alert/eve: remove jansson specific feature (jsonbuilder prep)

Remove the Jansson specific feature of being able to delete
an object from json_t, in prep for refactors to JsonBuilder.

Instead create a new header for each alert to be logged.

diff --git a/src/output-json-alert.c b/src/output-json-alert.c
index 5b078fc555b9bda0a2a42b974913932e802b2ed3..55b61626dc7527cad64a9cc4f7ca5c82fd43c92e 100644 (file)
--- a/src/output-json-alert.c
+++ b/src/output-json-alert.c
@@ -405,18 +405,18 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
     if (p->alerts.cnt == 0 && !(p->flags & PKT_HAS_TAG))
         return TM_ECODE_OK;
 
-    json_t *js = CreateJSONHeader(p, LOG_DIR_PACKET, "alert");
-    if (unlikely(js == NULL))
-        return TM_ECODE_OK;
-
-    JsonAddCommonOptions(&json_output_ctx->cfg, p, p->flow, js);
-
     for (i = 0; i < p->alerts.cnt; i++) {
         const PacketAlert *pa = &p->alerts.alerts[i];
         if (unlikely(pa->s == NULL)) {
             continue;
         }
 
+        json_t *js = CreateJSONHeader(p, LOG_DIR_PACKET, "alert");
+        if (unlikely(js == NULL))
+            return TM_ECODE_OK;
+
+        JsonAddCommonOptions(&json_output_ctx->cfg, p, p->flow, js);
+
         MemBufferReset(aft->json_buffer);
 
         /* alert */
@@ -596,10 +596,8 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
         }
 
         OutputJSONBuffer(js, aft->file_ctx, &aft->json_buffer);
-        json_object_del(js, "alert");
+        json_decref(js);
     }
-    json_object_clear(js);
-    json_decref(js);
 
     if ((p->flags & PKT_HAS_TAG) && (json_output_ctx->flags &
             LOG_JSON_TAGGED_PACKETS)) {