# Attribute Reference

This document is a quick reference for all flow span attributes in Mermin. For design rationale and the full specification, see [Semantic Conventions](/concepts/semantic-conventions.md).

## Overview

Each network flow is represented as a single OpenTelemetry Span with:

* **Span Name**: `flow_<network.type>_<network.transport>` (e.g., `flow_ipv4_tcp`)
* **Span Kind**: `CLIENT` (forward/initiator), `SERVER` (reverse/responder), or `INTERNAL` (unknown)

## Example Span (OTLP JSON)

Below is an example of what a flow span might look like in OTLP JSON format.

{% code fullWidth="false" %}

```json
{
  "name": "flow_ipv4_tcp",
  "kind": "SPAN_KIND_CLIENT",
  "startTimeUnixNano": "1727149620000000000",
  "endTimeUnixNano": "1727149680000000000",
  "attributes": [
    { "key": "flow.community_id", "value": { "stringValue": "1:LQU9qZlK+B+2dM2I2n1kI/M5a/g=" } },
    { "key": "flow.direction", "value": { "stringValue": "forward" } },
    { "key": "flow.end_reason", "value": { "stringValue": "active_timeout" } },
    { "key": "flow.bytes.delta", "value": { "intValue": "1024" } },
    { "key": "flow.packets.delta", "value": { "intValue": "10" } },
    { "key": "flow.reverse.bytes.delta", "value": { "intValue": "32768" } },
    { "key": "flow.reverse.packets.delta", "value": { "intValue": "85" } },
    { "key": "source.address", "value": { "stringValue": "10.1.1.5" } },
    { "key": "source.port", "value": { "intValue": "54211" } },
    { "key": "source.k8s.pod.name", "value": { "stringValue": "frontend-abcde" } },
    { "key": "source.k8s.namespace.name", "value": { "stringValue": "production" } },
    { "key": "destination.address", "value": { "stringValue": "10.1.2.10" } },
    { "key": "destination.port", "value": { "intValue": "80" } },
    { "key": "destination.k8s.pod.name", "value": { "stringValue": "backend-xyz" } },
    { "key": "destination.k8s.namespace.name", "value": { "stringValue": "production" } },
    { "key": "network.transport", "value": { "stringValue": "tcp" } },
    { "key": "network.type", "value": { "stringValue": "ipv4" } },
    { "key": "flow.tcp.flags.bits", "value": { "intValue": "18" } },
    { "key": "flow.tcp.flags.tags", "value": { "arrayValue": { "values": [
      { "stringValue": "SYN" },
      { "stringValue": "ACK" }
    ]}}},
    { "key": "flow.reverse.tcp.flags.bits", "value": { "intValue": "18" } },
    { "key": "flow.reverse.tcp.flags.tags", "value": { "arrayValue": { "values": [
      { "stringValue": "SYN" },
      { "stringValue": "ACK" }
    ]}}},
    { "key": "flow.tcp.rndtrip.latency", "value": { "intValue": "2500000" } }
  ]
}
```

{% endcode %}

## Requirement Level Legend

The following symbols are used in the "Required" column to indicate [OpenTelemetry attribute requirement levels](https://opentelemetry.io/docs/specs/semconv/general/attribute-requirement-level/):

<table><thead><tr><th width="99.93359375">Symbol</th><th width="199.79296875">Requirement Level</th><th>Description</th></tr></thead><tbody><tr><td>✓</td><td>Required</td><td>All instrumentations MUST populate the attribute</td></tr><tr><td>?</td><td>Conditionally Required</td><td>MUST populate when the specified condition is satisfied</td></tr><tr><td>~</td><td>Recommended</td><td>SHOULD add by default if readily available and efficient</td></tr><tr><td>○</td><td>Opt-In</td><td>SHOULD populate only if user configures instrumentation to do so</td></tr></tbody></table>

## General Flow Attributes

> Note on Timestamps: The span's standard `start_time_unix_nano` and `end_time_unix_nano` fields are used to mark the beginning and end of the flow span's observation window. These are analogous to the `flowStart*` and `flowEnd*` fields in IPFIX records and are not duplicated as attributes.

