DHCP brief vs full...

dhcp.json

{
    "timestamp": "2017-01-12T14:19:31.564270-0600",
    "flow_id": 995572963318830,
    "pcap_cnt": 3,
    "event_type": "dhcp",
    "src_ip": "10.16.1.1",
    "src_port": 67,
    "dest_ip": "10.16.1.166",
    "dest_port": 68,
    "proto": "UDP",
    "dhcp": {
	"id": 1844287072,
	"request": {
	    "type": "discover",
	    "client_ip": "10.16.1.166",
	    "hostname": "SELKS",
	    "params": [
		"subnet_mask",
		"router",
		"domain",
		"dns_server",
		"ntp_server"
	    ]
	},
	"response": {
	    "type": "offer",
	    "server_ip": "10.16.1.1",
	    "lease_time": 3600,
	    "renewal_time": 1800,
	    "rebinding_time": 3150,
	    "subnet_mask": "255.255.255.0",
	    "dns_ip": "8.8.8.8",
	    "router_ip": "10.16.1.1"
	}
    }
}

// Brief...
{
    "timestamp": "2017-01-12T14:19:31.564270-0600",
    "flow_id": 995572963318830,
    "pcap_cnt": 3,
    "event_type": "dhcp",
    // Should the the IP address of the client, even if thats 0.0.0.0
    // in the case of no response.
    "src_ip": "10.16.1.1",
    "src_port": 67,
    "dest_ip": "10.16.1.166",
    "dest_port": 68,
    "proto": "UDP",
    "dhcp": {
	"client_hw": "08:00:27:0f:9b:b9",
	// Or "assigned_ip"?
	"client_ip": "10.16.1.166",
	"lease_time": 3600,
	"hostname": "SELKS",
	"id": 1844287072
    }
}