From: Victor Julien <victor@inliniac.net>
Date: Tue, 10 Dec 2019 11:48:56 +0000 (+0100)
Subject: eve: support pcap_filename for unix socket mode
X-Git-Tag: suricata-5.0.1~13
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eceb7dcba46621ab0ac5f600812c74fe4152affc;p=thirdparty%2Fsuricata.git

eve: support pcap_filename for unix socket mode

Bug #3390.
---

diff --git a/src/output-json.c b/src/output-json.c
index 925d9664ea..53b9441b79 100644
--- a/src/output-json.c
+++ b/src/output-json.c
@@ -1055,7 +1055,8 @@ OutputInitResult OutputJsonInitCtx(ConfNode *conf)
         const char *pcapfile_s = ConfNodeLookupChildValue(conf, "pcap-file");
         if (pcapfile_s != NULL && ConfValIsTrue(pcapfile_s)) {
             json_ctx->file_ctx->is_pcap_offline =
-                (RunmodeGetCurrent() == RUNMODE_PCAP_FILE);
+                (RunmodeGetCurrent() == RUNMODE_PCAP_FILE ||
+                 RunmodeGetCurrent() == RUNMODE_UNIX_SOCKET);
         }
 
         json_ctx->file_ctx->type = json_ctx->json_out;