<table data-full-width="true"><thead><tr><th>Proposed Field Name</th><th width="96.08203125">Data Type</th><th>Description</th><th>Notes / Decisions</th><th width="96.21875">Std OTel</th><th width="96.0078125">Required</th></tr></thead><tbody><tr><td><code>flow.community_id</code></td><td><code>string</code></td><td>The Community ID hash of the flow's five-tuple.</td><td>A common way to identify a network flow across different monitoring points.</td><td></td><td>✓</td></tr><tr><td><code>flow.direction</code></td><td><code>string</code></td><td>The inferred direction of the flow from the observer's perspective.</td><td>One of: <code>forward</code>, <code>reverse</code>, or <code>unknown</code>. Mirrors IPFIX biflow concepts. See <a href="https://github.com/elastiflow/mermin/blob/main/docs/.gitbook/includes/semantic-conventions.md#flow-direction">Flow Direction</a> for details.</td><td></td><td>✓</td></tr><tr><td><code>flow.connection.state</code></td><td><code>string</code></td><td>The state of the connection (e.g., TCP state) at the time the flow was generated.</td><td>For TCP, this would be one of the standard states like <code>established</code>, <code>time_wait</code>, etc. Similar to network.connection.state but from a flow perspective.</td><td></td><td>? TCP only</td></tr><tr><td><code>flow.end_reason</code></td><td><code>string</code></td><td>The reason the flow record was exported (e.g., <code>active_timeout</code>, <code>end_of_flow_detected</code>).</td><td>Stored as a human-readable text enum based on <a href="https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-flow-end-reason">ipfix end reason</a>.</td><td></td><td>✓</td></tr></tbody></table>

