eve: reduce flow_id to 51 bits

Evebox & ELK couldn't handle the large integers. It looks like (partly)
a javascript limitation that doesn't treat 64bit ints as real ints.

diff --git a/src/output-json.c b/src/output-json.c
index cf19df8acf6183daf50d1bb396c8e5e12be40699..7fb06c535a821fc2406dede581d3c912d31cbd91 100644 (file)
--- a/src/output-json.c
+++ b/src/output-json.c
@@ -167,6 +167,9 @@ void CreateJSONFlowId(json_t *js, const Flow *f)
     if (f == NULL)
         return;
     int64_t flow_id = FlowGetId(f);
+    /* reduce to 51 bits as Javascript and even JSON often seem to
+     * max out there. */
+    flow_id &= 0x7ffffffffffffLL;
     json_object_set_new(js, "flow_id", json_integer(flow_id));
 }