Jeff, How about the hosts which do not generate logs? BYOD is a fact of life after all. A log management system by itself is not capable of retaining flow information as well. Are you dismissing the state of your network when analyzing the logs?