From: Philippe Antoine <pantoine@oisf.net>
Date: Fri, 1 Jul 2022 13:52:33 +0000 (+0200)
Subject: output: do not log empty arrays for sid
X-Git-Tag: suricata-7.0.0-beta1~369
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=da0be16d360c891ffdee6b8648bb7f81e9020613;p=thirdparty%2Fsuricata.git

output: do not log empty arrays for sid

Ticket: #5167
---

diff --git a/src/output-json.c b/src/output-json.c
index de322104c5..4590fe244d 100644
--- a/src/output-json.c
+++ b/src/output-json.c
@@ -132,11 +132,13 @@ void EveFileInfo(JsonBuilder *jb, const File *ff, const bool stored)
 {
     jb_set_string_from_bytes(jb, "filename", ff->name, ff->name_len);
 
-    jb_open_array(jb, "sid");
-    for (uint32_t i = 0; ff->sid != NULL && i < ff->sid_cnt; i++) {
-        jb_append_uint(jb, ff->sid[i]);
+    if (ff->sid_cnt > 0) {
+        jb_open_array(jb, "sid");
+        for (uint32_t i = 0; ff->sid != NULL && i < ff->sid_cnt; i++) {
+            jb_append_uint(jb, ff->sid[i]);
+        }
+        jb_close(jb);
     }
-    jb_close(jb);
 
 #ifdef HAVE_MAGIC
     if (ff->magic)