From: Jeff Lucovsky <jeff@lucovsky.org>
Date: Fri, 18 Sep 2020 11:53:10 +0000 (-0400)
Subject: log/anomaly: Move metadata out of anomaly section
X-Git-Tag: suricata-6.0.0~48
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bb71eac9f91a52c3c6c32906497402de9c991a68;p=thirdparty%2Fsuricata.git

log/anomaly: Move metadata out of anomaly section

This commit moves the metadata from the anomaly object where it was
incorrectly located.
---

diff --git a/src/output-json-anomaly.c b/src/output-json-anomaly.c
index 112076edb5..ad55ecc36f 100644
--- a/src/output-json-anomaly.c
+++ b/src/output-json-anomaly.c
@@ -128,12 +128,12 @@ static int AnomalyDecodeEventJson(ThreadVars *tv, JsonAnomalyLogThread *aft,
             return TM_ECODE_OK;
         }
 
-        jb_open_object(js, ANOMALY_EVENT_TYPE);
-
         if (is_ip_pkt) {
             EveAddCommonOptions(&aft->json_output_ctx->cfg, p, p->flow, js);
         }
 
+        jb_open_object(js, ANOMALY_EVENT_TYPE);
+
         if (event_code < DECODE_EVENT_MAX) {
             const char *event = DEvents[event_code].event_name;
             if (EVENT_IS_DECODER_PACKET_ERROR(event_code)) {