IANA standard names.</td><td></td><td>~</td></tr><tr><td><code>flow.icmp.code.name</code></td><td><code>string</code></td><td>ICMP message code name.</td><td>Based on IANA standard names.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.icmp.type.id</code></td><td><code>long</code></td><td>ICMP message type id (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.icmp.type.name</code></td><td><code>string</code></td><td>Lowercase ICMP message type name (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.icmp.code.id</code></td><td><code>long</code></td><td>ICMP message code id (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.icmp.code.name</code></td><td><code>string</code></td><td>ICMP message code name (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.tcp.flags.bits</code></td><td><code>long</code></td><td>The integer representation of all TCP flags seen during the observation window.</td><td>Accumulated across entire flow lifetime (never reset).</td><td></td><td>~</td></tr><tr><td><code>flow.tcp.flags.tags</code></td><td><code>string[]</code></td><td>An array of TCP flag names (e.g., <code>["SYN", "ACK"]</code>) for all flags set.</td><td>Accumulated across entire flow lifetime (never reset).</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.tcp.flags.bits</code></td><td><code>long</code></td><td>The integer representation of all TCP flags seen in reverse direction.</td><td>Accumulated across entire flow lifetime (never reset).</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.tcp.flags.tags</code></td><td><code>string[]</code></td><td>An array of TCP flag names for reverse direction (e.g., <code>["SYN", "ACK"]</code>).</td><td>Accumulated across entire flow lifetime (never reset).</td><td></td><td>~</td></tr></tbody></table>

## Flow Metrics

<table data-full-width="true"><thead><tr><th>Proposed Field Name</th><th width="95.57421875">Data Type</th><th>Description</th><th>Notes / Decisions</th><th width="95.93359375">Std OTel</th><th width="95.9453125">Required</th></tr></thead><tbody><tr><td><code>flow.bytes.delta</code></td><td><code>long</code></td><td>Number of bytes observed in the last measurement interval for the flow.</td><td></td><td></td><td>✓</td></tr><tr><td><code>flow.bytes.total</code></td><td><code>long</code></td><td>Total number of bytes observed for this flow since its start.</td><td>The term <code>bytes</code> is preferred over <code>octets</code> for clarity.</td><td></td><td>~</td></tr><tr><td><code>flow.packets.delta</code></td><td><code>long</code></td><td>Number of packets observed in the last measurement interval for the flow.</td><td></td><td></td><td>✓</td></tr><tr><td><code>flow.packets.total</code></td><td><code>long</code></td><td>Total number of packets observed for this flow since its start.</td><td></td><td></td><td>~</td></tr><tr><td><code>flow.reverse.bytes.delta</code></td><td><code>long</code></td><td>Delta bytes in the reverse direction of the flow.</td><td></td><td></td><td>✓</td></tr><tr><td><code>flow.reverse.bytes.total</code></td><td><code>long</code></td><td>Total bytes in the reverse direction of the flow since its start.</td><td></td><td></td><td>~</td></tr><tr><td><code>flow.reverse.packets.delta</code></td><td><code>long</code></td><td>Delta packets in the reverse direction of the flow.</td><td></td><td></td><td>✓</td></tr><tr><td><code>flow.reverse.packets.total</code></td><td><code>long</code></td><td>Total packets in the reverse direction of the flow since its start.</td><td></td><td></td><td>~</td></tr></tbody></table>

## Performance Metrics

Time-based metrics calculated for the flow, stored in nanoseconds (`ns`).

<table data-full-width="true"><thead><tr><th>Proposed Field Name</th><th width="95.625">Data Type</th><th>Description</th><th>Notes / Decisions</th><th width="96.4140625">Std OTel</th><th width="95.51953125">Required</th></tr></thead><tbody><tr><td><code>flow.tcp.handshake.latency</code></td><td><code>long</code></td><td>The latency of the first part of the TCP handshake (SYN to SYN/ACK), from the <strong>client's perspective</strong>. (Server network delay)</td><td>Unit: <code>ns</code>.</td><td></td><td>~</td></tr><tr><td><code>flow.tcp.svc.latency</code></td><td><code>long</code></td><td>The application/service processing time, as measured on the <strong>server side</strong>.</td><td>Unit: <code>ns</code>.</td><td></td><td>~</td></tr><tr><td><code>flow.tcp.svc.jitter</code></td><td><code>long</code></td><td>The jitter of the application/service processing time, as measured on the <strong>server side</strong>.</td><td>Unit: <code>ns</code>.</td><td></td><td>~</td></tr><tr><td><code>flow.tcp.rndtrip.latency</code></td><td><code>long</code></td><td>The full round-trip time (client to server + app to client), from the <strong>client's perspective</strong>.</td><td>Unit: <code>ns</code>.</td><td></td><td>~</td></tr><tr><td><code>flow.tcp.rndtrip.jitter</code></td><td><code>long</code></td><td>The jitter of the full round-trip time, from the <strong>client's perspective</strong>.</td><td>Unit: <code>ns</code>.</td><td></td><td>~</td></tr></tbody></table>