## L2-L4 Attributes

<table data-full-width="true"><thead><tr><th>Proposed Field Name</th><th width="95.9921875">Data Type</th><th>Description</th><th>Notes / Decisions</th><th width="96.04296875">Std OTel</th><th width="95.78125">Required</th></tr></thead><tbody><tr><td><code>source.address</code></td><td><code>string</code></td><td>Source IP address.</td><td></td><td>✓</td><td>✓</td></tr><tr><td><code>source.port</code></td><td><code>long</code></td><td>Source port number.</td><td></td><td>✓</td><td>✓</td></tr><tr><td><code>destination.address</code></td><td><code>string</code></td><td>Destination IP address.</td><td></td><td>✓</td><td>✓</td></tr><tr><td><code>destination.port</code></td><td><code>long</code></td><td>Destination port number.</td><td></td><td>✓</td><td>✓</td></tr><tr><td><code>network.transport</code></td><td><code>string</code></td><td>The transport protocol of the flow (e.g., <code>tcp</code>, <code>udp</code>).</td><td>Lowercase IANA protocol name string.</td><td>✓</td><td>✓</td></tr><tr><td><code>network.type</code></td><td><code>string</code></td><td>The network protocol type (EtherType) of the flow (e.g., <code>ipv4</code>, <code>ipv6</code>).</td><td></td><td>✓</td><td>✓</td></tr><tr><td><code>network.interface.index</code></td><td><code>long</code></td><td>The index value of the network interface where the flow was observed.</td><td></td><td>✓</td><td>~</td></tr><tr><td><code>network.interface.name</code></td><td><code>string</code></td><td>The name of the network interface where the flow was observed.</td><td></td><td>✓</td><td>~</td></tr><tr><td><code>network.interface.mac</code></td><td><code>string</code></td><td>Source MAC address.</td><td>Lowercased, 6 hexadecimal values separated by colons.</td><td></td><td>~</td></tr><tr><td><code>flow.ip.dscp.id</code></td><td><code>long</code></td><td>Differentiated Services Code Point (DSCP) value from the IP header (forward direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.ip.dscp.name</code></td><td><code>string</code></td><td>Lowercase DSCP standard name (forward direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.ip.ecn.id</code></td><td><code>long</code></td><td>Explicit Congestion Notification (ECN) value from the IP header (forward direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.ip.ecn.name</code></td><td><code>string</code></td><td>Lowercase ECN standard name (forward direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.ip.ttl</code></td><td><code>long</code></td><td>Time to Live (IPv4) or Hop Limit (IPv6) value (forward direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.ip.flow_label</code></td><td><code>long</code></td><td>Flow Label from the IPv6 header (forward direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.ip.dscp.id</code></td><td><code>long</code></td><td>Differentiated Services Code Point (DSCP) value from the IP header (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.ip.dscp.name</code></td><td><code>string</code></td><td>Lowercase DSCP standard name (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.ip.ecn.id</code></td><td><code>long</code></td><td>Explicit Congestion Notification (ECN) value from the IP header (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.ip.ecn.name</code></td><td><code>string</code></td><td>Lowercase ECN standard name (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.ip.ttl</code></td><td><code>long</code></td><td>Time to Live (IPv4) or Hop Limit (IPv6) value (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.ip.flow_label</code></td><td><code>long</code></td><td>Flow Label from the IPv6 header (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.icmp.type.id</code></td><td><code>long</code></td><td>ICMP message type id.</td><td>Based on IANA standard names.</td><td></td><td>~</td></tr><tr><td><code>flow.icmp.type.name</code></td><td><code>string</code></td><td>Lowercase ICMP message type name.</td><td>Based on IANA standard names.</td><td></td><td>~</td></tr><tr><td><code>flow.icmp.code.id</code></td><td><code>long</code></td><td>ICMP message code id.</td><td>Based on IANA standard names.</td><td></td><td>~</td></tr><tr><td><code>flow.icmp.code.name</code></td><td><code>string</code></td><td>ICMP message code name.</td><td>Based on IANA standard names.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.icmp.type.id</code></td><td><code>long</code></td><td>ICMP message type id (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.icmp.type.name</code></td><td><code>string</code></td><td>Lowercase ICMP message type name (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.icmp.code.id</code></td><td><code>long</code></td><td>ICMP message code id (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.icmp.code.name</code></td><td><code>string</code></td><td>ICMP message code name (reverse direction).</td><td>First packet per direction per export interval. Reset between exports.</td><td></td><td>~</td></tr><tr><td><code>flow.tcp.flags.bits</code></td><td><code>long</code></td><td>The integer representation of all TCP flags seen during the observation window.</td><td>Accumulated across entire flow lifetime (never reset).</td><td></td><td>~</td></tr><tr><td><code>flow.tcp.flags.tags</code></td><td><code>string[]</code></td><td>An array of TCP flag names (e.g., <code>["SYN", "ACK"]</code>) for all flags set.</td><td>Accumulated across entire flow lifetime (never reset).</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.tcp.flags.bits</code></td><td><code>long</code></td><td>The integer representation of all TCP flags seen in reverse direction.</td><td>Accumulated across entire flow lifetime (never reset).</td><td></td><td>~</td></tr><tr><td><code>flow.reverse.tcp.flags.tags</code></td><td><code>string[]</code></td><td>An array of TCP flag names for reverse direction (e.g., <code>["SYN", "ACK"]</code>).</td><td>Accumulated across entire flow lifetime (never reset).</td><td></td><td>~</td></tr></tbody></table>

