Suricata

Actually thinking this ticket can be closed. All info is available, you can just create a little script to merge the counters.

It is possible as you say Victor just to add a small script to parse the logs and then be able to process the data elsewere as needed. But this design choice puts many users in the situation of creating lots of small scripts and reinventing the wheel again and again. The lack aggregated data can create large and "hard to handle" logs (say with 32 threads in AF_PACKET running).

This could possibally be set as an option in the stats configuration, eg: - aggregated: yes/no