Eric Leblond
6fd9b4b255
json: add event_type key
...
This patch adds an event_type key to the generated events. Current
value is one of "dns", "alert, "file", "tls", "http", "drop". It is
then easy to differentiate in log analysis tools the events based on
source inside Suricata.
12 years ago
Eric Leblond
7a9efd74e4
json: sync key name with CIM
...
This patch is synchronizing key name with Common Information Model.
It updates key name following what is proposed in:
http://docs.splunk.com/Documentation/PCI/2.0/DataSource/CommonInformationModelFieldReference
The interest of these modifications is that using the same key name
as other software will provide an easy to correlate and improve
data. For example, geoip setting in logstash can be applied on
all src_ip fields allowing geoip tagging of data.
12 years ago
Victor Julien
31a024c9b5
Various fixes for scan-build warnings
12 years ago
Victor Julien
cd7a5ff0ca
output: cleanups
...
Preparation of making output type for json logs configurable.
12 years ago
Victor Julien
5874f52ec6
json: rename output-httplog -> output-json-http
12 years ago
Victor Julien
b5ef269b03
json outputs: cleanups
...
Clean up header files and improve memory handling.
12 years ago
Victor Julien
3fc63d3656
jansson file log: make file log module
...
Turn the libjansson based file logger into a file module, as a child
of eve-log.
12 years ago
Victor Julien
039f7b3e5f
tls json: turn into packet logger
...
Like log-tls, turn the json tls logger into a packet logger as the
protocol parser is not tx aware.
Make it a child of eve-log as well.
12 years ago
Victor Julien
f0aa2ed240
json drop log: move into packet module
...
Move JSON drop log into a full packet module.
12 years ago
Victor Julien
85335d9cbe
alert json: make child of eve-log
...
Enable alert json for eve-log by registering the module as a sub-
module of eve-log.
12 years ago
Victor Julien
42858647e2
alert-json: make full module out of json alert
...
Make a full module out of the json alert code in output-json-alert.[ch].
12 years ago
Victor Julien
8c3e71559a
dns-json: turn logger to tx api
...
Convert Json DNS logger into a Tx Logger API logger.
12 years ago
Victor Julien
bc71a43e08
http-json: separate module using tx api
...
Turn HTTP json logger into a Tx Logger API logger.
12 years ago
Victor Julien
4874d5abbb
Various compile fixes after rebase with master
12 years ago
Tom DeCanio
6fd1b31c57
Remaining JSON output pull request comment edits
12 years ago
Tom DeCanio
a3d86594dc
address most initial JSON pull request comments
12 years ago
Tom DeCanio
55df2d5cdb
add "united" drop JSON log
12 years ago
Tom DeCanio
0c067646a8
Add "united" JSON files output
12 years ago
Tom DeCanio
730ee3d721
First cut at "united" file log output in JSON
12 years ago
Tom DeCanio
3241732e27
rename alert-json.[ch] output-json.[ch]
12 years ago