{"text_format":"3","workbook":"xlsx","n_sheets":2,"sheets":["推荐不入库的字段","E21会话日志字段占比"],"read":"whole","date_system":"1900"}

{"sheet":"推荐不入库的字段","index":0,"n_rows":17,"n_cols":4,"rows_kept":17,"merged":[[16,0,16,3]]}
["字段","压缩前(bytes)","压缩前(TB)","压缩前占比"]
["device_tag",112860813961518,102.6463,{"v":0.0458,"d":"4.58%"}]
["app_transition",33911642179139,30.8425,{"v":0.0138,"d":"1.38%"}]
["tcp_s2c_rtx_pkts",19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_c2s_rtx_bytes",19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_c2s_o3_pkts",19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_s2c_o3_pkts",19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_c2s_rtx_pkts",19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_s2c_ip_fragments",19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_c2s_ip_fragments",19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_c2s_lost_bytes",19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_s2c_lost_bytes",19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_s2c_rtx_bytes",19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["flags_identify_info",16391743534822,14.9082,{"v":0.0067,"d":"0.67%"}]
["ssl_san",9291556091501,8.4506,{"v":0.0038,"d":"0.38%"}]
["app_debug_info",2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["为了缓解clickhouse磁盘IO的压力，推荐以上session record日志字段不写入clickhouse。\n该表格统计字段在clickhouse中占用磁磁盘的大小。"]

{"sheet":"E21会话日志字段占比","index":1,"n_rows":228,"n_cols":7,"rows_kept":228}
["字段","压缩后(bytes)","压缩后(TB)","压缩后占比","压缩前(bytes)","压缩前(TB)","压缩前占比"]
["encapsulation",16637005099608,15.1313,{"v":0.0684,"d":"6.84%"},384797748623671,349.9715,{"v":0.1563,"d":"15.63%"}]
["device_tag",479711992958,0.4363,{"v":0.002,"d":"0.20%"},112860813961518,102.6463,{"v":0.0458,"d":"4.58%"}]
["app_transition",5433702659717,4.9419,{"v":0.0223,"d":"2.23%"},33911642179139,30.8425,{"v":0.0138,"d":"1.38%"}]
["client_ip",13265651184720,12.065,{"v":0.0545,"d":"5.45%"},31871704988221,28.9871,{"v":0.0129,"d":"1.29%"}]
["server_ip",11960824131501,10.8783,{"v":0.0492,"d":"4.92%"},30165119302264,27.435,{"v":0.0123,"d":"1.23%"}]
["in_src_mac",3027342995377,2.7534,{"v":0.0124,"d":"1.24%"},29410068883266,26.7483,{"v":0.0119,"d":"1.19%"}]
["in_dest_mac",3685161699315,3.3516,{"v":0.0151,"d":"1.51%"},29410068883266,26.7483,{"v":0.0119,"d":"1.19%"}]
["out_dest_mac",2942530374269,2.6762,{"v":0.0121,"d":"1.21%"},27821645057709,25.3036,{"v":0.0113,"d":"1.13%"}]
["out_src_mac",3663207443986,3.3317,{"v":0.0151,"d":"1.51%"},27821645057709,25.3036,{"v":0.0113,"d":"1.13%"}]
["sled_ip",900168444905,0.8187,{"v":0.0037,"d":"0.37%"},26087083787323,23.7261,{"v":0.0106,"d":"1.06%"}]
["fqdn_category_list",1915460306101,1.7421,{"v":0.0079,"d":"0.79%"},21931026021520,19.9462,{"v":0.0089,"d":"0.89%"}]
["server_asn",5422245830636,4.9315,{"v":0.0223,"d":"2.23%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_s2c_rtx_pkts",1314904031420,1.1959,{"v":0.0054,"d":"0.54%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_c2s_rtx_bytes",1065581345633,0.9691,{"v":0.0044,"d":"0.44%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_c2s_o3_pkts",1493190783297,1.358,{"v":0.0061,"d":"0.61%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["http_action_file_size",85430849275,0.0777,{"v":0.0004,"d":"0.04%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_s2c_o3_pkts",1991066873067,1.8109,{"v":0.0082,"d":"0.82%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["http_request_content_length",145862687134,0.1327,{"v":0.0006,"d":"0.06%