## Flow Metrics

<table data-full-width="true"><thead><tr><th>Proposed Field Name</th><th width="95.57421875">Data Type</th><th>Description</th><th>Notes / Decisions</th><th width="95.93359375">Std OTel</th><th width="95.9453125">Required</th></tr></thead><tbody><tr><td><code>flow.bytes.delta</code></td><td><code>long</code></td><td>Number of bytes observed in the last measurement interval for the flow.</td><td></td><td></td><td>✓</td></tr><tr><td><code>flow.bytes.total</code></td><td><code>long</code></td><td>Total number of bytes observed for this flow since its start.</td><td>The term <code>bytes</code> is preferred over <code>octets</code> for clarity.</td><td></td><td>~</td></tr><tr><td><code>flow.packets.delta</code></td><td><code>long</code></td><td>Number of packets observed in the last measurement interval for the flow.</td><td></td><td></td><td>✓</td></tr><tr><td><code>flow.packets.total</code></td><td><code>long</code></td><td>Total number of packets observed for this flow since its start.</td><td></td><td></td><td>~</td></tr><tr><td><code>flow.reverse.bytes.delta</code></td><td><code>long</code></td><td>Delta bytes in the reverse direction of the flow.</td><td></td><td></td><td>✓</td></tr><tr><td><code>flow.reverse.bytes.total</code></td><td><code>long</code></td><td>Total bytes in the reverse direction of the flow since its start.</td><td></td><td></td><td>~</td></tr><tr><td><code>flow.reverse.packets.delta</code></td><td><code>long</code></td><td>Delta packets in the reverse direction of the flow.</td><td></td><td></td><td>✓</td></tr><tr><td><code>flow.reverse.packets.total</code></td><td><code>long</code></td><td>Total packets in the reverse direction of the flow since its start.</td><td></td><td></td><td>~</td></tr></tbody></table>

## Performance Metrics

Time-based metrics calculated for the flow, stored in nanoseconds (`ns`).

<table data-full-width="true"><thead><tr><th>Proposed Field Name</th><th width="95.625">Data Type</th><th>Description</th><th>Notes / Decisions</th><th width="96.4140625">Std OTel</th><th width="95.51953125">Required</th></tr></thead><tbody><tr><td><code>flow.tcp.handshake.latency</code></td><td><code>long</code></td><td>The latency of the first part of the TCP handshake (SYN to SYN/ACK), from the <strong>client's perspective</strong>. (Server network delay)</td><td>Unit: <code>ns</code>.</td><td></td><td>~</td></tr><tr><td><code>flow.tcp.svc.latency</code></td><td><code>long</code></td><td>The application/service processing time, as measured on the <strong>server side</strong>.</td><td>Unit: <code>ns</code>.</td><td></td><td>~</td></tr><tr><td><code>flow.tcp.svc.jitter</code></td><td><code>long</code></td><td>The jitter of the application/service processing time, as measured on the <strong>server side</strong>.</td><td>Unit: <code>ns</code>.</td><td></td><td>~</td></tr><tr><td><code>flow.tcp.rndtrip.latency</code></td><td><code>long</code></td><td>The full round-trip time (client to server + app to client), from the <strong>client's perspective</strong>.</td><td>Unit: <code>ns</code>.</td><td></td><td>~</td></tr><tr><td><code>flow.tcp.rndtrip.jitter</code></td><td><code>long</code></td><td>The jitter of the full round-trip time, from the <strong>client's perspective</strong>.</td><td>Unit: <code>ns</code>.</td><td></td><td>~</td></tr></tbody></table>

