ragator default aggregation strategy

[Wozz]

Greetings,

  I'm curious how ragator's default aggregation strategy would be expressed in
flowfile(5) syntax.  What I'm trying to do is filter out known 'good' traffic
flows, and then have the rest of the traffic aggregated as ragator normally
does.  If something is not matched in a flowfile statement, is it aggregated as
ragator normally does?  If not, how would I configure the flowfile to do so.
Thanks!

Matt