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_c2s_rtx_pkts",1037780725431,0.9439,{"v":0.0043,"d":"0.43%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_client_isn",10519015492727,9.567,{"v":0.0432,"d":"4.32%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_s2c_ip_fragments",938095527808,0.8532,{"v":0.0039,"d":"0.39%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_server_isn",8671033303030,7.8863,{"v":0.0356,"d":"3.56%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["http_response_content_length",175965095723,0.16,{"v":0.0007,"d":"0.07%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_c2s_ip_fragments",844614660427,0.7682,{"v":0.0035,"d":"0.35%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_c2s_lost_bytes",1558892366050,1.4178,{"v":0.0064,"d":"0.64%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["client_asn",928024836797,0.844,{"v":0.0038,"d":"0.38%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_s2c_lost_bytes",2007359063120,1.8257,{"v":0.0083,"d":"0.83%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["tcp_s2c_rtx_bytes",1376273627871,1.2517,{"v":0.0057,"d":"0.57%"},19548332645634,17.7791,{"v":0.0079,"d":"0.79%"}]
["direction",737379245931,0.6706,{"v":0.003,"d":"0.30%"},19357833640456,17.6058,{"v":0.0079,"d":"0.79%"}]
["device_id",356786209313,0.3245,{"v":0.0015,"d":"0.15%"},17647154140111,16.05,{"v":0.0072,"d":"0.72%"}]
["monitor_rule_list",253176336282,0.2303,{"v":0.001,"d":"0.10%"},17626979664248,16.0316,{"v":0.0072,"d":"0.72%"}]
["statistics_rule_list",163706018905,0.1489,{"v":0.0007,"d":"0.07%"},17522310440792,15.9364,{"v":0.0071,"d":"0.71%"}]
["proxy_rule_list",76190374532,0.0693,{"v":0.0003,"d":"0.03%"},17461271943224,15.8809,{"v":0.0071,"d":"0.71%"}]
["security_rule_list",75831522594,0.069,{"v":0.0003,"d":"0.03%"},17380351052440,15.8073,{"v":0.0071,"d":"0.71%"}]
["sc_rule_list",75810595877,0.0689,{"v":0.0003,"d":"0.03%"},17376295685120,15.8036,{"v":0.0071,"d":"0.71%"}]
["shaping_rule_list",75810595877,0.0689,{"v":0.0003,"d":"0.03%"},17376295685120,15.8036,{"v":0.0071,"d":"0.71%"}]
["sc_rsp_raw",75810595880,0.0689,{"v":0.0003,"d":"0.03%"},17376295685104,15.8036,{"v":0.0071,"d":"0.71%"}]
["sc_rsp_decrypted",75810595833,0.0689,{"v":0.0003,"d":"0.03%"},17376295685008,15.8036,{"v":0.0071,"d":"0.71%"}]
["start_timestamp_ms",8948617546678,8.1387,{"v":0.0368,"d":"3.68%"},17376295685008,15.8036,{"v":0.0071,"d":"0.71%"}]
["recv_time",103050310240,0.0937,{"v":0.0004,"d":"0.04%"},17376295685008,15.8036,{"v":0.0071,"d":"0.71%"}]
["ingestion_time",103050310240,0.0937,{"v":0.0004,"d":"0.04%"},17376295685008,15.8036,{"v":0.0071,"d":"0.71%"}]
["sent_bytes",5808780851844,5.2831,{"v":0.0239,"d":"2.39%"},17376295685008,15.8036,{"v":0.0071,"d":"0.71%"}]
["sent_pkts",4691750624171,4.2671,{"v":0.0193,"d":"1.93%"},17376295685008,15.8036,{"v":0.0071,"d":"0.71%"}]
["log_id",9538456015020,8.6752,{"v":0.0392,"d":"3.92%"},17376295685008,15.8036,{"v":0.0071,"d":"0.71%"}]
["processing_time",113255241623,0.103,{"v":0.0005,"d":"0.05%"},17376295685008,15.8036,{"v":0.0071,"d":"0.71%"}]
["insert_time",159650218751,0.1452,{"v":0.0007,"d":"0.07%"},17376295685008,15.8036,{"v":0.0071,"d":"0.71%"}]
["received_bytes",6348179881141,5.7736,{"v":0.0261,"d":"2.61%"},17376295685008,15.8036,{"v":0.0071,"d":"0.71%"}]
["flags",4577661589172,4.1634,{"v":0.0188,"d":"1.88%"},17376295685008,15.8036,{"v":0.0071,"d":"0.71%"}]
["session_id",13847205819824,12.594,{"v":0.0569,"d":"5.69%"},17376295685008,15.8036,{"v":0.0071,"d":"0.71%"}]
