Cache Contexts

By default, cached fields are stored in the context of a stack stream. e.g. for a UDP based protocol, a new instance of an ACD cache field will be created for each source IP address / destination IP address / source UDP port / destination UDP port combination.

Sometimes this is not what is required. One example is where some state may be shared across multiple stack streams This may occur in line arbitration scenarios, for example.

Cached fields can be stored in different cache contexts by adding cache context configurations.

Cache Contexts example:

  "CacheContexts": {
    "lineArb": {
      "keys": [
        "Hdr_Unit"
      ],
      "addToStackStream": false,
      "expirationPolicy": {
        "type": "none"
      },
      "fields": [
        "CachedTimeEpochNS"
      ]
    }
  }

Object: CacheContexts

JSON key	Required?	Type	Value description
Cache context name	Yes	A CacheContext object.	The name of the cache context is currently just to explain the purpose.

Object: CacheContext object

JSON key	Required?	Type	Value description
keys	Yes	Array	An array of field names decoded from messages, or datafield names further down the stack.
addToStackStream	Yes	Boolean	True if the context should be added on top of the stack stream context, or false if the context should be independent of the stack stream context.
expirationPolicy	Yes	Object	An object defining the expiration policy of the cache context. This can be used to limit the size of the cache in cases where the values of the keys can have large numbers of combinations. The definition of this object is documented in the Mapper section of the Configuration Guide for VMX-Capture.
fields	Yes	Array	An array of cache field names. Cache fields used in Calculated Fields will use this context definition if the field name is in this list. If a cache field name is not in any CacheContext fields list, it will default to using the stack stream as a context with no expiration policy.