Well, a tag is based on a field-value pair. In the question above, the tag was created against the eventtype.
There is no reason why you couldn't use the eventtype directly - or even the tag.
The problem arises when you want to say "by eventtype" or "by tag" in a command like stats - because there may be lots of tags or eventtypes that you don't care about.
You could do a calculated field:
field: traffic_direction
calculation: case(eventtype=="inbound","inbound",eventtype=="outbound","outbound", etc.
You could make the field calculation anything that makes sense for your environment. The calculated field will always be available (although you will have to set its permissions for other people to use it).
... View more