["received_pkts",5037940839206,4.582,{"v":0.0207,"d":"2.07%"},17376295685008,15.8036,{"v":0.0071,"d":"0.71%"}]
["end_timestamp_ms",6981865469472,6.35,{"v":0.0287,"d":"2.87%"},17376295685008,15.8036,{"v":0.0071,"d":"0.71%"}]
["device_group",77009298789,0.07,{"v":0.0003,"d":"0.03%"},17291187694702,15.7262,{"v":0.007,"d":"0.70%"}]
["flags_identify_info",4462332345369,4.0585,{"v":0.0183,"d":"1.83%"},16391743534822,14.9082,{"v":0.0067,"d":"0.67%"}]
["ssl_ja3s_hash",1863830770014,1.6951,{"v":0.0077,"d":"0.77%"},13467453221682,12.2486,{"v":0.0055,"d":"0.55%"}]
["ssl_ja3_hash",3348005686775,3.045,{"v":0.0138,"d":"1.38%"},13174541980786,11.9822,{"v":0.0054,"d":"0.54%"}]
["server_fqdn",2597747638035,2.3626,{"v":0.0107,"d":"1.07%"},12067715772979,10.9755,{"v":0.0049,"d":"0.49%"}]
["server_os_desc",3091305052779,2.8115,{"v":0.0127,"d":"1.27%"},11807582232132,10.7389,{"v":0.0048,"d":"0.48%"}]
["client_os_desc",2445075389573,2.2238,{"v":0.0101,"d":"1.01%"},11775160706918,10.7094,{"v":0.0048,"d":"0.48%"}]
["dns_qname",4746055016211,4.3165,{"v":0.0195,"d":"1.95%"},11030691692988,10.0324,{"v":0.0045,"d":"0.45%"}]
["rdp_certificate_count",48163328361,0.0438,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dns_arcount",156470410021,0.1423,{"v":0.0006,"d":"0.06%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["sip_responder_sdp_media_port",47527744477,0.0432,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["http_status_code",108717520840,0.0989,{"v":0.0004,"d":"0.04%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["proxy_pinning_status",47527744691,0.0432,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["proxy_client_side_latency_ms",47527744955,0.0432,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["out_link_id",2372743016927,2.158,{"v":0.0098,"d":"0.98%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["http_response_latency_ms",105586623005,0.096,{"v":0.0004,"d":"0.04%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dup_traffic_flag",244232977828,0.2221,{"v":0.001,"d":"0.10%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["sip_originator_sdp_media_port",47527744477,0.0432,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["in_link_id",2513946068639,2.2864,{"v":0.0103,"d":"1.03%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["tcp_handshake_latency_ms",1300653520209,1.1829,{"v":0.0053,"d":"0.53%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dns_rcode",95894099052,0.0872,{"v":0.0004,"d":"0.04%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["rdp_certificate_permanent",48163813888,0.0438,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["proxy_cert_verify",47527744845,0.0432,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["sip_duration_s",47527744477,0.0432,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["mail_starttls_flag",47763300442,0.0434,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dns_qdcount",47564487699,0.0433,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["http_sequence",48311514481,0.0439,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dns_ra",206658393332,0.188,{"v":0.0008,"d":"0.08%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["rtp_originator_dir",47527744477,0.0432,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["proxy_server_side_latency_ms",47527745019,0.0432,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dns_message_id",1002561927075,0.9118,{"v":0.0041,"d":"0.41%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dns_qclass",48004755864,0.0437,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dns_qtype