## Tunnel & Ip-in-Ip & IPSec Attributes

<table data-full-width="true"><thead><tr><th>Proposed Field Name</th><th width="95.73828125">Data Type</th><th>Description</th><th>Notes / Decisions</th><th width="96.20703125">Std OTel</th><th width="95.76953125">Required</th></tr></thead><tbody><tr><td><code>flow.ipsec.ah.spi</code></td><td><code>long</code></td><td>Security Parameters Index for AH headers.</td><td>SPI from the outermost header (after a tunnel)</td><td></td><td>○</td></tr><tr><td><code>flow.ipsec.esp.spi</code></td><td><code>long</code></td><td>Security Parameters Index for ESP headers.</td><td>SPI from the outermost header (after a tunnel)</td><td></td><td>○</td></tr><tr><td><code>flow.ipsec.sender_index</code></td><td><code>long</code></td><td>The sender index from a WireGuard header.</td><td></td><td></td><td>○</td></tr><tr><td><code>flow.ipsec.receiver_index</code></td><td><code>long</code></td><td>The receiver index from a WireGuard header.</td><td></td><td></td><td>○</td></tr><tr><td><code>ipip.network.type</code></td><td><code>string</code></td><td>The network protocol type (EtherType) of the flow (e.g., <code>ipv4</code>, <code>ipv6</code>).</td><td></td><td></td><td>○</td></tr><tr><td><code>ipip.network.transport</code></td><td><code>string</code></td><td>The transport protocol of the encapsulated flow (e.g., <code>tcp</code>, <code>udp</code>).</td><td></td><td></td><td>○</td></tr><tr><td><code>ipip.source.address</code></td><td><code>string</code></td><td>The source IP address of the tunnel's outer header.</td><td>Ip-in-Ip is always the outermost header.</td><td></td><td>○</td></tr><tr><td><code>ipip.destination.address</code></td><td><code>string</code></td><td>The destination IP address of the tunnel's outer header.</td><td></td><td></td><td>○</td></tr><tr><td><code>ipip.bytes.delta</code></td><td><code>long</code></td><td>Number of outer header bytes observed in the last measurement interval.</td><td></td><td></td><td>? IP-in-IP present</td></tr><tr><td><code>ipip.bytes.total</code></td><td><code>long</code></td><td>Total number of outer header bytes observed since flow start.</td><td>The term <code>bytes</code> is preferred over <code>octets</code> for clarity.</td><td></td><td>~</td></tr><tr><td><code>ipip.reverse.bytes.delta</code></td><td><code>long</code></td><td>Delta outer header bytes in the reverse direction.</td><td></td><td></td><td>? IP-in-IP present</td></tr><tr><td><code>ipip.reverse.bytes.total</code></td><td><code>long</code></td><td>Total outer header bytes in the reverse direction since flow start.</td><td></td><td></td><td>~</td></tr><tr><td><code>tunnel.type</code></td><td><code>string</code></td><td>The type of tunnel protocol (e.g., <code>vxlan</code>, <code>geneve</code>, <code>gre</code>).</td><td>Tunnel is always the outermost header.</td><td></td><td>○</td></tr><tr><td><code>tunnel.network.interface.mac</code></td><td><code>string</code></td><td>Source MAC address of tunnel.</td><td>Lowercased, 6 hexadecimal values separated by colons.</td><td></td><td>~</td></tr><tr><td><code>tunnel.network.type</code></td><td><code>string</code></td><td>The network protocol type (EtherType) of the flow (e.g., <code>ipv4</code>, <code>ipv6</code>).</td><td></td><td></td><td>○</td></tr><tr><td><code>tunnel.network.transport</code></td><td><code>string</code></td><td>The transport protocol of the flow (e.g., <code>tcp</code>, <code>udp</code>).</td><td></td><td></td><td>○</td></tr><tr><td><code>tunnel.source.address</code></td><td><code>string</code></td><td>The source IP address of the tunnel's outer header.</td><td></td><td></td><td>○</td></tr><tr><td><code>tunnel.source.port</code></td><td><code>long</code></td><td>The source port of the tunnel's outer header.</td><td></td><td></td><td>○</td></tr><tr><td><code>tunnel.destination.address</code></td><td><code>string</code></td><td>The destination IP address of the tunnel's outer header.</td><td></td><td></td><td>○</td></tr><tr><td><code>tunnel.destination.port</code></td><td><code>long</code></td><td>The destination port of the tunnel's outer header.</td><td></td><td></td><td>○</td></tr><tr><td><code>tunnel.id</code></td><td><code>string</code></td><td>The identifier for the tunnel (e.g., VNI for VXLAN/Geneve, Key ID for GRE).</td><td></td><td></td><td>○</td></tr><tr><td><code>tunnel.ipsec.ah.spi</code></td><td><code>long</code></td><td>Security Parameters Index for AH headers.</td><td>SPI from the outermost header.</td><td></td><td>○</td></tr><tr><td><code>tunnel.ipsec.esp.spi</code></td><td><code>long</code></td><td>Security Parameters Index for ESP headers.</td><td>SPI from the outermost header.</td><td></td><td>○</td></tr><tr><td><code>tunnel.bytes.delta</code></td><td><code>long</code></td><td>Number of tunnel overhead bytes observed in the last measurement interval.</td><td></td><td></td><td>? tunnel present</td></tr><tr><td><code>tunnel.bytes.total</code></td><td><code>long</code></td><td>Total number of tunnel overhead bytes observed since flow start.</td><td>The term <code>bytes</code> is preferred over <code>octets</code> for clarity.</td><td></td><td>~</td></tr><tr><td><code>tunnel.reverse.bytes.delta</code></td><td><code>long</code></td><td>Delta tunnel overhead bytes in the reverse direction.</td><td></td><td></td><td>? tunnel present</td></tr><tr><td><code>tunnel.reverse.bytes.total</code></td><td><code>long</code></td><td>Total tunnel overhead bytes in the reverse direction since flow start.</td><td></td><td></td><td>~</td></tr></tbody></table>

