From b81ea0d7dbcfd3c997b6d02806e79214fb45244d Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 1 Sep 2016 20:34:26 +0200 Subject: [PATCH] eve: reduce flow_id to 51 bits Evebox & ELK couldn't handle the large integers. It looks like (partly) a javascript limitation that doesn't treat 64bit ints as real ints. --- src/output-json.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/output-json.c b/src/output-json.c index cf19df8acf..7fb06c535a 100644 --- a/src/output-json.c +++ b/src/output-json.c @@ -167,6 +167,9 @@ void CreateJSONFlowId(json_t *js, const Flow *f) if (f == NULL) return; int64_t flow_id = FlowGetId(f); + /* reduce to 51 bits as Javascript and even JSON often seem to + * max out there. */ + flow_id &= 0x7ffffffffffffLL; json_object_set_new(js, "flow_id", json_integer(flow_id)); } -- 2.47.2