Error on props.conf

[bricevaixagon]

FIELDALIAS-storm = fw AS dvc dst AS dest dstif AS dest_interface dstport AS dest_port ipproto AS transport ruleid AS rule srcif AS src_interface srcport as src_port dstportname AS app action AS vendor_action result AS status op AS http_method sent AS bytes_out rcvd AS bytes_in arg AS uri_query cat_site AS category address AS dest

dst AS dest
AND
address AS dest

i think it's dst AS dest_ip.

[koshyk]

I feel the above code is bit clunky (or overuse/abuse of FIELDALIAS). To keep it simple and future debug friendly, it is better to write in multiple lines

FIELDALIAS-dest1 = dst AS dest_ip dstport AS dest_port dstportname AS app dstif AS dest_interface address AS dest
FIELDALIAS-src1 = srcport as src_port  srcif AS src_interface 
FIELDALIAS-flow1 = ipproto AS transport sent AS bytes_out rcvd AS bytes_in 
FIELDALIAS-payload1 = ruleid AS rule op AS http_method arg AS uri_query 
FIELDALIAS-others1 = result AS status action AS vendor_action  cat_site AS category 

I would even write it in individual lines, to make it easier to debug/automate in future