eve/frame: implement payload-buffer-size option

Modeled after the same option in eve/alert. Defaults to 4k.

diff --git a/src/output-json-frame.c b/src/output-json-frame.c
index 665010a6e44abd73db2bbace9ddc51389ef01911..3bccdc6b2f0a97680468bdbac7856b7c1d15b8c4 100644 (file)
--- a/src/output-json-frame.c
+++ b/src/output-json-frame.c
@@ -482,8 +482,22 @@ static OutputInitResult JsonFrameLogInitCtxSub(ConfNode *conf, OutputCtx *parent
         goto error;
     }
 
+    uint32_t payload_buffer_size = 4096;
+    if (conf != NULL) {
+        const char *payload_buffer_value = ConfNodeLookupChildValue(conf, "payload-buffer-size");
+        if (payload_buffer_value != NULL) {
+            uint32_t value;
+            if (ParseSizeStringU32(payload_buffer_value, &value) < 0) {
+                SCLogError("Error parsing payload-buffer-size \"%s\"", payload_buffer_value);
+                goto error;
+            }
+            payload_buffer_size = value;
+        }
+    }
+
     json_output_ctx->file_ctx = ajt->file_ctx;
     json_output_ctx->eve_ctx = ajt;
+    json_output_ctx->payload_buffer_size = payload_buffer_size;
 
     output_ctx->data = json_output_ctx;
     output_ctx->DeInit = JsonFrameLogDeInitCtxSub;

diff --git a/suricata.yaml.in b/suricata.yaml.in
index a6d91b27d426afe7f9a2ca891a01222120ca7ab7..38f5152f5dade67f328e85888b951aba3f4ea572 100644 (file)
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -177,6 +177,7 @@ outputs:
         - frame:
             # disabled by default as this is very verbose.
             enabled: no
+            # payload-buffer-size: 4kb # max size of frame payload buffer to output in eve-log
         - anomaly:
             # Anomaly log records describe unexpected conditions such
             # as truncated packets, packets with invalid IP/UDP/TCP