",216343337770,0.1968,{"v":0.0009,"d":"0.09%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["ssl_esni_flag",225326047476,0.2049,{"v":0.0009,"d":"0.09%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dns_response_latency_ms",448654935792,0.408,{"v":0.0018,"d":"0.18%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["monitor_mirrored_bytes",318094605760,0.2893,{"v":0.0013,"d":"0.13%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["rtp_payload_type_s2c",47527744477,0.0432,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["http_session_duration_ms",122310649099,0.1112,{"v":0.0005,"d":"0.05%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dns_ancount",364864769880,0.3318,{"v":0.0015,"d":"0.15%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["http_proxy_flag",47527744477,0.0432,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["monitor_mirrored_pkts",304510704916,0.277,{"v":0.0013,"d":"0.13%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["ssl_ech_flag",393688984930,0.3581,{"v":0.0016,"d":"0.16%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dns_tc",49166974884,0.0447,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["ssl_handshake_latency_ms",724832108805,0.6592,{"v":0.003,"d":"0.30%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dns_opcode",47818764973,0.0435,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["rtp_payload_type_c2s",47527744477,0.0432,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["proxy_intercept_status",47527744886,0.0432,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dns_aa",120733895043,0.1098,{"v":0.0005,"d":"0.05%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dns_sub",47527744477,0.0432,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dtls_handshake_latency_ms",47527744477,0.0432,{"v":0.0002,"d":"0.02%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dns_qr",183011605261,0.1664,{"v":0.0008,"d":"0.08%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dns_nscount",210373488308,0.1913,{"v":0.0009,"d":"0.09%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["tcp_rtt_ms",1300653520209,1.1829,{"v":0.0053,"d":"0.53%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["dns_rd",133144367799,0.1211,{"v":0.0005,"d":"0.05%"},10860184803130,9.8773,{"v":0.0044,"d":"0.44%"}]
["ssl_sni",2136467941633,1.9431,{"v":0.0088,"d":"0.88%"},10109989630105,9.195,{"v":0.0041,"d":"0.41%"}]
["decoded_as",44699867546,0.0407,{"v":0.0002,"d":"0.02%"},10074759075906,9.1629,{"v":0.0041,"d":"0.41%"}]
["ssl_san",1088008049077,0.9895,{"v":0.0045,"d":"0.45%"},9291556091501,8.4506,{"v":0.0038,"d":"0.38%"}]
["duration_ms",7404961433717,6.7348,{"v":0.0304,"d":"3.04%"},8688147842504,7.9018,{"v":0.0035,"d":"0.35%"}]
["vsys_id",38233586841,0.0348,{"v":0.0002,"d":"0.02%"},8688147842504,7.9018,{"v":0.0035,"d":"0.35%"}]
["server_port",1297670836149,1.1802,{"v":0.0053,"d":"0.53%"},8688147842504,7.9018,{"v":0.0035,"d":"0.35%"}]
["address_type",41964198953,0.0382,{"v":0.0002,"d":"0.02%"},8688147842504,7.9018,{"v":0.0035,"d":"0.35%"}]
["t_vsys_id",38233586839,0.0348,{"v":0.0002,"d":"0.02%"},8688147842504,7.9018,{"v":0.0035,"d":"0.35%"}]
["client_port",8555408219826,7.7811,{"v":0.0352,"d":"3.52%"},8688147842504,7.9018,{"v":0.0035,"d":"0.35%"}]
["dns_cname",1363696027970,1.2403,{"v":0.0056,"d":"0.56%"},7846308202104,7.1362,{"v":0.0032,"d":"0.32%"}]
["server_domain",1606433340468,1.461,{"v":0.0066,"d":"0.66%"},7804878240230,7.0985,{"v":0.0032,"d":"0.32%"}]
["ssl_cert_issuer",468254708685,0.4259,{"v":0.0019,"d":"0.19%"},6193200595598,5.6327,{"v":0.0025,"d":"0.25%"}]
