fix: match NetFlow protocol names and drop the records eslint-disable

Bare Lucene terms searched the raw protocol number, so "TCP" matched no
flows while charts, pills and records all show protocol names. The default
full-text expression now uses the protocol-name transform from the NetFlow
dimensions, moved to common-utils so both share one list.

The source modal can save a non-NetFlow source. The page now switches only
to a created NetFlow source instead of showing "NetFlow source unavailable".

Flow records keyed rows by index behind an eslint-disable, which fails the
escape-hatch ratchet. Rows are now keyed by content plus a repeat count.

The changeset no longer claims dashboard-filter support, because dashboard
filters cannot select NetFlow sources.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: Valery Petrov

.changeset/native-netflow-monitoring.md

@@ -44,9 +44,9 @@ expression. Share the summary aggregate query, reuse accessible filter menus,
 restore valid Sankey dimensions across source changes, and document source
 mappings consistently in REST and MCP.
 
-Apply the same bare-term search defaults to dashboards, chart editing, alert
-details, and dashboard filters. Support timestamp expression lists in flow
-records and normalize partial traffic buckets over their selected duration.
+Apply the same bare-term search defaults to dashboards, chart editing, and alert
+details. Support timestamp expression lists in flow records and normalize
+partial traffic buckets over their selected duration.
 
 Preserve saved source mappings when connections, databases, or metadata change.
 Show removable range filters using the shared filter pills and apply configured

packages/app/src/NetflowPage.tsx

@@ -144,7 +144,8 @@ function NetflowPage() {
         sourceId={source?.id}
         onClose={() => setSourceModal(null)}
         onCreate={created => {
-          clearFilters(created.id);
+          // The form can save another kind; keep the current flows then.
+          if (created.kind === SourceKind.Netflow) clearFilters(created.id);
           setSourceModal(null);
         }}
       />

packages/app/src/__tests__/NetflowPage.drafts.test.tsx

@@ -83,7 +83,14 @@ jest.mock('@/netflow', () => ({
   buildNetflowQueryConfigs: jest.fn(() => ({})),
 }));
 jest.mock('@/components/NetflowCharts', () => () => null);
-jest.mock('@/components/NetflowSourceModal', () => () => null);
+let mockCreateSource: (source: { id: string; kind: SourceKind }) => void;
+jest.mock('@/components/NetflowSourceModal', () => ({
+  __esModule: true,
+  default: ({ onCreate }: { onCreate: typeof mockCreateSource }) => {
+    mockCreateSource = onCreate;
+    return null;
+  },
+}));
 jest.mock('@/components/SourceSelect', () => {
   const Input = jest.requireActual(
     '@/components/InputControlled',
@@ -207,6 +214,20 @@ describe('NetFlow draft search fields', () => {
     });
   });
 
+  it('switches only to NetFlow sources created from the source modal', async () => {
+    renderWithMantine(<NetflowPage />);
+    await screen.findByLabelText('Query');
+    act(() => mockCreateSource({ id: 'logs', kind: SourceKind.Log }));
+    expect(screen.getByLabelText('Source')).toHaveValue('flows');
+    expect(screen.getByLabelText('Query')).toHaveValue('Proto:6');
+    act(() => mockCreateSource({ id: 'other', kind: SourceKind.Netflow }));
+    await waitFor(() =>
+      expect(
+        jest.mocked(buildNetflowQueryConfigs).mock.lastCall?.[0],
+      ).toMatchObject({ source: mockOtherSource, where: '' }),
+    );
+  });
+
   it('preserves drafts until Run when clicks or migrations update filters', async () => {
     renderWithMantine(<NetflowPage />);
     const query = await screen.findByLabelText('Query');

packages/app/src/components/NetflowRecords.tsx

@@ -50,15 +50,19 @@ export default function NetflowRecords({
   const [selected, setSelected] = useState<Record<string, unknown> | null>(
     null,
   );
-  const rows = useMemo(
-    () =>
-      (data?.data ?? []).map(row =>
-        Object.fromEntries(
-          fields.map(([key]) => [key, row[netflowColumnAlias(key)]]),
-        ),
-      ),
-    [data],
-  );
+  const rows = useMemo(() => {
+    const repeats = new Map<string, number>();
+    return (data?.data ?? []).map(row => {
+      const values = Object.fromEntries(
+        fields.map(([key]) => [key, row[netflowColumnAlias(key)]]),
+      );
+      // Flow exports can repeat a record exactly and carry no ID.
+      const content = JSON.stringify(values);
+      const repeat = (repeats.get(content) ?? 0) + 1;
+      repeats.set(content, repeat);
+      return { values, key: `${content}#${repeat}` };
+    });
+  }, [data]);
 
   return (
     <>
@@ -112,10 +116,8 @@ export default function NetflowRecords({
                   </Table.Tr>
                 </Table.Thead>
                 <Table.Tbody>
-                  {rows.map((row, index) => (
-                    // Flow exports may contain duplicate records without an ID; the table remounts when its query changes.
-                    // eslint-disable-next-line @eslint-react/no-array-index-key
-                    <Table.Tr key={index}>
+                  {rows.map(({ values: row, key }, index) => (
+                    <Table.Tr key={key}>
                       <Table.Td>{formatTime(String(row.timestamp))}</Table.Td>
                       <Table.Td>
                         <NetflowFilterMenu

