[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間:2025-09-04 (世界標準時間)。"],[],[],null,["# Metrics and alignment period\n\nFlow Analyzer analyzes VPC Flow Logs data stored in a\n[record format](/vpc/docs/about-flow-logs-records#record_format).\nLog records contain base fields, which are the core fields of every log record,\nand metadata fields, which provide more information. The log records for\nmonitoring traffic flows consist of three primary components:\n\n- Resource information\n- Metric types\n- Time series\n\nResource information\n--------------------\n\nThe log records include the following data about the resources:\n\n- [Connection details](/vpc/docs/about-flow-logs-records#IpConnection)\n- [Reporter data](/vpc/docs/about-flow-logs-records#record_format)\n- [GKE details](/vpc/docs/about-flow-logs-records#gke-details)\n- [Instance details](/vpc/docs/about-flow-logs-records#InstanceDetails)\n- [Geographic details](/vpc/docs/about-flow-logs-records#GeographicDetails)\n- [VPC details](/vpc/docs/about-flow-logs-records#VpcDetails)\n\nMetric types\n------------\n\nThe log records include data for the following metric types:\n\n- **Bytes sent**: contains information about the payload volumes and doesn't include headers. This metric value can be zero because some packets have only headers and don't include any payloads.\n- **Packets sent:** indicates the number of packets sent from the source to the destination.\n\nRaw time-series data\n--------------------\n\nThe amount of raw metric data in a single time series can be enormous, and\nthere are usually many time series associated with a metric type. To analyze the\nwhole set of data for commonalities, trends, or outliers, some processing must\nbe done on the time series in the set. Otherwise, there is too much data to\nconsider.\n\nTo introduce sampling and aggregation of the examples on this page, use a small\nnumber of hypothetical time series. For example, the following diagram\nshows a few minutes worth of raw data for the metric type of **bytes per\nsecond**:\n[](/static/network-intelligence-center/docs/flow-analyzer/images/fa-align-raw.png) Raw time series data (click to enlarge).\n\nRaw time-series data must be manipulated before it can be analyzed, and\nanalysis often involves sampling the data and aggregating some together. This\npage describes two primary techniques for refining raw data:\n\n- **Sampling**, which removes some of the data from consideration. Google Cloud does the sampling and uses the required data from the log records to perform operations as indicated in the queries.\n- **Aggregation**, which combines multiple pieces of data into a smaller set along dimensions you specify.\n\nSampling and aggregation are powerful tools to help identify interesting\npatterns and highlight trends or outliers in the data, among other things.\n\nUnderstanding alignment period\n------------------------------\n\nThe first step in aggregating time-series data is *alignment*. Alignment\ncreates a new time series in which the raw data is regularized in time so\nit can be combined with other aligned time series. Alignment produces time\nseries with regularly spaced data.\n\nAlignment involves two steps:\n\n1. Dividing the time series into regular time intervals, also called *bucketing* the data. The interval is called the *alignment period*.\n2. Computing a single metric value for the points in the alignment period. You choose how that single point is computed; you might sum all the values, or compute their average, or use the maximum.\n\nThe following diagram shows how the alignment period is used to bucket the\ndata within the start time and the end time.\n[](/static/network-intelligence-center/docs/flow-analyzer/images/fa-alignment-period.png) Alignment period (click to enlarge).\n\nThe following diagram shows the result of using an alignment period of\nfive minutes with the following steps:\n\n1. Creating an alignment period of five minutes time interval.\n2. Computing the single metric value by using the sum of the metric values from the raw data.\n\n[](/static/network-intelligence-center/docs/flow-analyzer/images/fa-alignment-five-min-period.png) Alignment period of five minutes (click to enlarge).\n\n### Granularity\n\nIf you know that something happened within a span of a couple of minutes, and\nyou want to dig deeper, you probably want to use a period of a minute for\nalignment.\n\nIf you are interested in exploring trends over longer periods of time, a larger\nalignment period might be more appropriate. Large alignment periods are typically\nnot useful for looking at short-term anomalous conditions, such as short spikes\nin traffic. If you use, for example, a multiple-week alignment period, the\nexistence of an anomaly in that period can still be detected, but the aligned\ndata might be too general to be of much help.\n\nFor large time durations, a smaller alignment period is not helpful. For\nexample, if you select a 1 minute alignment for a 30 day period, Flow Analyzer\ngenerates more than 43,000 data points. Because 43,000 data points is 10 times\nmore than the 4k display pixels, you cannot view all the details and\nsome options are disabled for large time durations.\n\n### Alignment options\n\nAlignment options include summing the values, or finding the max, min, or mean\nof the values, finding a chosen percentile value, counting the values, and\nothers. Using Flow Analyzer, you can use various metric aggregations as\nalignment options.\n\nIf you select **Bytes sent** as the metric type and **Source and destination**\nas the traffic aggregation, the following options are available.\n\n- Total traffic\n- Average traffic rate\n- Median traffic rate\n- P95 traffic rate\n- Maximum traffic rate\n\nIf you select **Packets sent** as the metric type and **Source and\ndestination** as the traffic aggregation, the following options are available.\n\n- Aggregate packets\n- Average packets rate\n- Median packets rate\n- P95 packets rate\n- Maximum packets rate\n\nThe following diagram shows the result of using two alignment options of\n**total traffic** and **average traffic rate**.\n[](/static/network-intelligence-center/docs/flow-analyzer/images/fa-total-average-traffic.png) Total and average traffic (click to enlarge).\n\nUsing alignment period\n----------------------\n\nYou can use the **Alignment period** option to aggregate the traffic flows into\ntime intervals of the selected duration. You can further zoom in the graph and\nsee the specific details, if needed.\n\nWhat's next\n-----------\n\n- [Analyze traffic flows](/network-intelligence-center/docs/flow-analyzer/analyze-traffic-flows)\n- [Enable Log Analytics](/network-intelligence-center/docs/flow-analyzer/enable-log-analytics)\n- [Configure a central bucket](/network-intelligence-center/docs/flow-analyzer/configure-central-bucket)\n- [Run Connectivity Tests from Flow Analyzer](/network-intelligence-center/docs/flow-analyzer/run-connectivity-tests)\n- [Monitor your traffic flows](/network-intelligence-center/docs/flow-analyzer/monitor-traffic-flows)\n- [Troubleshoot data issues in Flow Analyzer](/network-intelligence-center/docs/flow-analyzer/manage-flow-analyzer)"]]