["quic_version",260717204007,0.2371,{"v":0.0011,"d":"0.11%"},5042282749282,4.5859,{"v":0.002,"d":"0.20%"}]
["ssl_cert_subject",610099435377,0.5549,{"v":0.0025,"d":"0.25%"},4644862735818,4.2245,{"v":0.0019,"d":"0.19%"}]
["server_geolocation",2093432738468,1.904,{"v":0.0086,"d":"0.86%"},4571658125084,4.1579,{"v":0.0019,"d":"0.19%"}]
["client_geolocation",1022147074885,0.9296,{"v":0.0042,"d":"0.42%"},4446471722679,4.044,{"v":0.0018,"d":"0.18%"}]
["app",1722577761415,1.5667,{"v":0.0071,"d":"0.71%"},4325172121489,3.9337,{"v":0.0018,"d":"0.18%"}]
["http_url",672245204559,0.6114,{"v":0.0028,"d":"0.28%"},3820645476509,3.4749,{"v":0.0016,"d":"0.16%"}]
["http_request_line",636908783129,0.5793,{"v":0.0026,"d":"0.26%"},3755073738966,3.4152,{"v":0.0015,"d":"0.15%"}]
["http_user_agent",244373712663,0.2223,{"v":0.001,"d":"0.10%"},3637656135286,3.3084,{"v":0.0015,"d":"0.15%"}]
["quic_sni",336544975570,0.3061,{"v":0.0014,"d":"0.14%"},3608584932156,3.282,{"v":0.0015,"d":"0.15%"}]
["ssl_cn",390757060677,0.3554,{"v":0.0016,"d":"0.16%"},3222520557375,2.9309,{"v":0.0013,"d":"0.13%"}]
["http_response_line",93802324206,0.0853,{"v":0.0004,"d":"0.04%"},2753242723623,2.5041,{"v":0.0011,"d":"0.11%"}]
["http_host",143395664196,0.1304,{"v":0.0006,"d":"0.06%"},2691245919884,2.4477,{"v":0.0011,"d":"0.11%"}]
["http_response_content_type",86079841159,0.0783,{"v":0.0004,"d":"0.04%"},2546642061234,2.3162,{"v":0.001,"d":"0.10%"}]
["http_cookie",154450603651,0.1405,{"v":0.0006,"d":"0.06%"},2397624412040,2.1806,{"v":0.001,"d":"0.10%"}]
["http_request_content_type",47194404322,0.0429,{"v":0.0002,"d":"0.02%"},2380257670568,2.1648,{"v":0.001,"d":"0.10%"}]
["http_version",10485662015,0.0095,{"v":0,"d":"0.00%"},2370649212771,2.1561,{"v":0.001,"d":"0.10%"}]
["ssl_version",183017448782,0.1665,{"v":0.0008,"d":"0.08%"},2304556828742,2.096,{"v":0.0009,"d":"0.09%"}]
["proxy_action",10165529800,0.0092,{"v":0,"d":"0.00%"},2299501347461,2.0914,{"v":0.0009,"d":"0.09%"}]
["ssh_host_key",52039809299,0.0473,{"v":0.0002,"d":"0.02%"},2213856518368,2.0135,{"v":0.0009,"d":"0.09%"}]
["http_referer",20738010661,0.0189,{"v":0.0001,"d":"0.01%"},2206983284782,2.0072,{"v":0.0009,"d":"0.09%"}]
["ssh_server_version",15378005343,0.014,{"v":0.0001,"d":"0.01%"},2202576044489,2.0032,{"v":0.0009,"d":"0.09%"}]
["ssh_client_version",12476483180,0.0113,{"v":0.0001,"d":"0.01%"},2193602481015,1.9951,{"v":0.0009,"d":"0.09%"}]
["ssh_hassh",12293275868,0.0112,{"v":0.0001,"d":"0.01%"},2191636554484,1.9933,{"v":0.0009,"d":"0.09%"}]
["decoded_path",499793950128,0.4546,{"v":0.0021,"d":"0.21%"},2185844023690,1.988,{"v":0.0009,"d":"0.09%"}]
["ip_protocol",443447650564,0.4033,{"v":0.0018,"d":"0.18%"},2185808182633,1.988,{"v":0.0009,"d":"0.09%"}]
["quic_user_agent",14699039212,0.0134,{"v":0.0001,"d":"0.01%"},2185180075640,1.9874,{"v":0.0009,"d":"0.09%"}]
["stratum_mining_subscribe",10546981386,0.0096,{"v":0,"d":"0.00%"},2183403493039,1.9858,{"v":0.0009,"d":"0.09%"}]
["ssh_mac_alg",10297743757,0.0094,{"v":0,"d":"0.00%"},2182178660383,1.9847,{"v":0.0009,"d":"0.09%"}]
["ssh_cipher_alg",10423106001,0.0095,{"v":0,"d":"0.00%"},2179753926854,1.9825,{"v":0.0009,"d":"0.09%"}]
["ssh_kex_alg",10326381816,0.0094,{"v":0,"d":"0.00%"},2179681725013,1.9824,{"v":0.0009,"d":"0.09%"}]
["ssh_host_key_alg",10345158927,0.0094,{"v":0,"d":"0.00%"},2176718371701,1.9797,{"v":0.0009,"d":"0.09%"}]
["rdp_cookie",10889298193,0.0099,{"v":0,"d":"0.00%"},2176288196053,1.9793,{"v":0.0009,"d":"0.09%"}]
