From eceb7dcba46621ab0ac5f600812c74fe4152affc Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Tue, 10 Dec 2019 12:48:56 +0100
Subject: [PATCH] eve: support pcap_filename for unix socket mode

Bug #3390.
---
 src/output-json.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/output-json.c b/src/output-json.c
index 925d9664ea..53b9441b79 100644
--- a/src/output-json.c
+++ b/src/output-json.c
@@ -1055,7 +1055,8 @@ OutputInitResult OutputJsonInitCtx(ConfNode *conf)
         const char *pcapfile_s = ConfNodeLookupChildValue(conf, "pcap-file");
         if (pcapfile_s != NULL && ConfValIsTrue(pcapfile_s)) {
             json_ctx->file_ctx->is_pcap_offline =
-                (RunmodeGetCurrent() == RUNMODE_PCAP_FILE);
+                (RunmodeGetCurrent() == RUNMODE_PCAP_FILE ||
+                 RunmodeGetCurrent() == RUNMODE_UNIX_SOCKET);
         }
 
         json_ctx->file_ctx->type = json_ctx->json_out;
-- 
2.47.2