The dl_type=ARP (or any other dl_type) is overwritten if dst-ip/src-ip are specified later on in the json object. I added condition that only overwrites the field if it hasn't been already specified. This case only applies for src-ip, and dst-ip.