There are ~105 distinct Cisco types extracted from the log messages (+/- a few generics).
I'm asking this question because I ran into this issue with some custom fields.
Is there a functional difference between interface and interface_name? Or proto or protocol?
Can they and/or should they be consolidated?