DNP3 logging sample.

dnp3-log-sample.txt

  "dnp3": {

// This is actually 16 bits of flags.  Should the flags be broken out into a list of symbolic names?
//
// Examples: 
//   - List flags that are set.
//     "iin": ["device_restart", "class_3_events"]
//   - List state of all flags:
//     "iin": {
//         "device_restart": true,
//         "device_trouble": false,
//         "class_3_events": true,
//         "class_2_events": false,
//         "class_1_events": true,
//         ...
//     }
    "iin": 0,
    "application": {
      "objects": [
        {
          "variation": 2,
          "group": 60
        }
      ],
      "function_code": 129,
      "sequence": 3,
// Another set of bits flags.  Same thoughts as iin above.
      "control": 195
    },
    "transport": 206,
    "dst": 1,
    "src": 10,
// Another set of bit flags.  Same thoughts as iin above.
    "control": 68,
    "type": "response"
  },

There is some precedence from flow logging to list out the true/false state for all flags.