@johnpoz
I definitely agree on volume / time / bandwidth.
The issue is nprobe is not free, but I saw an option to send flows to an ELK.
In the meantime, trying scrutinizer, elastiflow and others.
But at least, I know what i'm looking for is not embedded in Pfsense.
In the meantime, if someone has a good idea :)