eve2pcap: use sid as name when available

[victorjulien]

Tested locally in oneshot mode, appears to work correctly.

[jasonish]

Better for sure. Do you think there is anything else that should go in that filename?

[victorjulien]

Better for sure. Do you think there is anything else that should go in that filename?

I guess in my workflow I would call something inliniac-public-sid-12345-dns-blah.pcap, so maybe at least the app proto? But an option that would present a text box could also work, but not sure how that would work here.

[jasonish]

Merged. Thanks!