Suricata

jq 'select(.event_type=="flow" and .app_proto=="enip") | .app_proto' log/eve.json | wc -l gives 1 ENIP detection-only flow

But
jq 'select(.event_type=="stats") | .stats."app_layer".flow.enip' log/eve.json gives 0