Merge branch 'bugfix/voip-fields' into 'master'

bugfix: add field for 'VoIP' records

See merge request galaxy/tsg_olap/sip-rtp-correlation!32

.gitlab-ci.yml

@@ -1,4 +1,4 @@
-image: 192.168.40.153:9080/common/maven:3.8.1-openjdk-11-slim-with-git
+image: 192.168.40.153:8082/common/maven:3.8.1-openjdk-11-slim
 
 variables:
   MAVEN_CLI_OPTS: "--batch-mode --errors --show-version"
@@ -11,6 +11,7 @@ stages:
 release-version-check:
   stage: check
   script:
+    - echo "$MAVEN_SETTINGS_XML" > /usr/share/maven/conf/settings.xml
     - mvn $MAVEN_CLI_OPTS enforcer:enforce@release-version-check
     - |-
       if `mvn $MAVEN_CLI_OPTS dependency:get@release-deploy-check > /dev/null 2>&1`; then
@@ -25,6 +26,7 @@ release-version-check:
 test:
   stage: test
   script:
+    - echo "$MAVEN_SETTINGS_XML" > /usr/share/maven/conf/settings.xml
     - mvn $MAVEN_CLI_OPTS clean test
   only:
     - merge_requests

pom.xml

@@ -7,7 +7,7 @@
 
     <groupId>com.geedgenetworks.application</groupId>
     <artifactId>sip-rtp-correlation</artifactId>
-    <version>2.0-rc2</version>
+    <version>2.0-rc6</version>
 
     <name>Flink : SIP-RTP : Correlation</name>
 
@@ -28,35 +28,21 @@
     <distributionManagement>
         <repository>
             <id>platform-releases</id>
-            <url>http://192.168.40.153:8099/content/repositories/platform-release</url>
+            <url>http://192.168.40.153:8081/content/repositories/platform-release</url>
             <uniqueVersion>true</uniqueVersion>
         </repository>
         <snapshotRepository>
             <id>platform-snapshots</id>
-            <url>http://192.168.40.153:8099/content/repositories/platform-snapshot</url>
+            <url>http://192.168.40.153:8081/content/repositories/platform-snapshot</url>
         </snapshotRepository>
         <site>
             <id>platform-site</id>
             <url>
-                dav:http://192.168.40.153:8099/content/sites/platform-site/platform/application/sip-rtp-correlate-${project.version}
+                dav:http://192.168.40.153:8081/content/sites/platform-site/platform/application/sip-rtp-correlate-${project.version}
             </url>
         </site>
     </distributionManagement>
 
-    <repositories>
-        <repository>
-            <id>central</id>
-            <url>http://192.168.40.153:8099/content/groups/public</url>
-        </repository>
-        <repository>
-            <id>snapshots</id>
-            <url>http://192.168.40.153:8099/content/groups/public</url>
-            <snapshots>
-                <enabled>true</enabled>
-            </snapshots>
-        </repository>
-    </repositories>
-
     <dependencies>
         <dependency>
             <groupId>org.slf4j</groupId>