## Tunnel & Ip-in-Ip & IPSec Attributes

<table data-full-width="true"><thead><tr><th>Proposed Field Name</th><th width="95.73828125">Data Type</th><th>Description</th><th>Notes / Decisions</th><th width="96.20703125">Std OTel</th><th width="95.76953125">Required</th></tr></thead><tbody><tr><td><code>flow.ipsec.ah.spi</code></td><td><code>long</code></td><td>Security Parameters Index for AH headers.</td><td>SPI from the outermost header (after a tunnel)</td><td></td><td>○</td></tr><tr><td><code>flow.ipsec.esp.spi</code></td><td><code>long</code></td><td>Security Parameters Index for ESP headers.</td><td>SPI from the outermost header (after a tunnel)</td><td></td><td>○</td></tr><tr><td><code>flow.ipsec.sender_index</code></td><td><code>long</code></td><td>The sender index from a WireGuard header.</td><td></td><td></td><td>○</td></tr><tr><td><code>flow.ipsec.receiver_index</code></td><td><code>long</code></td><td>The receiver index from a WireGuard header.</td><td></td><td></td><td>○</td></tr><tr><td><code>ipip.network.type</code></td><td><code>string</code></td><td>The network protocol type (EtherType) of the flow (e.g., <code>ipv4</code>, <code>ipv6</code>).</td><td></td><td></td><td>○</td></tr><tr><td><code>ipip.network.transport</code></td><td><code>string</code></td><td>The transport protocol of the encapsulated flow (e.g., <code>tcp</code>, <code>udp</code>).</td><td></td><td></td><td>○</td></tr><tr><td><code>ipip.source.address</code></td><td><code>string</code></td><td>The source IP address of the tunnel's outer header.</td><td>Ip-in-Ip is always the outermost header.</td><td></td><td>○</td></tr><tr><td><code>ipip.destination.address</code></td><td><code>string</code></td><td>The destination IP address of the tunnel's outer header.</td><td></td><td></td><td>○</td></tr><tr><td><code>ipip.bytes.delta</code></td><td><code>long</code></td><td>Number of outer header bytes observed in the last measurement interval.</td><td></td><td></td><td>? IP-in-IP present</td></tr><tr><td><code>ipip.bytes.total</code></td><td><code>long</code></td><td>Total number of outer header bytes observed since flow start.</td><td>The term <code>bytes</code> is preferred over <code>octets</code> for clarity.</td><td></td><td>~</td></tr><tr><td><code>ipip.reverse.bytes.delta</code></td><td><code>long</code></td><td>Delta outer header bytes in the reverse direction.</td><td></td><td></td><td>? IP-in-IP present</td></tr><tr><td><code>ipip.reverse.bytes.total</code></td><td><code>long</code></td><td>Total outer header bytes in the reverse direction since flow start.</td><td></td><td></td><td>~</td></tr><tr><td><code>tunnel.type</code></td><td><code>string</code></td><td>The type of tunnel protocol (e.g., <code>vxlan</code>, <code>geneve</code>, <code>gre</code>).</td><td>Tunnel is always the outermost header.</td><td></td><td>○</td></tr><tr><td><code>tunnel.network.interface.mac</code></td><td><code>string</code></td><td>Source MAC address of tunnel.</td><td>Lowercased, 6 hexadecimal values separated by colons.</td><td></td><td>~</td></tr><tr><td><code>tunnel.network.type</code></td><td><code>string</code></td><td>The network protocol type (EtherType) of the flow (e.g., <code>ipv4</code>, <code>ipv6</code>).</td><td></td><td></td><td>○</td></tr><tr><td><code>tunnel.network.transport</code></td><td><code>string</code></td><td>The transport protocol of the flow (e.g., <code>tcp</code>, <code>udp</code>).</td><td></td><td></td><td>○</td></tr><tr><td><code>tunnel.source.address</code></td><td><code>string</code></td><td>The source IP address of the tunnel's outer header.</td><td></td><td></td><td>○</td></tr><tr><td><code>tunnel.source.port</code></td><td><code>long</code></td><td>The source port of the tunnel's outer header.</td><td></td><td></td><td>○</td></tr><tr><td><code>tunnel.destination.address</code></td><td><code>string</code></td><td>The destination IP address of the tunnel's outer header.</td><td></td><td></td><td>○</td></tr><tr><td><code>tunnel.destination.port</code></td><td><code>long</code></td><td>The destination port of the tunnel's outer header.</td><td></td><td></td><td>○</td></tr><tr><td><code>tunnel.id</code></td><td><code>string</code></td><td>The identifier for the tunnel (e.g., VNI for VXLAN/Geneve, Key ID for GRE).</td><td></td><td></td><td>○</td></tr><tr><td><code>tunnel.ipsec.ah.spi</code></td><td><code>long</code></td><td>Security Parameters Index for AH headers.</td><td>SPI from the outermost header.</td><td></td><td>○</td></tr><tr><td><code>tunnel.ipsec.esp.spi</code></td><td><code>long</code></td><td>Security Parameters Index for ESP headers.</td><td>SPI from the outermost header.</td><td></td><td>○</td></tr><tr><td><code>tunnel.bytes.delta</code></td><td><code>long</code></td><td>Number of tunnel overhead bytes observed in the last measurement interval.</td><td></td><td></td><td>? tunnel present</td></tr><tr><td><code>tunnel.bytes.total</code></td><td><code>long</code></td><td>Total number of tunnel overhead bytes observed since flow start.</td><td>The term <code>bytes</code> is preferred over <code>octets</code> for clarity.</td><td></td><td>~</td></tr><tr><td><code>tunnel.reverse.bytes.delta</code></td><td><code>long</code></td><td>Delta tunnel overhead bytes in the reverse direction.</td><td></td><td></td><td>? tunnel present</td></tr><tr><td><code>tunnel.reverse.bytes.total</code></td><td><code>long</code></td><td>Total tunnel overhead bytes in the reverse direction since flow start.</td><td></td><td></td><td>~</td></tr></tbody></table>

