For Virtual network flow logs, is the macAddress (or any other property in the log format) optional?

Nathaniel Rupsis 20 Reputation points
2025-06-03T20:39:02.04+00:00

Can I get confirmation that the macAddress (and any other Flow log property) isn't optional?

Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,777 questions
{count} votes

Accepted answer
  1. Praveen Bandaru 5,520 Reputation points Microsoft External Staff Moderator
    2025-06-03T22:47:11.9766667+00:00

    Hello Nathaniel Rupsis

    I understand that you're trying to confirm if the macAddress property, along with other properties in the virtual network flow logs, is optional.

    In Azure Virtual Network (VNet) flow logs, the macAddress field—and other properties—are not optional. The log format includes specific properties such as macAddress, category, flowLogResourceID, targetResourceID, operationName, and flowRecords, among others.

    This means that when flow logs are generated, they should consistently include all standard fields unless there is a specific configuration or versioning issue affecting the output. If you notice missing fields, it might be worth checking:

    • The version of the flow logs you're using (e.g., version 1 vs. version 2).
    • Whether Traffic Analytics is enabled, which can enrich the logs.
    • Any custom parsing or transformation applied downstream.

    Check the public document for more understanding of Virtual network flow logs.


    Hope the above answer helps! Please let us know do you have any further queries. Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members. 

    1 person found this answer helpful.
    0 comments No comments

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.