src/main/resources/jobs/job.yml

@@ -21,9 +21,9 @@ source:
     schema:
       ## General
       - name: recv_time
-        data-type: BIGINT NOT NULL
+        data-type: BIGINT
       - name: log_id
-        data-type: BIGINT NOT NULL
+        data-type: BIGINT
       - name: decoded_as
         data-type: STRING NOT NULL
       - name: session_id
@@ -294,7 +294,7 @@ sink:
     type: kafka
     on: errors-records
     option:
-      topic: VOIP-CONVERSATTON-RECORD
+      topic: VOIP-CONVERSATION-RECORD
       properties:
         bootstrap.servers: localhost:9092
         security.protocol: SASL_PLAINTEXT
@@ -306,7 +306,7 @@ sink:
     on: voip-fusion.ok
     type: kafka
     option:
-      topic: VOIP-CONVERSATTON-RECORD
+      topic: VOIP-CONVERSATION-RECORD
       properties:
         bootstrap.servers: localhost:9092
         security.protocol: SASL_PLAINTEXT
@@ -318,7 +318,7 @@ sink:
     on: cannot-fusion-records
     type: kafka
     option:
-      topic: VOIP-CONVERSATTON-RECORD
+      topic: VOIP-CONVERSATION-RECORD
       properties:
         bootstrap.servers: localhost:9092
         security.protocol: SASL_PLAINTEXT
@@ -363,13 +363,13 @@ pipeline:
     cache:
       - name: v1
         type: VALUE
-        ttl: 1 minute
+        ttl: 2 minute
         schema:
           ## General
           - name: recv_time
-            data-type: BIGINT NOT NULL
+            data-type: BIGINT
           - name: log_id
-            data-type: BIGINT NOT NULL
+            data-type: BIGINT
           - name: decoded_as
             data-type: STRING NOT NULL
           - name: session_id
@@ -806,13 +806,13 @@ pipeline:
     cache:
       - name: sip
         type: VALUE
-        ttl: 6 minute
+        ttl: 7 minute
         schema:
           ## General
           - name: recv_time
-            data-type: BIGINT NOT NULL
+            data-type: BIGINT
           - name: log_id
-            data-type: BIGINT NOT NULL
+            data-type: BIGINT
           - name: decoded_as
             data-type: STRING NOT NULL
           - name: session_id
@@ -1077,13 +1077,13 @@ pipeline:
             data-type: INT
       - name: rtp
         type: LIST
-        ttl: 6 minute
+        ttl: 7 minute
         schema:
           ## General
           - name: recv_time
-            data-type: BIGINT NOT NULL
+            data-type: BIGINT
           - name: log_id
-            data-type: BIGINT NOT NULL
+            data-type: BIGINT
           - name: decoded_as
             data-type: STRING NOT NULL
           - name: session_id
@@ -1358,7 +1358,7 @@ pipeline:
                 FLAT OUTPUT ok FOR i IN rtp FROM 
                         @i.$recv_time AS recv_time,
                         @i.$log_id AS log_id,
-                        'VoIP' AS decode_as,
+                        'VoIP' AS decoded_as,
                         @i.$session_id AS session_id,
                         @i.$start_timestamp_ms AS start_timestamp_ms,
                         @i.$end_timestamp_ms AS end_timestamp_ms,
@@ -1411,21 +1411,8 @@ pipeline:
                         @i.$sent_bytes AS sent_bytes,
                         @i.$received_bytes AS received_bytes,
                         
-                        @i.$sip_call_id AS sip_call_id,
-                        @i.$sip_originator_description AS sip_originator_description,
-                        @i.$sip_responder_description AS sip_responder_description,
-                        @i.$sip_user_agent AS sip_user_agent,
-                        @i.$sip_server AS sip_server,
-                        @i.$sip_originator_sdp_connect_ip AS sip_originator_sdp_connect_ip,
-                        @i.$sip_originator_sdp_media_port AS sip_originator_sdp_media_port,
-                        @i.$sip_originator_sdp_media_type AS sip_originator_sdp_media_type,
-                        @i.$sip_originator_sdp_content AS sip_originator_sdp_content,
-                        @i.$sip_responder_sdp_connect_ip AS sip_responder_sdp_connect_ip,
-                        @i.$sip_responder_sdp_media_port AS sip_responder_sdp_media_port,
-                        @i.$sip_responder_sdp_media_type AS sip_responder_sdp_media_type,
-                        @i.$sip_responder_sdp_content AS sip_responder_sdp_content,
-                        @i.$sip_duration_s AS sip_duration_s,
-                        @i.$sip_bye AS sip_bye,
+                        withColumns(sip_call_id to sip_bye), 
+                      
                         @i.$rtp_payload_type_c2s AS rtp_payload_type_c2s,
                         @i.$rtp_payload_type_s2c AS rtp_payload_type_s2c,
                         @i.$rtp_pcap_path AS rtp_pcap_path,
@@ -1443,7 +1430,7 @@ pipeline:
                 FLAT OUTPUT ok FOR i IN rtp FROM
                                 @i.$recv_time AS recv_time,
                                 @i.$log_id AS log_id,
-                                'VoIP' AS decode_as,
+                                'VoIP' AS decoded_as,
                                 @i.$session_id AS session_id,
                                 @i.$start_timestamp_ms AS start_timestamp_ms,
                                 @i.$end_timestamp_ms AS end_timestamp_ms,
@@ -1496,25 +1483,26 @@ pipeline:
                                 @i.$sent_bytes AS sent_bytes,
                                 @i.$received_bytes AS received_bytes,
                                 