## Kubernetes Attributes

> **Note:** These attributes use `source.k8s.*` / `destination.k8s.*` prefixes rather than standard OTel `k8s.*` attributes. See [Why `source.k8s.*` Instead of `k8s.source.*`?](https://github.com/elastiflow/mermin/blob/main/docs/.gitbook/includes/semantic-conventions.md#why-sourcek8s-instead-of-k8ssource) for the rationale.

<table data-full-width="true"><thead><tr><th>Proposed Field Name</th><th width="96.2421875">Data Type</th><th>Description</th><th>Notes / Decisions</th><th width="96.04296875">Std OTel</th><th width="96.25">Required</th></tr></thead><tbody><tr><td><code>source.k8s.cluster.name</code></td><td><code>string</code></td><td>The name of the Kubernetes cluster for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.cluster.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes cluster for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.node.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Node for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.node.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Node for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.node.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source Node.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.namespace.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Namespace for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.pod.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Pod for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.pod.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Pod for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.pod.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source Pod.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.container.name</code></td><td><code>string</code></td><td>The name of the Container from Pod specification.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.deployment.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Deployment for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.deployment.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Deployment for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.deployment.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source Deployment.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.replicaset.name</code></td><td><code>string</code></td><td>The name of the Kubernetes ReplicaSet for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.replicaset.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes ReplicaSet for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.replicaset.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source ReplicaSet.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.statefulset.name</code></td><td><code>string</code></td><td>The name of the Kubernetes StatefulSet for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.statefulset.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes StatefulSet for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.statefulset.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source StatefulSet.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.daemonset.name</code></td><td><code>string</code></td><td>The name of the Kubernetes DaemonSet for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.daemonset.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes DaemonSet for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.daemonset.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source DaemonSet.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.job.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Job for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.job.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Job for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.job.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source Job.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.cronjob.name</code></td><td><code>string</code></td><td>The name of the Kubernetes CronJob for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.cronjob.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes CronJob for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.cronjob.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source CronJob.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.service.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Service for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.service.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Service for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.service.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source Service.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.cluster.name</code></td><td><code>string</code></td><td>The name of the Kubernetes cluster for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.cluster.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes cluster for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.node.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Node for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.node.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Node for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.node.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination Node.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.namespace.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Namespace for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.pod.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Pod for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.pod.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Pod for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.pod.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination Pod.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.container.name</code></td><td><code>string</code></td><td>The name of the Container from Pod specification.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.deployment.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Deployment for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.deployment.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Deployment for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.deployment.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination Deployment.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.replicaset.name</code></td><td><code>string</code></td><td>The name of the Kubernetes ReplicaSet for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.replicaset.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes ReplicaSet for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.replicaset.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination ReplicaSet.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.statefulset.name</code></td><td><code>string</code></td><td>The name of the Kubernetes StatefulSet for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.statefulset.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes StatefulSet for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.statefulset.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination StatefulSet.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.daemonset.name</code></td><td><code>string</code></td><td>The name of the Kubernetes DaemonSet for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.daemonset.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes DaemonSet for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.daemonset.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination DaemonSet.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.job.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Job for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.job.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Job for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.job.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination Job.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.cronjob.name</code></td><td><code>string</code></td><td>The name of the Kubernetes CronJob for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.cronjob.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes CronJob for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.cronjob.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination CronJob.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.service.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Service for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.service.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Service for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.service.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination Service.</td><td>Flattened map.</td><td>~</td><td>○</td></tr></tbody></table>

