log/anomaly: Move metadata out of anomaly section

This commit moves the metadata from the anomaly object where it was
incorrectly located.

diff --git a/src/output-json-anomaly.c b/src/output-json-anomaly.c
index 112076edb5bf681f32dcafa88c003ae7a2018337..ad55ecc36fc49b59e7ae8ab388422eacd1b7c378 100644 (file)
--- a/src/output-json-anomaly.c
+++ b/src/output-json-anomaly.c
@@ -128,12 +128,12 @@ static int AnomalyDecodeEventJson(ThreadVars *tv, JsonAnomalyLogThread *aft,
             return TM_ECODE_OK;
         }
 
-        jb_open_object(js, ANOMALY_EVENT_TYPE);
-
         if (is_ip_pkt) {
             EveAddCommonOptions(&aft->json_output_ctx->cfg, p, p->flow, js);
         }
 
+        jb_open_object(js, ANOMALY_EVENT_TYPE);
+
         if (event_code < DECODE_EVENT_MAX) {
             const char *event = DEvents[event_code].event_name;
             if (EVENT_IS_DECODER_PACKET_ERROR(event_code)) {