-                                @i.$sip_call_id AS sip_call_id,
-                                @i.$sip_originator_description AS sip_originator_description,
-                                @i.$sip_responder_description AS sip_responder_description,
-                                @i.$sip_user_agent AS sip_user_agent,
-                                @i.$sip_server AS sip_server,
-                                @i.$sip_originator_sdp_connect_ip AS sip_originator_sdp_connect_ip,
-                                @i.$sip_originator_sdp_media_port AS sip_originator_sdp_media_port,
-                                @i.$sip_originator_sdp_media_type AS sip_originator_sdp_media_type,
-                                @i.$sip_originator_sdp_content AS sip_originator_sdp_content,
-                                @i.$sip_responder_sdp_connect_ip AS sip_responder_sdp_connect_ip,
-                                @i.$sip_responder_sdp_media_port AS sip_responder_sdp_media_port,
-                                @i.$sip_responder_sdp_media_type AS sip_responder_sdp_media_type,
-                                @i.$sip_responder_sdp_content AS sip_responder_sdp_content,
-                                @i.$sip_duration_s AS sip_duration_s,
-                                @i.$sip_bye AS sip_bye,
+                                @sip.$sip_call_id AS sip_call_id,
+                                @sip.$sip_originator_description AS sip_originator_description,
+                                @sip.$sip_responder_description AS sip_responder_description,
+                                @sip.$sip_user_agent AS sip_user_agent,
+                                @sip.$sip_server AS sip_server,
+                                @sip.$sip_originator_sdp_connect_ip AS sip_originator_sdp_connect_ip,
+                                @sip.$sip_originator_sdp_media_port AS sip_originator_sdp_media_port,
+                                @sip.$sip_originator_sdp_media_type AS sip_originator_sdp_media_type,
+                                @sip.$sip_originator_sdp_content AS sip_originator_sdp_content,
+                                @sip.$sip_responder_sdp_connect_ip AS sip_responder_sdp_connect_ip,
+                                @sip.$sip_responder_sdp_media_port AS sip_responder_sdp_media_port,
+                                @sip.$sip_responder_sdp_media_type AS sip_responder_sdp_media_type,
+                                @sip.$sip_responder_sdp_content AS sip_responder_sdp_content,
+                                @sip.$sip_duration_s AS sip_duration_s,
+                                @sip.$sip_bye AS sip_bye,
+                
                                 @i.$rtp_payload_type_c2s AS rtp_payload_type_c2s,
                                 @i.$rtp_payload_type_s2c AS rtp_payload_type_s2c,
                                 @i.$rtp_pcap_path AS rtp_pcap_path,
-                                ( @i.$client_ip == sip_originator_sdp_connect_ip).?(1, (@i.$client_ip == sip_responder_sdp_connect_ip).?(2, 0) ) AS rtp_originator_dir
+                                ( @i.$client_ip == @sip.$sip_originator_sdp_connect_ip).?(1, (@i.$client_ip == @sip.$sip_responder_sdp_connect_ip).?(2, 0) ) AS rtp_originator_dir
           - SCHEDULING USING PROCESS TIME FOR NOW + 6 * 60 * 1000
     schedule:
       - if: '@rtp.isNotNull && @rtp.cardinality > 0'

