output/alert: check flag before logging app-layer

Ticket: 6846
2 years ago · 2b4e10224e
parent 910f6af54f
commit 2b4e10224e
1 changed files with 8 additions and 6 deletions
--- a/src/output-json-alert.c
+++ b/src/output-json-alert.c
@ -627,6 +627,7 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
        }

        if (p->flow != NULL) {
+            if (pa->flags & PACKET_ALERT_FLAG_TX) {
                if (json_output_ctx->flags & LOG_JSON_APP_LAYER) {
                    AlertAddAppLayer(p, jb, pa->tx_id, json_output_ctx->flags);
                }
@ -634,6 +635,7 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
                if (json_output_ctx->flags & LOG_JSON_RULE_METADATA) {
                    AlertAddFiles(p, jb, pa->tx_id);
                }
+            }

            EveAddAppProto(p->flow, jb);