about packet's load

I use "packet load" as : the data of IP packet , or the data of TCP/UDP

Ah - the term you're looking for is "payload". You can get this using
the "packet_contents" event handler, or using the new signature engine
(for which Robin Sommer has contributed a new chapter for the Bro
manual, which will be included in the next development release).