eve/schema: add host

The "host" field is added to EVE events if the "sensor-name" field is configured in suricata.yaml.
2 years ago · 3802a51552
parent edb8cca825
commit 3802a51552
1 changed files with 5 additions and 0 deletions
--- a/etc/schema.json
+++ b/etc/schema.json
@ -39,6 +39,11 @@
        "flow_id": {
            "type": "integer"
        },
+        "host": {
+            "$comment": "May change to sensor_name in the future, or become user configurable: https://redmine.openinfosecfoundation.org/issues/4919",
+            "description": "the sensor-name, if configured",
+            "type": "string"
+        },
        "icmp_code": {
            "type": "integer"
        },