as a tls event can come from a flush after setting no_inspection
dest_ip: 172.217.14.206
dest_port: 443
event_type: tls
- pcap_cnt: 7
proto: TCP
src_ip: 172.26.0.39
src_port: 35958
dest_ip: 2607:f8b0:400a:0800:0000:0000:0000:200e
dest_port: 443
event_type: tls
- pcap_cnt: 41
proto: TCP
src_ip: 2600:1f13:00f8:d400:03a6:303c:e011:18eb
src_port: 60202
dest_ip: 2001:4860:4860:0000:0000:0000:0000:8888
dest_port: 443
event_type: tls
- pcap_cnt: 7
proto: TCP
src_ip: 2600:1f13:00f8:d400:03a6:303c:e011:18eb
src_port: 33892