# Metrics schema

The following list shows the metrics labels related to the [message schema](../../docs/axoflow/reference/message-schema/overview/index.md). You can use these metrics labels:

  * on the [analytics pages](../../docs/axoflow/metrics/analytics/index.md), and
  * in [log tapping](../../docs/axoflow/onboard-hosts/log-tapping/index.md) filters.



## auto_classified_service

**Type:** string   
**Related schema element:** [meta.classified.service.name](../../../message-schema/reference/index.md#meta.classified.service.name)

Classified service Name for appliance. 

## dest_ip

**Type:** string   
**Related schema element:** [meta.connection.dest_ip](../../../message-schema/reference/index.md#meta.connection.dest_ip)

IP address where the message was sent to according to the IP header. 

## dest_port

**Type:** number   
**Related schema element:** [meta.connection.dest_port](../../../message-schema/reference/index.md#meta.connection.dest_port)

TCP or UDP port number where the message was sent to according to the transport header. 

## ip_protocol

**Type:** number   
**Related schema element:** [meta.connection.ip_protocol](../../../message-schema/reference/index.md#meta.connection.ip_protocol)

Network protocol version used for receiving this message. 

## protocol

**Type:** string   
**Related schema element:** [meta.connection.protocol](../../../message-schema/reference/index.md#meta.connection.protocol)

Transport protocol used for receiving this message. 

## src_ip

**Type:** string   
**Related schema element:** [meta.connection.src_ip](../../../message-schema/reference/index.md#meta.connection.src_ip)

IP address that sent the message according to the IP header. 

## transport

**Type:** string   
**Related schema element:** [meta.connection.transport](../../../message-schema/reference/index.md#meta.connection.transport)

The transport mechanism used to retrieve or receive the message. 

## connector_label_labels

**Type:** object   
**Related schema element:** [meta.connector.labels](../../../message-schema/reference/index.md#meta.connector.labels)

Labels set on the connector that received the message. 

## connector_name

**Type:** string   
**Related schema element:** [meta.connector.name](../../../message-schema/reference/index.md#meta.connector.name)

The name of the connector that received the log. The name of the connector instance follows the `<name-of-AxoRouter>-<name-of-connector-rule>-<suffix>` schema. For details, see [Connector rules](../../docs/axoflow/data-sources/connector-rules/index.md). 

## connector_type

**Type:** string   
**Related schema element:** [meta.connector.type](../../../message-schema/reference/index.md#meta.connector.type)

The type of the connector that received the message. 

## axostore_axostore

**Type:** object   
**Related schema element:** [meta.destination.axostore](../../../message-schema/reference/index.md#meta.destination.axostore)

Parameters for sending the message to an AxoStore destination. 

## axostore_body_raw

**Type:** boolean   
**Related schema element:** [meta.destination.axostore.body_raw](../../../message-schema/reference/index.md#meta.destination.axostore.body_raw)

Override the option to send the raw message body to the AxoStore destination. (default: false) 

## axostore_meta_raw

**Type:** boolean   
**Related schema element:** [meta.destination.axostore.meta_raw](../../../message-schema/reference/index.md#meta.destination.axostore.meta_raw)

Override the option to send raw metadata to AxoStore destination. (default: true) 

## clickhouse_clickhouse

**Type:** object   
**Related schema element:** [meta.destination.clickhouse](../../../message-schema/reference/index.md#meta.destination.clickhouse)

Parameters for sending the message to a Clickhouse destination. 

## clickhouse_body_raw

**Type:** boolean   
**Related schema element:** [meta.destination.clickhouse.body_raw](../../../message-schema/reference/index.md#meta.destination.clickhouse.body_raw)

Override the option to send raw body to the Clickhouse destination. (default: false) 

## clickhouse_meta_raw

**Type:** boolean   
**Related schema element:** [meta.destination.clickhouse.meta_raw](../../../message-schema/reference/index.md#meta.destination.clickhouse.meta_raw)

Override the option to send raw metadata to the Clickhouse destination. (default: true) 

## elasticsearch_elasticsearch

**Type:** object   
**Related schema element:** [meta.destination.elasticsearch](../../../message-schema/reference/index.md#meta.destination.elasticsearch)

Parameters for sending the message to an Elasticsearch destination. 

