Currently as flows are processed, the interfaces are tagged in the DB as having flow.
If a particular interface is no longer sending flows, this interface is still tagged. No method of cleanup exists for interfaces.
1) Run expensive ES query on weekly/monthly basis for all interfaces with flows, compare and cleanup against database.
2) Add timestamp adjacent to flow tag in database, update field periodically to prevent flooding of DB timestamp updates. Create parameter that removes tag from interfaces if date is greater than X.
3) Similar to solution 2, run ES query for netflow indexes and calculate X from oldest index date.
4) Convert `hasflows` field in DB to date field updating periodically to represent last time flows seen.