output: Add linktype name

Issue: 6954

This commit adds the linktype name to the output stream. The name is
determined from the pcap utility function pcap_datalink_val_to_name
pull/12497/head
Jeff Lucovsky 9 months ago
parent 1e63a9d172
commit 7a75a1cdae

@ -3494,6 +3494,10 @@
"properties": {
"linktype": {
"type": "integer"
},
"linktype_name": {
"type": "string",
"description": "the descriptive name of the linktype"
}
},
"additionalProperties": false

@ -428,8 +428,15 @@ void EvePacket(const Packet *p, JsonBuilder *js, uint32_t max_length)
return;
}
if (!jb_set_uint(js, "linktype", p->datalink)) {
jb_close(js);
return;
}
const char *dl_name = DatalinkValueToName(p->datalink);
// Intentionally ignore the return value from jb_set_string and proceed
// so the jb object is closed
jb_set_string(js, "linktype_name", dl_name == NULL ? "n/a" : dl_name);
jb_close(js);
}

Loading…
Cancel
Save