Suricata

There is a regression between Suricata 7 and Suricata 8. The app_proto was logged in almost all events in 7 and is only log in a small subset (fileinfo, flow, frame, netflow) in 8.

This could trigger problem for people who have dashboards or search using this key. Also there is a interest in this information in case of protocol upgrade. For example in the case of TLS, it is useful to know that the TLS session is an upgrade of a previous session to avoid thinking this is an anomaly.