packages/app/src/netflow.ts

@@ -1,5 +1,8 @@
 import { FIXED_TIME_BUCKET_EXPR_ALIAS } from '@hyperdx/common-utils/dist/core/renderChartConfig';
-import { getSourceImplicitColumnExpression } from '@hyperdx/common-utils/dist/core/searchChartConfig';
+import {
+  getSourceImplicitColumnExpression,
+  netflowProtocolNameExpression,
+} from '@hyperdx/common-utils/dist/core/searchChartConfig';
 import {
   convertDateRangeToGranularityString,
   convertGranularityToSeconds,
@@ -31,14 +34,6 @@ export const NETFLOW_ALIASES = {
   bytes: netflowColumnAlias('bytes'),
   value: netflowColumnAlias('value'),
 };
-const PROTOCOL_NAMES = {
-  1: 'ICMP',
-  6: 'TCP',
-  17: 'UDP',
-  47: 'GRE',
-  50: 'ESP',
-  58: 'ICMPv6',
-};
 export const NETFLOW_SUMMARY_TILES = [
   {
     title: 'Average bit rate',
@@ -83,13 +78,7 @@ export function getNetflowDimensions(source: TNetflowSource) {
   return {
     srcAddr: address(source.srcAddrExpression),
     dstAddr: address(source.dstAddrExpression),
-    protocol: `transform(toString(${source.protocolExpression}), [${Object.keys(
-      PROTOCOL_NAMES,
-    )
-      .map(value => `'${value}'`)
-      .join(', ')}], [${Object.values(PROTOCOL_NAMES)
-      .map(value => `'${value}'`)
-      .join(', ')}], toString(${source.protocolExpression}))`,
+    protocol: netflowProtocolNameExpression(source.protocolExpression),
     exporter: source.exporterExpression?.trim(),
     inputInterface: source.inIfExpression?.trim(),
     outputInterface: source.outIfExpression?.trim(),

packages/common-utils/src/__tests__/netflowSource.test.ts

@@ -1,6 +1,7 @@
 import {
   buildSearchChartConfig,
   getSourceImplicitColumnExpression,
+  netflowProtocolNameExpression,
 } from '@/core/searchChartConfig';
 import {
   isSearchableSource,
@@ -82,6 +83,12 @@ it('searches mapped NetFlow dimensions for bare Lucene terms by default', () =>
   expect(config.implicitColumnExpression).toContain('toString(SrcAddr)');
   expect(config.implicitColumnExpression).toContain('toString(ExporterName)');
   expect(config.implicitColumnExpression).toContain('toString(OutIfName)');
+  expect(config.implicitColumnExpression).toContain(
+    netflowProtocolNameExpression('Proto'),
+  );
+  expect(netflowProtocolNameExpression('Proto')).toBe(
+    "transform(toString(Proto), ['1', '6', '17', '47', '50', '58'], ['ICMP', 'TCP', 'UDP', 'GRE', 'ESP', 'ICMPv6'], toString(Proto))",
+  );
   expect(getSourceImplicitColumnExpression(SourceSchema.parse(source))).toBe(
     config.implicitColumnExpression,
   );

packages/common-utils/src/core/searchChartConfig.ts

@@ -30,17 +30,38 @@ import {
  */
 export type SearchChartConfig = BuilderChartConfig & Partial<DateRange>;
 
+const NETFLOW_PROTOCOL_NAMES = {
+  1: 'ICMP',
+  6: 'TCP',
+  17: 'UDP',
+  47: 'GRE',
+  50: 'ESP',
+  58: 'ICMPv6',
+};
+
+/** Shows well-known IP protocol numbers by name, e.g. 6 as TCP. */
+export function netflowProtocolNameExpression(expression: string): string {
+  return `transform(toString(${expression}), [${Object.keys(
+    NETFLOW_PROTOCOL_NAMES,
+  )
+    .map(value => `'${value}'`)
+    .join(', ')}], [${Object.values(NETFLOW_PROTOCOL_NAMES)
+    .map(value => `'${value}'`)
+    .join(', ')}], toString(${expression}))`;
+}
+
 /** Bare terms search mapped dimensions even on sources saved before this option existed. */
 function getNetflowImplicitColumnExpression(source: TNetflowSource): string {
   if (source.implicitColumnExpression?.trim()) {
     return source.implicitColumnExpression.trim();
   }
+  const protocol = source.protocolExpression?.trim();
   const expressions = [
     source.srcAddrExpression,
     source.dstAddrExpression,
     source.srcPortExpression,
     source.dstPortExpression,
-    source.protocolExpression,
+    protocol && netflowProtocolNameExpression(protocol),
     source.exporterExpression,
     source.inIfExpression,
     source.outIfExpression,