eve: Log tenant_id for all eve-json messages

diff --git a/doc/userguide/configuration/multi-tenant.rst b/doc/userguide/configuration/multi-tenant.rst
index 683953a1669b9e2c9d15305321f36859c8d1d246..5ad0ee7c76ad3c7efd864b48d3dea6f9e90ba041 100644 (file)
--- a/doc/userguide/configuration/multi-tenant.rst
+++ b/doc/userguide/configuration/multi-tenant.rst
@@ -215,3 +215,10 @@ unregister-tenant-handler <tenant id> vlan <vlan id>
 
 The registration of tenant and tenant handlers can be done on a
 running engine.
+
+Eve JSON output
+---------------
+
+When multi-tenant support is configured and the detect engine is active then
+all EVE-types that report based on flows will also report the corresponding
+``tenant_id`` for events matching a tenant configuration.

diff --git a/doc/userguide/output/eve/eve-json-output.rst b/doc/userguide/output/eve/eve-json-output.rst
index a195a021bdf83baa24955ac713b0043c1614564c..b2079ea4571d89e7feba78ec3a708245de0ab528 100644 (file)
--- a/doc/userguide/output/eve/eve-json-output.rst
+++ b/doc/userguide/output/eve/eve-json-output.rst
@@ -501,5 +501,12 @@ YAML::
       # Seed value for the ID output. Valid values are 0-65535.
       community-id-seed: 0
 
+Multi Tenancy
+-------------
+
+Suricata can be configured to support multiple tenants with different detection
+engine configurations. When these tenants are configured and the detection
+engine is running then all EVE logging will also report the ``tenant_id`` field
+for traffic matching a specific tenant.
 
 .. _deprecation policy: https://suricata-ids.org/about/deprecation-policy/

diff --git a/src/output-json.c b/src/output-json.c
index 57b42220020d2c784ec0361b00c6f72637225ed6..1c1bda58b5d5e0b9959cd04fa63dd79dafdcffc3 100644 (file)
--- a/src/output-json.c
+++ b/src/output-json.c
@@ -453,6 +453,9 @@ void EveAddCommonOptions(const OutputJsonCommonSettings *cfg,
     if (cfg->include_community_id && f != NULL) {
         CreateEveCommunityFlowId(js, f, cfg->community_id_seed);
     }
+    if (f != NULL && f->tenant_id > 0) {
+        jb_set_uint(js, "tenant_id", f->tenant_id);
+    }
 }
 
 /**