src/site/markdown/download.md

@@ -2,7 +2,47 @@
 
 ### ${project.version}
 
+- VoIP Record 增加字段: SIP， RTP `protocol` 相关字段。
+
 | Easy Stream | UDF Jar                                                      | Job                                                          |
 |-------------| ------------------------------------------------------------ | ------------------------------------------------------------ |
 | ${easy.stream.version}         | [JAR](${project.distributionManagement.repository.url}/com/geedgenetworks/application/sip-rtp-correlation/${project.version}/${project.artifactId}-${project.version}.jar) ( [MD5](${project.distributionManagement.repository.url}/com/geedgenetworks/application/sip-rtp-correlation/${project.version}/${project.artifactId}-${project.version}.jar.md5) [SHA1](${project.distributionManagement.repository.url}/com/geedgenetworks/application/sip-rtp-correlation/${project.version}/${project.artifactId}-${project.version}.jar.sha1) ) | [YML](${project.distributionManagement.repository.url}/com/geedgenetworks/application/sip-rtp-correlation/${project.version}/${project.artifactId}-${project.version}.tar.gz) ( [MD5](${project.distributionManagement.repository.url}/com/geedgenetworks/application/sip-rtp-correlation/${project.version}/${project.artifactId}-${project.version}.tar.gz.md5) [SHA1](${project.distributionManagement.repository.url}/com/geedgenetworks/application/sip-rtp-correlation/${project.version}/${project.artifactId}-${project.version}.tar.gz.sha1) ) |
 
+### 2.0-rc5
+
+- 修复 VoIP 字段错误，使用 `decoded_as` 表示 VoIP 日志。
+
+| Easy Stream | UDF Jar                                                      | Job                                                          |
+|-------------| ------------------------------------------------------------ | ------------------------------------------------------------ |
+| 1.3-rc1     | [JAR](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc5/sip-rtp-correlation-2.0-rc5.jar) ( [MD5](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc5/sip-rtp-correlation-2.0-rc5.jar.md5) [SHA1](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc5/sip-rtp-correlation-2.0-rc5.jar.sha1) ) | [YML](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc5/sip-rtp-correlation-2.0-rc5.tar.gz) ( [MD5](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc5/sip-rtp-correlation-2.0-rc5.tar.gz.md5) [SHA1](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc5/sip-rtp-correlation-2.0-rc5.tar.gz.sha1) ) |
+
+### 2.0-rc4
+
+- 移除对 `log_id`, `recv_time` 字段的强制非空校验, 该字段在后续步骤中处理。
+
+| Easy Stream | UDF Jar                                                      | Job                                                          |
+|-------------| ------------------------------------------------------------ | ------------------------------------------------------------ |
+| 1.3-rc1     | [JAR](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc4/sip-rtp-correlation-2.0-rc4.jar) ( [MD5](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc4/sip-rtp-correlation-2.0-rc4.jar.md5) [SHA1](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc4/sip-rtp-correlation-2.0-rc4.jar.sha1) ) | [YML](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc4/sip-rtp-correlation-2.0-rc4.tar.gz) ( [MD5](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc4/sip-rtp-correlation-2.0-rc4.tar.gz.md5) [SHA1](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc4/sip-rtp-correlation-2.0-rc4.tar.gz.sha1) ) |
+
+### 2.0-rc3
+
+- 修复由于 State 过期策略早于 Timer 触发而导致的未关联成功的 RTP 数据未正常输出的问题。
+
+| Easy Stream | UDF Jar                                                      | Job                                                          |
+|-------------| ------------------------------------------------------------ | ------------------------------------------------------------ |
+| 1.3-rc1     | [JAR](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc3/sip-rtp-correlation-2.0-rc3.jar) ( [MD5](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc3/sip-rtp-correlation-2.0-rc3.jar.md5) [SHA1](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc3/sip-rtp-correlation-2.0-rc3.jar.sha1) ) | [YML](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc3/sip-rtp-correlation-2.0-rc3.tar.gz) ( [MD5](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc3/sip-rtp-correlation-2.0-rc3.tar.gz.md5) [SHA1](http://192.168.40.153:8081/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc3/sip-rtp-correlation-2.0-rc3.tar.gz.sha1) ) |
+
+### 2.0-rc2
+
+- 修复由于 Flink 1.13.6 和 Flink 1.13.1 之间某些 Runtime 不兼容的问题导致的系统无法启动。
+
+| Easy Stream | UDF Jar                                                      | Job                                                          |
+|-------------| ------------------------------------------------------------ | ------------------------------------------------------------ |
+| 1.3-rc1     | [JAR](http://192.168.40.153:8099/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc2/sip-rtp-correlation-2.0-rc2.jar) ( [MD5](http://192.168.40.153:8099/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc2/sip-rtp-correlation-2.0-rc2.jar.md5) [SHA1](http://192.168.40.153:8099/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc2/sip-rtp-correlation-2.0-rc2.jar.sha1) ) | [YML](http://192.168.40.153:8099/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc2/sip-rtp-correlation-2.0-rc2.tar.gz) ( [MD5](http://192.168.40.153:8099/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc2/sip-rtp-correlation-2.0-rc2.tar.gz.md5) [SHA1](http://192.168.40.153:8099/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc2/sip-rtp-correlation-2.0-rc2.tar.gz.sha1) ) |
+
+### 2.0-rc1
+
+| Easy Stream | UDF Jar                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | Job                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+|-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| 1.3-rc1     | [JAR](http://192.168.40.153:8099/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc1/sip-rtp-correlation-2.0-rc1.jar) ( [MD5](http://192.168.40.153:8099/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc1/sip-rtp-correlation-2.0-rc1.jar.md5) [SHA1](http://192.168.40.153:8099/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc1/sip-rtp-correlation-2.0-rc1.jar.sha1) ) | [YML](http://192.168.40.153:8099/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc1/sip-rtp-correlation-2.0-rc1.tar.gz) ( [MD5](http://192.168.40.153:8099/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc1/sip-rtp-correlation-2.0-rc1.tar.gz.md5) [SHA1](http://192.168.40.153:8099/content/repositories/platform-release/com/geedgenetworks/application/sip-rtp-correlation/2.0-rc1/sip-rtp-correlation-2.0-rc1.tar.gz.sha1) ) |
+

