field,is_recommended
action,true
src,true
src_ip,true
dest,true
dest_ip,true
dest_mac,true
signature,true
category,true
file_name,true
file_path,true
user,true
protocol,true
query,true
answer,true
recipient,true
src_user,true
query_type,true
message_type,true
app,true
lease_duration,true
bytes_in,true
bytes_out,true
http_content_type,true
http_method,true
http_user_agent,true
status,true
url,true
vendor_product,true