Ok, so... On the same thinking as Oleg, do tagged packets go into the packet field in eve.json? -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170301/e1294184/attachment-0002.html>