]> git.ipfire.org Git - thirdparty/suricata.git/commit
json file: separate http params 810/head
authorEric Leblond <eric@regit.org>
Fri, 31 Jan 2014 11:05:48 +0000 (12:05 +0100)
committerEric Leblond <eric@regit.org>
Fri, 31 Jan 2014 11:05:48 +0000 (12:05 +0100)
commit0189b4d1ebf6f4834b2e3d2def1436dddaa624cc
tree1e896a949caff67f2ef812e1b42e5280980a09a2
parent6fd9b4b255abac78a4dff88dcd4d10f279c632ce
json file: separate http params

This patch separates http keys from file to have a different value
list:

{
 "time":"01\/31\/2014-12:04:52.837245","event_type":"file","src_ip":"5.3.1.1","src_port":80,"dest_ip":"1.8.1.9","dest_port":9539,"proto":"TCP",
 "http":{"url":"/foo/","hostname":"bar.com","http_refer":"http:\/\/bar.org","http_user_agent":"Mozilla\/5.0"},
 "file":{"filename":"bar","magic":"unknown","state":"CLOSED","stored":false,"size":21}
}

One interest of this modification is that it is possible to use the
same key as the one used in http events. Thus correlating both type
of events is trivial. On code side, this will permit to factorize
the code by simply asking the underlying protocol to output its
info in a json object.

Second interest is that adding file extraction for a new protocol
will result in only changing the protocol specific json list.
src/output-json-file.c