eve: log max regions

3 years ago · 96dfd65b96
parent 1bb6f44ff0
commit 96dfd65b96
2 changed files with 9 additions and 0 deletions
--- a/etc/schema.json
+++ b/etc/schema.json
@ -5285,6 +5285,9 @@
                "tc_gap": {
                    "type": "boolean"
                },
+                "tc_max_regions": {
+                    "type": "integer"
+                },
                "tcp_flags": {
                    "type": "string"
                },
@ -5297,6 +5300,9 @@
                "ts_gap": {
                    "type": "boolean"
                },
+                "ts_max_regions": {
+                    "type": "integer"
+                },
                "urg": {
                    "type": "boolean"
                }
--- a/src/output-json-flow.c
+++ b/src/output-json-flow.c
@ -313,6 +313,9 @@ static void EveFlowLogJSON(OutputJsonThreadCtx *aft, JsonBuilder *jb, Flow *f)
            if (FlowHasGaps(f, STREAM_TOSERVER)) {
                JB_SET_TRUE(jb, "ts_gap");
            }
+
+            jb_set_uint(jb, "ts_max_regions", ssn->client.sb.max_regions);
+            jb_set_uint(jb, "tc_max_regions", ssn->server.sb.max_regions);
        }

        /* Close tcp. */