src/test/resources/data/e2e-test-execution.jsonl

@@ -0,0 +1,4 @@
+{"__timestamp":946681200,"__inputid":"tsg_olap","session_id":10240001,"decoded_as":"RTP","ip_protocol":"udp","address_type":4,"client_ip":"192.168.64.8","server_ip":"192.168.39.62","client_port":25524,"server_port":4580,"t_vsys_id":0,"vsys_id":1024,"data_center":"tsg_olap","device_group":"tsg_olap","device_id":"0000000000000000","sled_ip":"127.0.0.1","app":"unknown","app_transition":"","client_geolocation":"unknown","server_geolocation":"unknown","decoded_path":"ETHERNET.IPv4.UDP.rtp","server_fqdn":"","start_timestamp_ms":1721639438014,"end_timestamp_ms":1721639438014,"tcp_rtt_ms":0,"tcp_client_isn":0,"tcp_server_isn":0,"tcp_handshake_latency_ms":0,"in_link_id":0,"out_link_id":0,"duration_ms":0,"sent_pkts":0,"sent_bytes":0,"received_pkts":0,"received_bytes":0,"flags":24576,"flags_identify_info":[1,1],"fqdn_category_list":[0],"client_os_desc":"Windows","server_os_desc":"Linux","rtp_pcap_path":"123e4567-e89b-12d3-a456-426614174005"}
+{"__timestamp":946681200,"__inputid":"tsg_olap","session_id":10240002,"decoded_as":"SIP","ip_protocol":"udp","address_type":4,"client_ip":"10.0.0.1","server_ip":"192.0.2.1","client_port":1000,"server_port":60000,"t_vsys_id":0,"vsys_id":1024,"data_center":"tsg_olap","device_group":"tsg_olap","device_id":"0000000000000000","sled_ip":"127.0.0.1","app":"unknown","app_transition":"","client_geolocation":"unknown","server_geolocation":"unknown","decoded_path":"ETHERNET.IPv4.UDP.sip","server_fqdn":"","start_timestamp_ms":1721639438014,"end_timestamp_ms":1721639438014,"tcp_rtt_ms":0,"tcp_client_isn":0,"tcp_server_isn":0,"tcp_handshake_latency_ms":0,"in_link_id":0,"out_link_id":0,"duration_ms":0,"sent_pkts":0,"sent_bytes":0,"received_pkts":0,"received_bytes":0,"flags":24584,"flags_identify_info":[1,1],"fqdn_category_list":[0],"client_os_desc":"Windows","server_os_desc":"Linux","sip_call_id":"NGMxZWY3Y2NmMzNlNGE3NzJhODgyZDAwM2YyMzQ4NGI.","sip_originator_description":"\"lina\"<sip:lina@192.0.2.1>;tag=1837055d","sip_responder_description":"\"1075\"<sip:1075@192.0.2.1>","sip_originator_sdp_connect_ip":"192.168.64.8","sip_originator_sdp_media_port":25524,"sip_originator_sdp_media_type":"application/sdp","sip_server":"OpenSIPS (2.4.11 (x86_64/linux))","sip_responder_sdp_connect_ip":"192.168.39.62","sip_responder_sdp_media_port":4580,"sip_responder_sdp_media_type":"application/sdp","sip_duration_s":590,"sip_bye":"responder","sip_cseq":"2 BYE","sip_via":"SIP/2.0/UDP 192.0.2.1:5060;branch=z9hG4bKbe7c.392190f1.0","sip_user_agent":"eyeBeam release 1011d stamp 40820","sip_is_request":0}