## Kubernetes Attributes

> **Note:** These attributes use `source.k8s.*` / `destination.k8s.*` prefixes rather than standard OTel `k8s.*` attributes. See [Why `source.k8s.*` Instead of `k8s.source.*`?](https://github.com/elastiflow/mermin/blob/main/docs/.gitbook/includes/semantic-conventions.md#why-sourcek8s-instead-of-k8ssource) for the rationale.

<table data-full-width="true"><thead><tr><th>Proposed Field Name</th><th width="96.2421875">Data Type</th><th>Description</th><th>Notes / Decisions</th><th width="96.04296875">Std OTel</th><th width="96.25">Required</th></tr></thead><tbody><tr><td><code>source.k8s.cluster.name</code></td><td><code>string</code></td><td>The name of the Kubernetes cluster for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.cluster.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes cluster for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.node.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Node for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.node.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Node for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.node.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source Node.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.namespace.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Namespace for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.pod.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Pod for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.pod.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Pod for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.pod.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source Pod.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.container.name</code></td><td><code>string</code></td><td>The name of the Container from Pod specification.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.deployment.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Deployment for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.deployment.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Deployment for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.deployment.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source Deployment.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.replicaset.name</code></td><td><code>string</code></td><td>The name of the Kubernetes ReplicaSet for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.replicaset.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes ReplicaSet for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.replicaset.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source ReplicaSet.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.statefulset.name</code></td><td><code>string</code></td><td>The name of the Kubernetes StatefulSet for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.statefulset.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes StatefulSet for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.statefulset.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source StatefulSet.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.daemonset.name</code></td><td><code>string</code></td><td>The name of the Kubernetes DaemonSet for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.daemonset.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes DaemonSet for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.daemonset.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source DaemonSet.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.job.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Job for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.job.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Job for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.job.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source Job.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.cronjob.name</code></td><td><code>string</code></td><td>The name of the Kubernetes CronJob for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.cronjob.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes CronJob for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.cronjob.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source CronJob.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.service.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Service for the source.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>source.k8s.service.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Service for the source.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>source.k8s.service.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the source Service.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.cluster.name</code></td><td><code>string</code></td><td>The name of the Kubernetes cluster for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.cluster.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes cluster for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.node.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Node for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.node.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Node for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.node.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination Node.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.namespace.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Namespace for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.pod.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Pod for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.pod.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Pod for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.pod.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination Pod.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.container.name</code></td><td><code>string</code></td><td>The name of the Container from Pod specification.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.deployment.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Deployment for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.deployment.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Deployment for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.deployment.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination Deployment.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.replicaset.name</code></td><td><code>string</code></td><td>The name of the Kubernetes ReplicaSet for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.replicaset.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes ReplicaSet for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.replicaset.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination ReplicaSet.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.statefulset.name</code></td><td><code>string</code></td><td>The name of the Kubernetes StatefulSet for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.statefulset.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes StatefulSet for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.statefulset.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination StatefulSet.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.daemonset.name</code></td><td><code>string</code></td><td>The name of the Kubernetes DaemonSet for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.daemonset.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes DaemonSet for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.daemonset.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination DaemonSet.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.job.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Job for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.job.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Job for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.job.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination Job.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.cronjob.name</code></td><td><code>string</code></td><td>The name of the Kubernetes CronJob for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.cronjob.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes CronJob for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.cronjob.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination CronJob.</td><td>Flattened map.</td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.service.name</code></td><td><code>string</code></td><td>The name of the Kubernetes Service for the destination.</td><td></td><td>~</td><td>~</td></tr><tr><td><code>destination.k8s.service.uid</code></td><td><code>string</code></td><td>The UID of the Kubernetes Service for the destination.</td><td></td><td>~</td><td>○</td></tr><tr><td><code>destination.k8s.service.annotations.&#x3C;key></code></td><td><code>string</code></td><td>Dynamic annotations from the destination Service.</td><td>Flattened map.</td><td>~</td><td>○</td></tr></tbody></table>

