From bb71eac9f91a52c3c6c32906497402de9c991a68 Mon Sep 17 00:00:00 2001
From: Jeff Lucovsky <jeff@lucovsky.org>
Date: Fri, 18 Sep 2020 07:53:10 -0400
Subject: [PATCH] log/anomaly: Move metadata out of anomaly section

This commit moves the metadata from the anomaly object where it was
incorrectly located.
---
 src/output-json-anomaly.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/output-json-anomaly.c b/src/output-json-anomaly.c
index 112076edb5..ad55ecc36f 100644
--- a/src/output-json-anomaly.c
+++ b/src/output-json-anomaly.c
@@ -128,12 +128,12 @@ static int AnomalyDecodeEventJson(ThreadVars *tv, JsonAnomalyLogThread *aft,
             return TM_ECODE_OK;
         }
 
-        jb_open_object(js, ANOMALY_EVENT_TYPE);
-
         if (is_ip_pkt) {
             EveAddCommonOptions(&aft->json_output_ctx->cfg, p, p->flow, js);
         }
 
+        jb_open_object(js, ANOMALY_EVENT_TYPE);
+
         if (event_code < DECODE_EVENT_MAX) {
             const char *event = DEvents[event_code].event_name;
             if (EVENT_IS_DECODER_PACKET_ERROR(event_code)) {
-- 
2.47.2