eve/frame: require frame length to be known

Or reach logging threshold.

Avoids logging too early.

Ticket: #7440.

src/output-json-frame.c

@@ -369,7 +369,9 @@ static int FrameJson(ThreadVars *tv, JsonFrameLogThread *aft, const Packet *p)
             int64_t abs_offset = (int64_t)frame->offset + (int64_t)STREAM_BASE_OFFSET(stream);
             int64_t win = STREAM_APP_PROGRESS(stream) - abs_offset;
 
-            if (!eof && win < frame->len && win < 2500) {
+            /* skip frame if threshold not yet reached, esp if frame length is
+             * still unknown. */
+            if (!eof && ((frame->len == -1) || (win < frame->len)) && win < 2500) {
                 SCLogDebug("frame id %" PRIi64 " len %" PRIi64 ", win %" PRIi64
                            ", skipping logging",
                         frame->id, frame->len, win);