---
title: NAv1 to NAv2 schema map · Cloudflare Analytics docs
description: The following table lists direct mappings between NAv1 and NAv2
  fields, when available, and provides related fields when there is no direct
  mapping available.
lastUpdated: 2025-08-18T14:27:42.000Z
chatbotDeprioritize: false
source_url:
  html: https://developers.cloudflare.com/analytics/graphql-api/migration-guides/network-analytics-v2/schema-map/
  md: https://developers.cloudflare.com/analytics/graphql-api/migration-guides/network-analytics-v2/schema-map/index.md
---

The following table lists direct mappings between NAv1 and NAv2 fields, when available, and provides related fields when there is no direct mapping available.

| ipFlows1mGroups | magicTransitNetworkAnalytics-AdaptiveGroups / spectrumNetworkAnalytics-AdaptiveGroups | dosdNetworkAnalytics-AdaptiveGroups | dosdAttackAnalytics-Groups | flowtrackdNetworkAnalytics-AdaptiveGroups | magicFirewallNetworkAnalytics-AdaptiveGroups |
| - | - | - | - | - | - |
| `date` | *Related fields:* `datetime` `datetimeTenSeconds` | *Related fields:* `datetime` `datetimeTenSeconds` | | *Related fields:* `datetime` `datetimeTenSeconds` | *Related fields:* `datetime` `datetimeTenSeconds` |
| `datetimeMinute` | `datetimeMinute` | `datetimeMinute` | | `datetimeMinute` | `datetimeMinute` |
| `datetimeFiveMinutes` | `datetimeFiveMinutes` | `datetimeFiveMinutes` | | `datetimeFiveMinutes` | `datetimeFiveMinutes` |
| `datetimeFifteenMinutes` | `datetimeFifteenMinutes` | `datetimeFifteenMinutes` | | `datetimeFifteenMinutes` | `datetimeFifteenMinutes` |
| `datetimeHour` | `datetimeHour` | `datetimeHour` | | `datetimeHour` | `datetimeHour` |
| `attackId`\* | | `attackId`\* | `attackId`\* | | |
| `attackType` | | | `attackType` | | |
| `attackMitigationType` | | | `mitigationType` | | |
| `sourceIPCountry` | `sourceCountry` | `sourceCountry` | | `sourceCountry` | `sourceCountry` |
| `sourceIPAsn` | `sourceAsn` | `sourceAsn` | | `sourceAsn` | `sourceAsn` |
| `sourceIPASNDescription` | *Related field:* `sourceGeohash` | *Related field:* `sourceGeohash` | | *Related field:* `sourceGeohash` | *Related field:* `sourceGeohash` |
| `coloCode` | `coloCode` | `coloCode` | | `coloCode` | `coloCode` |
| `coloCity` | `coloCity` | `coloCity` | | `coloCity` | `coloCity` |
| `coloCountry` | `coloCountry` | `coloCountry` | | `coloCountry` | `coloCountry` |
| `coloRegion` | *Related field:* `coloGeohash` | *Related field:* `coloGeohash` | | *Related field:* `coloGeohash` | *Related field:* `coloGeohash` |
| ipFlows1mGroups | magicTransitNetworkAnalytics-AdaptiveGroups / spectrumNetworkAnalytics-AdaptiveGroups | dosdNetworkAnalytics-AdaptiveGroups | dosdAttackAnalytics-Groups | flowtrackdNetworkAnalytics-AdaptiveGroups | magicFirewallNetworkAnalytics-AdaptiveGroups |
| `ipVersion` | `ethertype` | `ethertype` | | `ethertype` | `ethertype` |
| `bits` | `ipTotalLength` (`bits` divided by 8) | `ipTotalLength` (`bits` divided by 8) | `bits` | `ipTotalLength` (`bits` divided by 8) | `ipTotalLength` (`bits` divided by 8) |
| `packets` | *n/a* | *n/a* | `packets` | *n/a* | *n/a* |
| `ipProtocol` | `ipProtocol` | `ipProtocol` | `ipProtocol` | `ipProtocol` | `ipProtocol` |
| `sourceIP` | `ipSourceAddress` | `ipSourceAddress` | `sourceIp` | `ipSourceAddress` | `ipSourceAddress` |
| `destinationIP` | `ipDestinationAddress` | `ipDestinationAddress` | `destinationIp` | `ipDestinationAddress` | `ipDestinationAddress` |
| `destinationIPv4Range24` | `ipDestinationSubnet` | `ipDestinationSubnet` | | `ipDestinationSubnet` | `ipDestinationSubnet` |
| `destinationIPv4Range23` | *n/a* | *n/a* | | *n/a* | *n/a* |
| `sourcePort` | `sourcePort` | `sourcePort` | `sourcePort` | `sourcePort` | `sourcePort` |
| `destinationPort` | `destinationPort` | `destinationPort` | `destinationPort` | `destinationPort` | `destinationPort` |
| `tcpFlags` | `tcpFlags` | `tcpFlags` | `tcpFlags` | `tcpFlags` | `tcpFlags` |

\* The `attackId` field value may be different between NAv1 and NAv2 for the same attack.