## Network Policy Attributes

<table data-full-width="true"><thead><tr><th>Proposed Field Name</th><th width="96.06640625">Data Type</th><th>Description</th><th>Notes / Decisions</th><th width="95.69140625">Std OTel</th><th width="96.390625">Required</th></tr></thead><tbody><tr><td><code>network.policy.ingress</code></td><td><code>string[]</code></td><td>A list of network policy names affecting ingress traffic.</td><td>This could be multiple policies.</td><td></td><td>○</td></tr><tr><td><code>network.policy.egress</code></td><td><code>string[]</code></td><td>A list of network policy names affecting egress traffic.</td><td>This could be multiple policies.</td><td></td><td>○</td></tr></tbody></table>

## Process & Container Attributes

<table data-full-width="true"><thead><tr><th>Proposed Field Name</th><th width="95.671875">Data Type</th><th>Description</th><th>Notes / Decisions</th><th width="96.1015625">Std OTel</th><th width="95.71875">Required</th></tr></thead><tbody><tr><td><code>process.executable.name</code></td><td><code>string</code></td><td>The name of the binary associated with the socket for this flow.</td><td>Provides application-level identification.</td><td>✓</td><td>~</td></tr><tr><td><code>process.pid</code></td><td><code>long</code></td><td>The PID of the process associated with the socket for this flow.</td><td>Provides application-level identification.</td><td>✓</td><td>~</td></tr><tr><td><code>source.container.name</code></td><td><code>string</code></td><td>The container runtime name for the source (e.g., from Docker/containerd).</td><td>Distinct from <code>source.k8s.container.name</code>.</td><td>✓</td><td>~</td></tr><tr><td><code>source.container.image.name</code></td><td><code>string</code></td><td>The image name of the source container (e.g., <code>nginx:1.21</code>).</td><td>From K8s Pod spec container image.</td><td></td><td>~</td></tr><tr><td><code>destination.container.name</code></td><td><code>string</code></td><td>The container runtime name for the destination.</td><td>Distinct from <code>destination.k8s.container.name</code>.</td><td>✓</td><td>~</td></tr><tr><td><code>destination.container.image.name</code></td><td><code>string</code></td><td>The image name of the destination container (e.g., <code>app:v1.0.0</code>).</td><td>From K8s Pod spec container image.</td><td></td><td>~</td></tr></tbody></table>

***

## Next Steps

{% tabs %}
{% tab title="Learn More" %}

1. [**Explore the Full Specification**](https://docs.mermin.dev/concepts/semantic-conventions): Design rationale and detailed semantics
2. [**Understand How Flows Are Generated**](https://docs.mermin.dev/concepts/agent-architecture): Agent architecture and data flow
   {% endtab %}

{% tab title="Use Flow Traces" %}

1. [**Query Flow Traces in Your Backend**](https://docs.mermin.dev/getting-started/backend-integrations): Use these attributes in your observability platform
2. [**Configure Filters**](https://docs.mermin.dev/configuration/reference/flow-span-filters): Filter flows by attribute values
   {% endtab %}
   {% endtabs %}

### Need Help?

* [**GitHub Discussions**](https://github.com/elastiflow/mermin/discussions): Ask about specific attributes