In Snort we expect `nevent` because you can hint that its `kind` is 1063
Discussion
Humm... What do you do with the kind before loading the event?
It just takes a shorter path in the code currently
When the kind is set i can skip a few elements in the tree, but in general i think its good to have these hints so you can make decisions earlier