## elasticsearch_fields

**Type:** object   
**Related schema element:** [meta.destination.elasticsearch.fields](../../../message-schema/reference/index.md#meta.destination.elasticsearch.fields)

Fields to send to Elasticsearch. This overrides the default fields set by the destination connector. 

## elasticsearch_index

**Type:** string   
**Related schema element:** [meta.destination.elasticsearch.index](../../../message-schema/reference/index.md#meta.destination.elasticsearch.index)

The Elasticsearch index to send the message to. 

## elasticsearch_message

**Type:** string   
**Related schema element:** [meta.destination.elasticsearch.message](../../../message-schema/reference/index.md#meta.destination.elasticsearch.message)

Override the message to send to Elasticsearch. When set, [`log.body`](../../docs/axoflow/reference/message-schema/reference/index.md#log.body) is ignored. 

## elasticsearch_timestamp

**Type:** string   
**Related schema element:** [meta.destination.elasticsearch.timestamp](../../../message-schema/reference/index.md#meta.destination.elasticsearch.timestamp)

Override the timestamp to send to Elasticsearch. When set, [`log.time_unix_nano`](../../docs/axoflow/reference/message-schema/reference/index.md#log.time_unix_nano) is ignored. 

## googlesecops_google_secops

**Type:** object   
**Related schema element:** [meta.destination.google_secops](../../../message-schema/reference/index.md#meta.destination.google_secops)

Parameters for sending the message to a Google SecOps destination. 

## googlesecops_customer_id

**Type:** string   
**Related schema element:** [meta.destination.google_secops.customer_id](../../../message-schema/reference/index.md#meta.destination.google_secops.customer_id)

This overrides the default customer ID configured in the destination connector. 

## googlesecops_labels

**Type:** object   
**Related schema element:** [meta.destination.google_secops.labels](../../../message-schema/reference/index.md#meta.destination.google_secops.labels)

Labels to send to Google SecOps. This overrides the default labels set by the destination connector. 

## googlesecops_log_text

**Type:** string   
**Related schema element:** [meta.destination.google_secops.log_text](../../../message-schema/reference/index.md#meta.destination.google_secops.log_text)

The text of the message to send to Google SecOps. When set, [`log.body`](../../docs/axoflow/reference/message-schema/reference/index.md#log.body) is ignored. 

## googlesecops_log_type

**Type:** string   
**Related schema element:** [meta.destination.google_secops.log_type](../../../message-schema/reference/index.md#meta.destination.google_secops.log_type)

This overrides the default log type configured in the destination connector. 

## googlesecops_namespace

**Type:** string   
**Related schema element:** [meta.destination.google_secops.namespace](../../../message-schema/reference/index.md#meta.destination.google_secops.namespace)

This overrides the default namespace configured in the destination connector. 

## googlesecops_ts_rfc3339

**Type:** string   
**Related schema element:** [meta.destination.google_secops.ts_rfc3339](../../../message-schema/reference/index.md#meta.destination.google_secops.ts_rfc3339)

The timestamp of the message in RFC3339 format. When set, [`log.time_unix_nano`](../../docs/axoflow/reference/message-schema/reference/index.md#log.time_unix_nano) is ignored. 

## destination_name

**Type:** string   
**Related schema element:** [meta.destination.name](../../../message-schema/reference/index.md#meta.destination.name)

Name of the destination where AxoRouter sent the message. 

## openobserve_openobserve

**Type:** object   
**Related schema element:** [meta.destination.openobserve](../../../message-schema/reference/index.md#meta.destination.openobserve)

Parameters for sending the message to an OpenObserve destination. 

## openobserve_fields

**Type:** object   
**Related schema element:** [meta.destination.openobserve.fields](../../../message-schema/reference/index.md#meta.destination.openobserve.fields)

Fields to send to OpenObserve. This overrides the default fields set by the destination connector. 

## openobserve_message

**Type:** string   
**Related schema element:** [meta.destination.openobserve.message](../../../message-schema/reference/index.md#meta.destination.openobserve.message)

Override the message to send to OpenObserve. When set, [`log.body`](../../docs/axoflow/reference/message-schema/reference/index.md#log.body) is ignored. 