["stratum_mining_program",9813632082,0.0089,{"v":0,"d":"0.00%"},2175533383026,1.9786,{"v":0.0009,"d":"0.09%"}]
["rdp_security_protocol",10155784387,0.0092,{"v":0,"d":"0.00%"},2175489535433,1.9786,{"v":0.0009,"d":"0.09%"}]
["security_action",9629356585,0.0088,{"v":0,"d":"0.00%"},2174064644286,1.9773,{"v":0.0009,"d":"0.09%"}]
["mail_from_cmd",10896073649,0.0099,{"v":0,"d":"0.00%"},2173981746247,1.9772,{"v":0.0009,"d":"0.09%"}]
["mail_to_cmd",10883653756,0.0099,{"v":0,"d":"0.00%"},2173876169164,1.9771,{"v":0.0009,"d":"0.09%"}]
["rdp_encryption_level",10022431746,0.0091,{"v":0,"d":"0.00%"},2173804572007,1.9771,{"v":0.0009,"d":"0.09%"}]
["rdp_encryption_method",10022232092,0.0091,{"v":0,"d":"0.00%"},2173803573691,1.9771,{"v":0.0009,"d":"0.09%"}]
["ssh_compression_alg",9957999685,0.0091,{"v":0,"d":"0.00%"},2173674274784,1.9769,{"v":0.0009,"d":"0.09%"}]
["mail_bcc",10683371206,0.0097,{"v":0,"d":"0.00%"},2173574855371,1.9769,{"v":0.0009,"d":"0.09%"}]
["mail_eml_file",10284903193,0.0094,{"v":0,"d":"0.00%"},2173349538830,1.9766,{"v":0.0009,"d":"0.09%"}]
["mail_protocol_type",9667259523,0.0088,{"v":0,"d":"0.00%"},2173341851642,1.9766,{"v":0.0009,"d":"0.09%"}]
["mail_account",10675441323,0.0097,{"v":0,"d":"0.00%"},2173097781722,1.9764,{"v":0.0009,"d":"0.09%"}]
["ssh_version",10311924772,0.0094,{"v":0,"d":"0.00%"},2172876131888,1.9762,{"v":0.0009,"d":"0.09%"}]
["mail_subject",9792263649,0.0089,{"v":0,"d":"0.00%"},2172784028979,1.9761,{"v":0.0009,"d":"0.09%"}]
["http_response_body",9938139861,0.009,{"v":0,"d":"0.00%"},2172697264886,1.9761,{"v":0.0009,"d":"0.09%"}]
["mail_password",10250359101,0.0093,{"v":0,"d":"0.00%"},2172668867894,1.976,{"v":0.0009,"d":"0.09%"}]
["stratum_cryptocurrency",9623398352,0.0088,{"v":0,"d":"0.00%"},2172560531214,1.9759,{"v":0.0009,"d":"0.09%"}]
["mail_to",9851627035,0.009,{"v":0,"d":"0.00%"},2172371907430,1.9758,{"v":0.0009,"d":"0.09%"}]
["mail_from",9866031189,0.009,{"v":0,"d":"0.00%"},2172370580358,1.9758,{"v":0.0009,"d":"0.09%"}]
["http_request_body",9715353183,0.0088,{"v":0,"d":"0.00%"},2172226272014,1.9756,{"v":0.0009,"d":"0.09%"}]
["dtls_version",9678044307,0.0088,{"v":0,"d":"0.00%"},2172210023823,1.9756,{"v":0.0009,"d":"0.09%"}]
["mail_attachment_name",9636070551,0.0088,{"v":0,"d":"0.00%"},2172189000527,1.9756,{"v":0.0009,"d":"0.09%"}]
["ftp_account",9634842023,0.0088,{"v":0,"d":"0.00%"},2172136917938,1.9755,{"v":0.0009,"d":"0.09%"}]
["ftp_link_type",9622596059,0.0088,{"v":0,"d":"0.00%"},2172131836217,1.9755,{"v":0.0009,"d":"0.09%"}]
["dtls_sni",9637669705,0.0088,{"v":0,"d":"0.00%"},2172092145719,1.9755,{"v":0.0009,"d":"0.09%"}]
["mail_cc",9631768485,0.0088,{"v":0,"d":"0.00%"},2172061299743,1.9755,{"v":0.0009,"d":"0.09%"}]
["ftp_url",9627793501,0.0088,{"v":0,"d":"0.00%"},2172052952084,1.9755,{"v":0.0009,"d":"0.09%"}]
["mail_subject_charset",9630923052,0.0088,{"v":0,"d":"0.00%"},2172047405085,1.9755,{"v":0.0009,"d":"0.09%"}]
["rdp_requested_color_depth",9622526942,0.0088,{"v":0,"d":"0.00%"},2172046692373,1.9755,{"v":0.0009,"d":"0.09%"}]
["rdp_keyboard_layout",9621396043,0.0088,{"v":0,"d":"0.00%"},2172040373491,1.9755,{"v":0.0009,"d":"0.09%"}]
["rdp_client_version",9621703124,0.0088,{"v":0,"d":"0.00%"},2172040081828,1.9755,{"v":0.0009,"d":"0.09%"}]
["packet_capture_file",9622341950,0.0088,{"v":0,"d":"0.00%"},2172039905750,1.9755,{"v":0.0009,"d":"0.09%"}]
["rdp_client_channels",9621201077,0.0088,{"v":0,"d":"0.00%"},2172038923096,1.9755,{"v":0.0009,"d":"0.09%"}]
["rdp_desktop_width",9621508722,0.0088,{"v":0,"d":"0.00%"},2172037756372,1.9755,{"v":0.0009,"d":"0.09%"}]