## Network Policy Attributes

<table data-full-width="true"><thead><tr><th>Proposed Field Name</th><th width="96.06640625">Data Type</th><th>Description</th><th>Notes / Decisions</th><th width="95.69140625">Std OTel</th><th width="96.390625">Required</th></tr></thead><tbody><tr><td><code>network.policy.ingress</code></td><td><code>string[]</code></td><td>A list of network policy names affecting ingress traffic.</td><td>This could be multiple policies.</td><td></td><td>○</td></tr><tr><td><code>network.policy.egress</code></td><td><code>string[]</code></td><td>A list of network policy names affecting egress traffic.</td><td>This could be multiple policies.</td><td></td><td>○</td></tr></tbody></table>

## Process & Container Attributes

<table data-full-width="true"><thead><tr><th>Proposed Field Name</th><th width="95.671875">Data Type</th><th>Description</th><th>Notes / Decisions</th><th width="96.1015625">Std OTel</th><th width="95.71875">Required</th></tr></thead><tbody><tr><td><code>process.executable.name</code></td><td><code>string</code></td><td>The name of the binary associated with the socket for this flow.</td><td>Provides application-level identification.</td><td>✓</td><td>~</td></tr><tr><td><code>process.pid</code></td><td><code>long</code></td><td>The PID of the process associated with the socket for this flow.</td><td>Provides application-level identification.</td><td>✓</td><td>~</td></tr><tr><td><code>source.container.name</code></td><td><code>string</code></td><td>The container runtime name for the source (e.g., from Docker/containerd).</td><td>Distinct from <code>source.k8s.container.name</code>.</td><td>✓</td><td>~</td></tr><tr><td><code>source.container.image.name</code></td><td><code>string</code></td><td>The image name of the source container (e.g., <code>nginx:1.21</code>).</td><td>From K8s Pod spec container image.</td><td></td><td>~</td></tr><tr><td><code>destination.container.name</code></td><td><code>string</code></td><td>The container runtime name for the destination.</td><td>Distinct from <code>destination.k8s.container.name</code>.</td><td>✓</td><td>~</td></tr><tr><td><code>destination.container.image.name</code></td><td><code>string</code></td><td>The image name of the destination container (e.g., <code>app:v1.0.0</code>).</td><td>From K8s Pod spec container image.</td><td></td><td>~</td></tr></tbody></table>

***

## Next Steps

{% tabs %}
{% tab title="Learn More" %}

1. [**Explore the Full Specification**](/concepts/semantic-conventions.md): Design rationale and detailed semantics
2. [**Understand How Flows Are Generated**](/concepts/agent-architecture.md): Agent architecture and data flow
   {% endtab %}

{% tab title="Use Flow Traces" %}

1. [**Query Flow Traces in Your Backend**](/getting-started/backend-integrations.md): Use these attributes in your observability platform
2. [**Configure Filters**](/configuration/reference/flow-span-filters.md): Filter flows by attribute values
   {% endtab %}
   {% endtabs %}

### Need Help?

* [**GitHub Discussions**](https://github.com/elastiflow/mermin/discussions): Ask about specific attributes


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.mermin.dev/getting-started/attribute-reference.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.