+{"__timestamp":946681200,"__inputid":"tsg_olap","session_id":10240003,"decoded_as":"RTP","ip_protocol":"udp","address_type":4,"client_ip":"192.168.164.18","server_ip":"192.168.39.162","client_port":65121,"server_port":4670,"t_vsys_id":0,"vsys_id":1024,"data_center":"tsg_olap","device_group":"tsg_olap","device_id":"0000000000000000","sled_ip":"127.0.0.1","app":"unknown","app_transition":"","client_geolocation":"unknown","server_geolocation":"unknown","decoded_path":"ETHERNET.IPv4.UDP.rtp","server_fqdn":"","start_timestamp_ms":1721639438014,"end_timestamp_ms":1721639438014,"tcp_rtt_ms":0,"tcp_client_isn":0,"tcp_server_isn":0,"tcp_handshake_latency_ms":0,"in_link_id":0,"out_link_id":0,"duration_ms":0,"sent_pkts":0,"sent_bytes":0,"received_pkts":0,"received_bytes":0,"flags":24584,"flags_identify_info":[1,1],"fqdn_category_list":[0],"client_os_desc":"Windows","server_os_desc":"Linux","rtp_pcap_path":"123e4567-e89b-12d3-a456-426614174001"}
+{"__timestamp":946681200,"__inputid":"tsg_olap","session_id":10240004,"decoded_as":"SIP","ip_protocol":"udp","address_type":4,"client_ip":"10.0.0.2","server_ip":"192.0.2.2","client_port":1000,"server_port":60000,"t_vsys_id":0,"vsys_id":1024,"data_center":"tsg_olap","device_group":"tsg_olap","device_id":"0000000000000000","sled_ip":"127.0.0.1","app":"unknown","app_transition":"","client_geolocation":"unknown","server_geolocation":"unknown","decoded_path":"ETHERNET.IPv4.UDP.sip","server_fqdn":"","start_timestamp_ms":1721639438014,"end_timestamp_ms":1721639438014,"tcp_rtt_ms":0,"tcp_client_isn":0,"tcp_server_isn":0,"tcp_handshake_latency_ms":0,"in_link_id":0,"out_link_id":0,"duration_ms":0,"sent_pkts":0,"sent_bytes":0,"received_pkts":0,"received_bytes":0,"flags":24584,"flags_identify_info":[1,1],"fqdn_category_list":[0],"client_os_desc":"Windows","server_os_desc":"Linux","sip_call_id":"CUMxZWY3Y2NmMzNlNGE3NzJhODgyZDAwM2YyMzQ4NGI.","sip_originator_description":"\"lina\"<sip:lina@192.0.2.1>;tag=1837055d","sip_responder_description":"\"1075\"<sip:1075@192.0.2.1>","sip_originator_sdp_connect_ip":"192.68.64.8","sip_originator_sdp_media_port":25524,"sip_originator_sdp_media_type":"application/sdp","sip_server":"OpenSIPS (2.4.11 (x86_64/linux))","sip_responder_sdp_connect_ip":"192.18.39.62","sip_responder_sdp_media_port":4580,"sip_responder_sdp_media_type":"application/sdp","sip_duration_s":590,"sip_bye":"responder","sip_cseq":"2 BYE","sip_via":"SIP/2.0/UDP 192.0.2.1:5060;branch=z9hG4bKbe7c.392190f1.0","sip_user_agent":"eyeBeam release 1011d stamp 40820","sip_is_request":0}