eve: support pcap_filename for unix socket mode

Bug #3390.

(cherry picked from commit eceb7dcba46621ab0ac5f600812c74fe4152affc)

diff --git a/src/output-json.c b/src/output-json.c
index ab488b9c7085a15f41a8e18395f522a4cc88f44f..cbcf02d924bdf329bcb40acb6d98473e86289510 100644 (file)
--- a/src/output-json.c
+++ b/src/output-json.c
@@ -1040,7 +1040,8 @@ OutputInitResult OutputJsonInitCtx(ConfNode *conf)
         const char *pcapfile_s = ConfNodeLookupChildValue(conf, "pcap-file");
         if (pcapfile_s != NULL && ConfValIsTrue(pcapfile_s)) {
             json_ctx->file_ctx->is_pcap_offline =
-                (RunmodeGetCurrent() == RUNMODE_PCAP_FILE);
+                (RunmodeGetCurrent() == RUNMODE_PCAP_FILE ||
+                 RunmodeGetCurrent() == RUNMODE_UNIX_SOCKET);
         }
 
         json_ctx->file_ctx->type = json_ctx->json_out;