## openobserve_organization

**Type:** string   
**Related schema element:** [meta.destination.openobserve.organization](../../../message-schema/reference/index.md#meta.destination.openobserve.organization)

The OpenObserve organization to send the message to. 

## openobserve_stream

**Type:** string   
**Related schema element:** [meta.destination.openobserve.stream](../../../message-schema/reference/index.md#meta.destination.openobserve.stream)

The OpenObserve stream to send the message to. 

## openobserve_timestamp

**Type:** string   
**Related schema element:** [meta.destination.openobserve.timestamp](../../../message-schema/reference/index.md#meta.destination.openobserve.timestamp)

Override the timestamp to send to OpenObserve. When set, [`log.time_unix_nano`](../../docs/axoflow/reference/message-schema/reference/index.md#log.time_unix_nano) is ignored. 

## pubsub_pubsub

**Type:** object   
**Related schema element:** [meta.destination.pubsub](../../../message-schema/reference/index.md#meta.destination.pubsub)

Parameters for sending the message to a Google PubSub destination. 

## pubsub_attributes

**Type:** object   
**Related schema element:** [meta.destination.pubsub.attributes](../../../message-schema/reference/index.md#meta.destination.pubsub.attributes)

Override the attributes key-value pairs for the Pub/Sub Event. 

## pubsub_data

**Type:** string   
**Related schema element:** [meta.destination.pubsub.data](../../../message-schema/reference/index.md#meta.destination.pubsub.data)

Override the data to send to Google Pub/Sub. When set, [`log.body`](../../docs/axoflow/reference/message-schema/reference/index.md#log.body) is ignored. 

## pubsub_project

**Type:** string   
**Related schema element:** [meta.destination.pubsub.project](../../../message-schema/reference/index.md#meta.destination.pubsub.project)

The ID of the Google Cloud project where the data is sent. 

## pubsub_topic

**Type:** string   
**Related schema element:** [meta.destination.pubsub.topic](../../../message-schema/reference/index.md#meta.destination.pubsub.topic)

The name of the Google Pub/Sub topic to send the data to. 

## splunk_splunk

**Type:** object   
**Related schema element:** [meta.destination.splunk](../../../message-schema/reference/index.md#meta.destination.splunk)

Parameters for sending the message to a Splunk destination. 

## splunk_event

**Type:** string   
**Related schema element:** [meta.destination.splunk.event](../../../message-schema/reference/index.md#meta.destination.splunk.event)

The raw event sent to Splunk. Overrides [`log.body`](../../docs/axoflow/reference/message-schema/reference/index.md#log.body) and avoids automatic formatting completely. 

## splunk_fields

**Type:** object   
**Related schema element:** [meta.destination.splunk.fields](../../../message-schema/reference/index.md#meta.destination.splunk.fields)

Fields to send to Splunk. This overrides the default fields set by the destination connector. 

## splunk_host

**Type:** string   
**Related schema element:** [meta.destination.splunk.host](../../../message-schema/reference/index.md#meta.destination.splunk.host)

The name of the host as sent to Splunk. Usually, this is the hostname of the source where the data originated from. 

## splunk_index

**Type:** string   
**Related schema element:** [meta.destination.splunk.index](../../../message-schema/reference/index.md#meta.destination.splunk.index)

The name of the Splunk index where the message is sent. The index must exist in Splunk, otherwise sending the data will fail. 

## splunk_source

**Type:** string   
**Related schema element:** [meta.destination.splunk.source](../../../message-schema/reference/index.md#meta.destination.splunk.source)

The source field sent to Splunk, containing where the event originated. For example, the protocol and port for network-based sources, or the path and filename for log files. 

## splunk_sourcetype

**Type:** string   
**Related schema element:** [meta.destination.splunk.sourcetype](../../../message-schema/reference/index.md#meta.destination.splunk.sourcetype)

The Splunk sourcetype value that corresponds to appliance, application, or service that generated the data. 

## splunk_time

**Type:** string   
**Related schema element:** [meta.destination.splunk.time](../../../message-schema/reference/index.md#meta.destination.splunk.time)

Override the time sent to Splunk. When set, [log.time_unix_nano](../../docs/axoflow/reference/message-schema/reference/index.md#log.time_unix_nano) is ignored. 

