Suricata

This looks similiar to #385 for me. What you could do, you can use the packet info from the eve.json log and convert it back to a normal packet.

I wonder if this could simply be done by adding an option to 'pcap-log' to respect the tag keyword?

I think this ticket is different enough from #385. That ticket is more about logging out in memory stream segments I think.

We will want to have documentation how this can be achieved with external tooling.
We also add, if possible, the directory where the pcap is stored or the filename if possible.
Lastline might have a possible solution for that and will try to contribute.
We will break that into three dedicated tickets.

I think this is satisfied by the solution we have for #120.

Duplicate of #120.