FIELDALIAS-storm = fw AS dvc dst AS dest dstif AS dest_interface dstport AS dest_port ipproto AS transport ruleid AS rule srcif AS src_interface srcport as src_port dstportname AS app action AS vendor_action result AS status op AS http_method sent AS bytes_out rcvd AS bytes_in arg AS uri_query cat_site AS category address AS dest
dst AS dest
AND
address AS dest
i think it's dst AS dest_ip.
I feel the above code is bit clunky (or overuse/abuse of FIELDALIAS). To keep it simple and future debug friendly, it is better to write in multiple lines
FIELDALIAS-dest1 = dst AS dest_ip dstport AS dest_port dstportname AS app dstif AS dest_interface address AS dest
FIELDALIAS-src1 = srcport as src_port srcif AS src_interface
FIELDALIAS-flow1 = ipproto AS transport sent AS bytes_out rcvd AS bytes_in
FIELDALIAS-payload1 = ruleid AS rule op AS http_method arg AS uri_query
FIELDALIAS-others1 = result AS status action AS vendor_action cat_site AS category
I would even write it in individual lines, to make it easier to debug/automate in future