## destination_type

**Type:** string   
**Related schema element:** [meta.destination.type](../../../message-schema/reference/index.md#meta.destination.type)

Type of the destination, for example, `splunkHEC`. 

## edge_connector_label_labels

**Type:** object   
**Related schema element:** [meta.edge.connector.labels](../../../message-schema/reference/index.md#meta.edge.connector.labels)

Labels set on the edge connector that sent the message. 

## edge_connector_name

**Type:** string   
**Related schema element:** [meta.edge.connector.name](../../../message-schema/reference/index.md#meta.edge.connector.name)

The name of the edge connector that sent the message. 

## edge_connector_rule_id

**Type:** string   
**Related schema element:** [meta.edge.connector.rule_id](../../../message-schema/reference/index.md#meta.edge.connector.rule_id)

The ID of the owner ConnectorRule resource in Axoflow that created the edge connector. 

## edge_connector_type

**Type:** string   
**Related schema element:** [meta.edge.connector.type](../../../message-schema/reference/index.md#meta.edge.connector.type)

The type of the edge connector that sent the message. 

## edge_flow_name

**Type:** string   
**Related schema element:** [meta.edge.flow.name](../../../message-schema/reference/index.md#meta.edge.flow.name)

The name of the edge forwarding rule that sent the message. 

## flow

**Type:** string   
**Related schema element:** [meta.flow](../../../message-schema/reference/index.md#meta.flow)

Name of the flow processing the message. 

## host_label_labels

**Type:** object   
**Related schema element:** [meta.host.labels](../../../message-schema/reference/index.md#meta.host.labels)

The labels set in the inventory for the host the message originates from. Note that if the host is sending data to an AxoRouter connector that doesn’t perform automatic classification, then changing the product and vendor labels can affect the final metadata in the destination, for example, the sourcetype assigned to the data in Splunk. 

## host_name

**Type:** string   
**Related schema element:** [meta.host.name](../../../message-schema/reference/index.md#meta.host.name)

The name of the host the message originates from (based on the inventory). 

## host_candidate_id

**Type:** string   
**Related schema element:** [meta.host_candidate.id](../../../message-schema/reference/index.md#meta.host_candidate.id)

Device ID found in the message. 

## host_candidate_ip

**Type:** string   
**Related schema element:** [meta.host_candidate.ip](../../../message-schema/reference/index.md#meta.host_candidate.ip)

IP address found in the message. 

## host_candidate_last_hop_name

**Type:** string   
**Related schema element:** [meta.host_candidate.last_hop_name](../../../message-schema/reference/index.md#meta.host_candidate.last_hop_name)

Host field found in the message’s envelope (which can be either the subject of the message, or the name of the host that forwarded it). 

## host_candidate_name

**Type:** string   
**Related schema element:** [meta.host_candidate.name](../../../message-schema/reference/index.md#meta.host_candidate.name)

Host name found in the message. 

## kubernetes_container

**Type:** string   
**Related schema element:** [meta.kubernetes.container](../../../message-schema/reference/index.md#meta.kubernetes.container)

Kubernetes container name found in the message metadata. 

## kubernetes_namespace

**Type:** string   
**Related schema element:** [meta.kubernetes.namespace](../../../message-schema/reference/index.md#meta.kubernetes.namespace)

Name of the Kubernetes namespace found in the message metadata. 

## product

**Type:** string   
**Related schema element:** [meta.product](../../../message-schema/reference/index.md#meta.product)

The product name of the appliance, application, or service that generated the message. 

## axo_host_label_labels

**Type:** object   
**Related schema element:** [meta.router.labels](../../../message-schema/reference/index.md#meta.router.labels)

Labels of the AxoRouter instance that processed the message. 

## axo_host_name

**Type:** string   
**Related schema element:** [meta.router.name](../../../message-schema/reference/index.md#meta.router.name)

The hostname of the AxoRouter instance that processed the message. 

## service

**Type:** string   
**Related schema element:** [meta.service.name](../../../message-schema/reference/index.md#meta.service.name)

Name of the service that generated the message. For syslog messages, that’s usually the value of the PROGRAM field. 

## vendor

**Type:** string   
**Related schema element:** [meta.vendor](../../../message-schema/reference/index.md#meta.vendor)

The vendor of the appliance, application, or service that generated the message.