I'm having difficulty understanding why vantage_point is an attribute of a Trace, but group_id is an attribute of an Event.
draft-ietf-quic-qlog-main-schema-07 section 3.2 states that "a single trace only contains events for a single logical QUIC connection". Section 6.6 doesn't commit to what a group_id is, but strongly implies that a group_id uniquely identifies a connection. If this is the case, then I'd expect the group_id to always be consistent for every event in a trace. You can model that by setting the group_id in the Trace common_fields, but if it's always going to be consistent, why isn't it an attribute of the Trace? Perhaps section 3.2 is wrong about every trace containing events for a single connection. Section 6.6 offers the example of a middlebox logging traffic, which perhaps might be expected to log packets from many connections to a single trace? And section 6.6 also says that *typically* a single trace contains events belonging to a single logical group, not that it must do so. If a trace can contain events for many connections, such that the group_id is an attribute of individual events, might not a single trace also contain events for multiple vantage points? An endpoint might act as both a server and a client for different connections. (Does the location of vantage_point stem from a view that a logging endpoint is always either a source of client or server connections, but never both?) I think this would make more sense to me if either vantage_point was an attribute of an Event, in which case a trace may clearly contain events for many connections and a Trace is a just a place to put a name and common fields; or if group_id was an attribute of Trace, in which case there's a one-to-one relationship between traces and connections. But perhaps I'm missing something?
