Primitive Filter Types

eq, ne—Searches flows for equality or inequality respectively in column specified by "field" with value specified by "value". Supports the following fields: src_hostname, dst_hostname, src_address, dst_address, src_port, dst_port, src_scope_name, dst_scope_name, vrf_name, src_enforcement_epg_name, dst_enforcement_epg_name, proto. These operators also work on user labelled columns.

lt, lte, gt, gte—Searches flows where values of column specified by "field" are less than, less than equal to, greater than or greater than equal to (as applicable) the value specified by "value". Supports the following fields: [src_port, dst_port].

range—Searches flows for values of column specified by "field" between range start and range end specified by "values" list (this list must be of size 2 for “range” filter type – first value is the range start and second is the range end). Supports the following fields: [src_port, dst_port].

in—Searches flows for membership in column specified by "field" with membership list specified by "values". Supports the following fields: src_hostname, dst_hostname, src_address, dst_address, src_port, dst_port, src_scope_name, dst_scope_name, vrf_name, src_enforcement_epg_name, dst_enforcement_epg_name, proto. This operator also works on user labelled columns.

regex, contains—Searches flows for regex matches or containment matches respectively in column specified by "field" with regex specified by "value". Supports the following fields: src_hostname, dst_hostname, src_scope_name, dst_scope_name, vrf_name, src_enforcement_epg_name, dst_enforcement_epg_name. These operators also work on user labelled columns. Filters with regex type must use Java style regex patterns as "value".

subnet—Searches flows for subnet membership specified by "field" as a string in CIDR notation. Supports the following fields: ["src_address", "dst_address"]