For Virtual network flow logs, is the macAddress (or any other property in the log format) optional?

Question

Can I get confirmation that the macAddress (and any other Flow log property) isn't optional?

Answer 1

Hello Nathaniel Rupsis

I understand that you're trying to confirm if the macAddress property, along with other properties in the virtual network flow logs, is optional.

In Azure Virtual Network (VNet) flow logs, the macAddress field—and other properties—are not optional. The log format includes specific properties such as macAddress, category, flowLogResourceID, targetResourceID, operationName, and flowRecords, among others.

This means that when flow logs are generated, they should consistently include all standard fields unless there is a specific configuration or versioning issue affecting the output. If you notice missing fields, it might be worth checking:

• The version of the flow logs you're using (e.g., version 1 vs. version 2).
• Whether Traffic Analytics is enabled, which can enrich the logs.
• Any custom parsing or transformation applied downstream.

Check the public document for more understanding of Virtual network flow logs.

---

Hope the above answer helps! Please let us know do you have any further queries. Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.