US Patent 11290355 Methods and systems for flow log compression and coordination

A compressed flow log can be created from flow log entries. Flow log entries include field values for flow log fields. The entries can be compressed based on tuples (e.g., primary tuple, secondary tuple, tertiary tuple, etc.) specified by tuple definitions that specify the flow log fields in tuple content values. A first primary tuple content value can be based on a primary tuple definition and the field values of a first flow log entry included in flow log entries. A first primary tuple symbol can be associated with the first primary tuple content value. The first flow log entry can be used to create a first compressed flow log entry that includes the first primary tuple symbol. The first compressed flow log entry can be included in the compressed flow log, and the compressed flow log can be transmitted to a flow log consumer.