eve/dns: make version required

The "eve.version" field is not always logged. Update the schema to
enforce that it is, and fix it for records that don't log it.

Ticket: #7167
(cherry picked from commit fcc1b1067b)
pull/11684/head
Jason Ish 1 year ago committed by Victor Julien
parent 304fe41762
commit 03844b4291

@ -961,6 +961,9 @@
}, },
"dns": { "dns": {
"type": "object", "type": "object",
"required": [
"version"
],
"properties": { "properties": {
"aa": { "aa": {
"type": "boolean" "type": "boolean"
@ -996,6 +999,7 @@
"type": "string" "type": "string"
}, },
"version": { "version": {
"description": "The version of this EVE DNS event",
"type": "integer" "type": "integer"
}, },
"opcode": { "opcode": {

@ -230,6 +230,7 @@ static void AlertJsonDns(const Flow *f, const uint64_t tx_id, JsonBuilder *js)
dns_state, tx_id); dns_state, tx_id);
if (txptr) { if (txptr) {
jb_open_object(js, "dns"); jb_open_object(js, "dns");
jb_set_int(js, "version", 2);
JsonBuilder *qjs = JsonDNSLogQuery(txptr); JsonBuilder *qjs = JsonDNSLogQuery(txptr);
if (qjs != NULL) { if (qjs != NULL) {
jb_set_object(js, "query", qjs); jb_set_object(js, "query", qjs);

@ -323,6 +323,7 @@ static int JsonDnsLoggerToServer(ThreadVars *tv, void *thread_data,
} }
jb_open_object(jb, "dns"); jb_open_object(jb, "dns");
jb_set_int(jb, "version", 2);
if (!rs_dns_log_json_query(txptr, i, td->dnslog_ctx->flags, jb)) { if (!rs_dns_log_json_query(txptr, i, td->dnslog_ctx->flags, jb)) {
jb_free(jb); jb_free(jb);
break; break;

Loading…
Cancel
Save