diff --git a/doc/userguide/upgrade.rst b/doc/userguide/upgrade.rst
index 1673d0db8a..8690db1885 100644
--- a/doc/userguide/upgrade.rst
+++ b/doc/userguide/upgrade.rst
@@ -127,6 +127,11 @@ Logging Changes
   ``client_hello_done`` is now ``client_hello``). See
   :doc:`firewall/tls-state-migration` for the old-to-new mapping.
 
+- NFS eve records are now logged in the flow direction, like SMB, HTTP and
+  DNS records: a record completed on a reply carries the client as
+  ``src_ip``/``src_port`` where 8.x logged the packet's addresses. Filters
+  that matched responses on ``src_port 2049`` need ``dest_port 2049`` now.
+
 Removals
 ~~~~~~~~
 
diff --git a/src/output-json-nfs.c b/src/output-json-nfs.c
index c95a16fa5a..9fd975a245 100644
--- a/src/output-json-nfs.c
+++ b/src/output-json-nfs.c
@@ -79,7 +79,11 @@ static int JsonNFSLogger(ThreadVars *tv, void *thread_data,
     if (SCNfsTxLoggingIsFiltered(state, nfstx))
         return TM_ECODE_OK;
 
-    SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "nfs", NULL, thread->ctx);
+    /* Log in the flow (request) direction, as SMB, HTTP and DNS do. A record
+     * is stamped once, when the tx ends, so with the packet direction the same
+     * flow would report its txs in both directions: toclient for the txs a real
+     * reply completed, toserver for the ones the flow-timeout flush ended. */
+    SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "nfs", NULL, thread->ctx);
     if (unlikely(jb == NULL)) {
         return TM_ECODE_OK;
     }