When:

• src IP matches ENI IP, flow log is egress, meaning src port is on ENI/EC2 and dst address and port are where ENI/EC2 is sending request/response
• dst IP matches ENI IP, flow logs is ingress, meaning dst port is on ENI/EC2 and src address and port are from where ENI/EC2 is receiving response/request

I find this hard to remember, also it is very hard to convert numeric TCP flags to actual flags. Numeric protocol and other fields flowlogs provide are not super clear, if you don't work with flow logs on daily basis as well.

That's why I created flowlogs cli tool to make it easier to create and query flow logs with clear output - https://github.com/pete911/flowlogs