eve: support pcap_filename for unix socket mode

Bug #3390.

diff --git a/src/output-json.c b/src/output-json.c
index 925d9664ea310113dec161bcf8dd258f6f478355..53b9441b7935554d4cfee29a668fbaac9139a22b 100644 (file)
--- a/src/output-json.c
+++ b/src/output-json.c
@@ -1055,7 +1055,8 @@ OutputInitResult OutputJsonInitCtx(ConfNode *conf)
         const char *pcapfile_s = ConfNodeLookupChildValue(conf, "pcap-file");
         if (pcapfile_s != NULL && ConfValIsTrue(pcapfile_s)) {
             json_ctx->file_ctx->is_pcap_offline =
-                (RunmodeGetCurrent() == RUNMODE_PCAP_FILE);
+                (RunmodeGetCurrent() == RUNMODE_PCAP_FILE ||
+                 RunmodeGetCurrent() == RUNMODE_UNIX_SOCKET);
         }
 
         json_ctx->file_ctx->type = json_ctx->json_out;