# Keep original event in event.original
**URL:** https://forum.elastiflow.com/t/keep-original-event-in-event-original/187
**Category:** Network Flows
**Created:** [October 29, 2024, 9:49am UTC](https://forum.elastiflow.com/t/keep-original-event-in-event-original/187 "2024-10-29T09:49:45Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@kbering](https://forum.elastiflow.com/u/kbering)
#### Post date: [October 29, 2024, 9:49am UTC](https://forum.elastiflow.com/t/keep-original-event-in-event-original/187/1 "2024-10-29T09:49:45Z")
Hello
Is is possible to keep the original flow event in the field event.original?
Best regards
Kåre
---
### Author:  [@daniel.harada](https://forum.elastiflow.com/u/daniel.harada)
#### Post date: [October 29, 2024, 11:45am UTC](https://forum.elastiflow.com/t/keep-original-event-in-event-original/187/2 "2024-10-29T11:45:44Z")
Hi Kåre,
I’m afraid I don’t understand what you are asking. Can you give a specific example or provide a screen shot to help clarify?
Thanks,
Dexter Turner
---
### Author:  [@kbering](https://forum.elastiflow.com/u/kbering)
#### Post date: [October 29, 2024, 12:14pm UTC](https://forum.elastiflow.com/t/keep-original-event-in-event-original/187/3 "2024-10-29T12:14:05Z")
Hello Dexter,
Lets says that elastiflow receives this event:
{
“event”: {
“category”: “network”,
“kind”: “event”,
“action”: “netflow”,
“outcome”: “success”,
“dataset”: “netflow”
},
“source”: {
“ip”: “192.168.1.10”,
“port”: 53213,
“mac”: “00:1A:2B:3C:4D:5E”,
“bytes”: 1050,
“packets”: 5
},
“destination”: {
“ip”: “192.168.2.20”,
“port”: 443,
“mac”: “00:1A:2B:3C:4D:5F”,
“bytes”: 2080,
“packets”: 7
},
“network”: {
“protocol”: “tcp”,
“transport”: “tcp”,
“direction”: “outbound”,
“bytes”: 3130,
“packets”: 12
},
“flow”: {
“id”: “12345”,
“start”: “2024-10-29T12:00:00Z”,
“end”: “2024-10-29T12:05:00Z”,
“duration”: 300
},
“observer”: {
“type”: “netflow”,
“ip”: “192.168.1.1”,
“hostname”: “router1”,
“serial\_number”: “123456789”
},
“ecs”: {
“version”: “1.11.0”
}
}
I would like the option to store that event in the field event.original along with the all the other fields that elastiflow creates so when I look in elastic search I see:
client.ip: 192.168.1.10
all elastiflow fields
event.original : {
“event”: {
“category”: “network”,
“kind”: “event”,
“action”: “netflow”,
“outcome”: “success”,
“dataset”: “netflow”
},
“source”: {
“ip”: “192.168.1.10”,
“port”: 53213,
“mac”: “00:1A:2B:3C:4D:5E”,
“bytes”: 1050,
“packets”: 5
},
“destination”: {
“ip”: “192.168.2.20”,
“port”: 443,
“mac”: “00:1A:2B:3C:4D:5F”,
“bytes”: 2080,
“packets”: 7
},
“network”: {
“protocol”: “tcp”,
“transport”: “tcp”,
“direction”: “outbound”,
“bytes”: 3130,
“packets”: 12
},
“flow”: {
“id”: “12345”,
“start”: “2024-10-29T12:00:00Z”,
“end”: “2024-10-29T12:05:00Z”,
“duration”: 300
},
“observer”: {
“type”: “netflow”,
“ip”: “192.168.1.1”,
“hostname”: “router1”,
“serial\_number”: “123456789”
},
“ecs”: {
“version”: “1.11.0”
}
}
Hopes this makes sense
Best regards
Kåre
---
### Author:  [@rob](https://forum.elastiflow.com/u/rob)
#### Post date: [October 29, 2024, 12:42pm UTC](https://forum.elastiflow.com/t/keep-original-event-in-event-original/187/4 "2024-10-29T12:42:17Z")
I think there may be a misunderstanding of what the ElastiFlow collector receives. Flow records are an array of encoded bytes, such as…
[event.original](https://www.elastic.co/guide/en/ecs/current/ecs-event.html#field-event-original) is intended to hold the “Raw text message of entire event.” A flow record (Netflow, IPFIX, sFlow) never exists in the form of a raw text message, and thus there is no value to store in this field.
---
### Author:  [@kbering](https://forum.elastiflow.com/u/kbering)
#### Post date: [October 29, 2024, 1:07pm UTC](https://forum.elastiflow.com/t/keep-original-event-in-event-original/187/5 "2024-10-29T13:07:50Z")
Hi Rob,
Thank you for the clarification 🙂
Best
Kåre
---
### Author:  [@system](https://forum.elastiflow.com/u/system)
#### Post date: [November 28, 2024, 1:08pm UTC](https://forum.elastiflow.com/t/keep-original-event-in-event-original/187/6 "2024-11-28T13:08:23Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.