eve: print app_proto_ts/app_proto_tc

9 years ago · c28d9d0538
parent dbb3a12b32
commit c28d9d0538
1 changed files with 10 additions and 1 deletions
--- a/src/output-json-flow.c
+++ b/src/output-json-flow.c
@ -187,7 +187,16 @@ static void JsonFlowLogJSON(JsonFlowLogThread *aft, json_t *js, Flow *f)
        return;
    }

-    json_object_set_new(js, "app_proto", json_string(AppProtoToString(f->alproto)));
+    json_object_set_new(js, "app_proto",
+            json_string(AppProtoToString(f->alproto)));
+    if (f->alproto_ts != f->alproto) {
+        json_object_set_new(js, "app_proto_ts",
+                json_string(AppProtoToString(f->alproto_ts)));
+    }
+    if (f->alproto_tc != f->alproto) {
+        json_object_set_new(js, "app_proto_tc",
+                json_string(AppProtoToString(f->alproto_tc)));
+    }

    json_object_set_new(hjs, "pkts_toserver",
            json_integer(f->todstpktcnt));