["rdp_desktop_height",9621470058,0.0088,{"v":0,"d":"0.00%"},2172037605578,1.9755,{"v":0.0009,"d":"0.09%"}]
["rdp_certificate_type",9621154459,0.0088,{"v":0,"d":"0.00%"},2172037453469,1.9755,{"v":0.0009,"d":"0.09%"}]
["stratum_mining_pools",9620531831,0.0087,{"v":0,"d":"0.00%"},2172037305596,1.9755,{"v":0.0009,"d":"0.09%"}]
["mail_attachment_name_charset",9620313157,0.0087,{"v":0,"d":"0.00%"},2172036995303,1.9755,{"v":0.0009,"d":"0.09%"}]
["proxy_client_side_version",9620252048,0.0087,{"v":0,"d":"0.00%"},2172036961095,1.9755,{"v":0.0009,"d":"0.09%"}]
["proxy_intercept_error",9620252131,0.0087,{"v":0,"d":"0.00%"},2172036961040,1.9755,{"v":0.0009,"d":"0.09%"}]
["proxy_passthrough_reason",9620252036,0.0087,{"v":0,"d":"0.00%"},2172036960879,1.9755,{"v":0.0009,"d":"0.09%"}]
["data_center",9620251756,0.0087,{"v":0,"d":"0.00%"},2172036960836,1.9755,{"v":0.0009,"d":"0.09%"}]
["sip_originator_sdp_media_type",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["sip_responder_sdp_content",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["proxy_server_side_version",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["app_content",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["sip_originator_description",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["rdp_client_name",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["ssh_auth_success",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["sip_call_id",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["rdp_client_product_id",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["sip_server",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["dns_rr",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["subscriber_id",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["dtls_ja3_hash",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["imei",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["dtls_san",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["sip_responder_sdp_connect_ip",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["sip_originator_sdp_content",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["http_set_cookie",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["sip_responder_description",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["tunnel_endpoint_a_desc",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["sip_bye",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["dtls_cert_subject",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["sip_originator_sdp_connect_ip",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["dtls_cookie",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["phone_number",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["dtls_ja3_fingerprint",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["sip_responder_sdp_media_type",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["dtls_cert_issuer",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["tunnel_endpoint_b_desc",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["imsi",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["rtp_pcap_path",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["apn",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["dtls_cn",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["app_extra_info",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["app_debug_info",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]
["sip_user_agent",9620251726,0.0087,{"v":0,"d":"0.00%"},2172036960626,1.9755,{"v":0.0009,"d":"0.09%"}]