I have deployed the traffic flow lua parser to my packet and log decoders as described in the guide Traffic Flow Lua Parser . The traffic_flow_options.lua file has been configured with internal and external network configurations and pushed to all decoders. The direction meta on log data is consistently wrong. Does anyone know why this is happening? Would I be better to remove the parser from my log decoders?