improve find fileds for default profiles

README.md

@@ -136,6 +136,23 @@ Ollama profile advisor can refine those recommendations, but the deterministic
 profile discovery remains the fallback when Ollama is disabled, missing, slow, or
 returns invalid JSON.
 
+Cross-stream discovery is semantic, not just exact-name matching. Source IP
+fields such as `srcip`, `source.ip`, `source_ip`, and `client_ip` are grouped as
+the same shared entity field. The same approach is used for destination IPs,
+ports, timestamps, actions, severities, usernames, hosts, event IDs, DNS names,
+services, URLs, and context/message fields. Recommended profiles show both the
+selected per-stream fields and the shared alias groups so you can see why a field
+is useful for correlation even when different products use different schemas.
+If the Ollama advisor returns no usable profile for a stream, the row stays on
+the deterministic profile and is labeled as a heuristic fallback instead of
+pretending the whole recommendation failed.
+
+Recommended profiles can be re-applied to existing profiles. Enable `show
+existing profiles` and click `Update profile` to append newly discovered entity,
+categorical, numeric, and detector fields. Existing profile names, field weights,
+and detector threshold settings are preserved, so this is the fast path after
+field-alias matching improves or after Graylog starts parsing additional fields.
+
 Enabled streams are normalized through the same event model. Stream profiles
 define the entity, timestamp, categorical, and numeric fields used for baselines.
 The dashboard and Ollama then correlate behavior across sources, for example a