eve-files: file -> fileinfo

Due to what appears to be an issue in logstash, the 'file' part of
the file event types was masked by a field that logstash-forwarder
added itself.

Since logstash-forwarder is an important part of the logstash stack,
this patch works around the issue by renaming our 'file' structure
to 'fileinfo', thus resolving the naming conflict.

Bug #1127

diff --git a/src/output-json-file.c b/src/output-json-file.c
index 2b46cfef23594f4f5fe78fd9aeaad542f2806b92..4f637b248b2a44d27a4138c9e395961d19daed72 100644 (file)
--- a/src/output-json-file.c
+++ b/src/output-json-file.c
@@ -231,9 +231,10 @@ static void FileWriteJsonRecord(JsonFileLogThread *aft, const Packet *p, const F
                         (ff->flags & FILE_STORED) ? json_true() : json_false());
     json_object_set_new(fjs, "size", json_integer(ff->size));
 
-    json_object_set_new(js, "file", fjs);
+    /* originally just 'file', but due to bug 1127 naming it fileinfo */
+    json_object_set_new(js, "fileinfo", fjs);
     OutputJSONBuffer(js, aft->filelog_ctx->file_ctx, buffer);
-    json_object_del(js, "file");
+    json_object_del(js, "fileinfo");
     json_object_del(js, "http");
 
     json_object_clear(js);