diff --git a/src/output-json-flow.c b/src/output-json-flow.c index 4025480fff..1a999da4df 100644 --- a/src/output-json-flow.c +++ b/src/output-json-flow.c @@ -273,6 +273,12 @@ static void EveFlowLogJSON(OutputJsonThreadCtx *aft, JsonBuilder *jb, Flow *f) if (f->flags & FLOW_WRONG_THREAD) JB_SET_TRUE(jb, "wrong_thread"); + if (f->flags & FLOW_ACTION_DROP) { + JB_SET_STRING(jb, "action", "drop"); + } else if (f->flags & FLOW_ACTION_PASS) { + JB_SET_STRING(jb, "action", "pass"); + } + /* Close flow. */ jb_close(jb);