From: Jason Ish <jason.ish@oisf.net>
Date: Thu, 12 Mar 2020 23:06:58 +0000 (-0600)
Subject: alert/eve: remove jansson specific feature (jsonbuilder prep)
X-Git-Tag: suricata-6.0.0-beta1~392
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cc4f9d7f3d45dbb2923471ec33ded694471461f8;p=thirdparty%2Fsuricata.git

alert/eve: remove jansson specific feature (jsonbuilder prep)

Remove the Jansson specific feature of being able to delete
an object from json_t, in prep for refactors to JsonBuilder.

Instead create a new header for each alert to be logged.
---

diff --git a/src/output-json-alert.c b/src/output-json-alert.c
index 5b078fc555..55b61626dc 100644
--- a/src/output-json-alert.c
+++ b/src/output-json-alert.c
@@ -405,18 +405,18 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
     if (p->alerts.cnt == 0 && !(p->flags & PKT_HAS_TAG))
         return TM_ECODE_OK;
 
-    json_t *js = CreateJSONHeader(p, LOG_DIR_PACKET, "alert");
-    if (unlikely(js == NULL))
-        return TM_ECODE_OK;
-
-    JsonAddCommonOptions(&json_output_ctx->cfg, p, p->flow, js);
-
     for (i = 0; i < p->alerts.cnt; i++) {
         const PacketAlert *pa = &p->alerts.alerts[i];
         if (unlikely(pa->s == NULL)) {
             continue;
         }
 
+        json_t *js = CreateJSONHeader(p, LOG_DIR_PACKET, "alert");
+        if (unlikely(js == NULL))
+            return TM_ECODE_OK;
+
+        JsonAddCommonOptions(&json_output_ctx->cfg, p, p->flow, js);
+
         MemBufferReset(aft->json_buffer);
 
         /* alert */
@@ -596,10 +596,8 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
         }
 
         OutputJSONBuffer(js, aft->file_ctx, &aft->json_buffer);
-        json_object_del(js, "alert");
+        json_decref(js);
     }
-    json_object_clear(js);
-    json_decref(js);
 
     if ((p->flags & PKT_HAS_TAG) && (json_output_ctx->flags &
             LOG_JSON_TAGGED_PACKETS)) {