# \[Packetbeat\] How to distinguish netflow from different interface device in log?
**URL:** https://discuss.elastic.co/t/packetbeat-how-to-distinguish-netflow-from-different-interface-device-in-log/297092
**Category:** Beats
**Tags:** packetbeat
**Created:** [February 14, 2022, 2:03am UTC](https://discuss.elastic.co/t/packetbeat-how-to-distinguish-netflow-from-different-interface-device-in-log/297092 "2022-02-14T02:03:32Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@492917328](https://discuss.elastic.co/u/492917328)
#### Post date: [February 14, 2022, 2:03am UTC](https://discuss.elastic.co/t/packetbeat-how-to-distinguish-netflow-from-different-interface-device-in-log/297092/1 "2022-02-14T02:03:32Z")
Packetbeat supports capturing all messages sent or received by the server on which Packetbeat is installed：
packetbeat.interfaces.device: any
But when I set the output to Elasticsearch, I found that the field interface.device does not exist on its log . In other words, How to distinguish netflow from different interface device in log?
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 14, 2022, 4:00am UTC](https://discuss.elastic.co/t/packetbeat-how-to-distinguish-netflow-from-different-interface-device-in-log/297092/2 "2022-02-14T04:00:32Z")
Wi @492917328 welcome to the community!
Look at the `interface` fields [here](https://www.elastic.co/guide/en/beats/packetbeat/current/exported-fields-ecs.html#_interface)
> interface.name
> Interface name as reported by the system.
>
> type: keyword
>
> example: eth0
And
`interface.id`
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 14, 2022, 6:00am UTC](https://discuss.elastic.co/t/packetbeat-how-to-distinguish-netflow-from-different-interface-device-in-log/297092/3 "2022-03-14T06:00:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.