Go to the documentation of this file.
66 #define DEFAULT_LOG_FILENAME "eve.json"
67 #define MODULE_NAME "OutputJSON"
69 #define MAX_JSON_SIZE 2048
71 static void OutputJsonDeInitCtx(
OutputCtx *);
72 static void CreateEveCommunityFlowId(SCJsonBuilder *js,
const Flow *f,
const uint16_t seed);
73 static int CreateJSONEther(
76 static const char *TRAFFIC_ID_PREFIX =
"traffic/id/";
77 static const char *TRAFFIC_LABEL_PREFIX =
"traffic/label/";
78 static size_t traffic_id_prefix_len = 0;
79 static size_t traffic_label_prefix_len = 0;
87 traffic_id_prefix_len = strlen(TRAFFIC_ID_PREFIX);
88 traffic_label_prefix_len = strlen(TRAFFIC_LABEL_PREFIX);
101 json_t * retval = json_string(val);
103 if (retval == NULL) {
106 for (u = 0; u < strlen(val); u++) {
107 if (isprint(val[u])) {
116 retval = json_string(retbuf);
122 static int64_t sensor_id = -1;
126 SCJbSetStringFromBytes(jb,
"filename", ff->
name, ff->
name_len);
129 SCJbOpenArray(jb,
"sid");
130 for (uint32_t i = 0; ff->
sid != NULL && i < ff->
sid_cnt; i++) {
131 SCJbAppendUint(jb, ff->
sid[i]);
138 SCJbSetString(jb,
"magic", (
char *)ff->magic);
145 SCJbSetHex(jb,
"md5", (uint8_t *)ff->
md5, (uint32_t)
sizeof(ff->
md5));
148 SCJbSetHex(jb,
"sha1", (uint8_t *)ff->
sha1, (uint32_t)
sizeof(ff->
sha1));
163 SCJbSetHex(jb,
"sha256", (uint8_t *)ff->
sha256, (uint32_t)
sizeof(ff->
sha256));
178 SCJbSetUint(jb,
"start", ff->
start);
179 SCJbSetUint(jb,
"end", ff->
end);
181 SCJbSetUint(jb,
"tx_id", tx_id);
184 static void EveAddPacketVars(
const Packet *p, SCJsonBuilder *js_vars)
186 if (p == NULL || p->
pktvar == NULL) {
192 if (pv->
key || pv->
id > 0) {
194 SCJbOpenArray(js_vars,
"pktvars");
197 SCJbStartObject(js_vars);
199 if (pv->
key != NULL) {
201 uint8_t keybuf[pv->
key_len + 1];
204 uint8_t printable_buf[
len + 1];
207 SCJbSetString(js_vars, (
char *)keybuf, (
char *)printable_buf);
211 uint8_t printable_buf[
len + 1];
214 SCJbSetString(js_vars, varname, (
char *)printable_buf);
233 static bool SCStringHasPrefix(
const char *s,
const char *prefix)
235 if (strncmp(s, prefix, strlen(prefix)) == 0) {
241 static void EveAddFlowVars(
const Flow *f, SCJsonBuilder *js_root, SCJsonBuilder **js_traffic)
243 if (f == NULL || f->
flowvar == NULL) {
246 SCJsonBuilder *js_flowvars = NULL;
247 SCJsonBuilder *js_traffic_id = NULL;
248 SCJsonBuilder *js_traffic_label = NULL;
249 SCJsonBuilder *js_flowints = NULL;
250 SCJsonBuilder *js_flowbits = NULL;
259 if (js_flowvars == NULL) {
260 js_flowvars = SCJbNewArray();
261 if (js_flowvars == NULL)
266 uint8_t printable_buf[
len + 1];
271 SCJbStartObject(js_flowvars);
272 SCJbSetString(js_flowvars, varname, (
char *)printable_buf);
273 SCJbClose(js_flowvars);
276 if (js_flowvars == NULL) {
277 js_flowvars = SCJbNewArray();
278 if (js_flowvars == NULL)
282 uint8_t keybuf[fv->
keylen + 1];
287 uint8_t printable_buf[
len + 1];
292 SCJbStartObject(js_flowvars);
293 SCJbSetString(js_flowvars, (
const char *)keybuf, (
char *)printable_buf);
294 SCJbClose(js_flowvars);
299 if (js_flowints == NULL) {
300 js_flowints = SCJbNewObject();
301 if (js_flowints == NULL)
313 if (SCStringHasPrefix(varname, TRAFFIC_ID_PREFIX)) {
314 if (js_traffic_id == NULL) {
315 js_traffic_id = SCJbNewArray();
316 if (
unlikely(js_traffic_id == NULL)) {
320 SCJbAppendString(js_traffic_id, &varname[traffic_id_prefix_len]);
321 }
else if (SCStringHasPrefix(varname, TRAFFIC_LABEL_PREFIX)) {
322 if (js_traffic_label == NULL) {
323 js_traffic_label = SCJbNewArray();
324 if (
unlikely(js_traffic_label == NULL)) {
328 SCJbAppendString(js_traffic_label, &varname[traffic_label_prefix_len]);
330 if (js_flowbits == NULL) {
331 js_flowbits = SCJbNewArray();
335 SCJbAppendString(js_flowbits, varname);
342 SCJbClose(js_flowbits);
343 SCJbSetObject(js_root,
"flowbits", js_flowbits);
344 SCJbFree(js_flowbits);
347 SCJbClose(js_flowints);
348 SCJbSetObject(js_root,
"flowints", js_flowints);
349 SCJbFree(js_flowints);
352 SCJbClose(js_flowvars);
353 SCJbSetObject(js_root,
"flowvars", js_flowvars);
354 SCJbFree(js_flowvars);
357 if (js_traffic_id != NULL || js_traffic_label != NULL) {
358 *js_traffic = SCJbNewObject();
359 if (
likely(*js_traffic != NULL)) {
360 if (js_traffic_id != NULL) {
361 SCJbClose(js_traffic_id);
362 SCJbSetObject(*js_traffic,
"id", js_traffic_id);
363 SCJbFree(js_traffic_id);
365 if (js_traffic_label != NULL) {
366 SCJbClose(js_traffic_label);
367 SCJbSetObject(*js_traffic,
"label", js_traffic_label);
368 SCJbFree(js_traffic_label);
370 SCJbClose(*js_traffic);
378 SCJsonBuilder *js_vars = SCJbNewObject();
381 SCJsonBuilder *js_traffic = NULL;
382 EveAddFlowVars(f, js_vars, &js_traffic);
383 if (js_traffic != NULL) {
384 SCJbSetObject(js,
"traffic", js_traffic);
385 SCJbFree(js_traffic);
389 EveAddPacketVars(p, js_vars);
392 SCJbSetObject(js,
"metadata", js_vars);
402 SCJbSetString(js,
"suricata_version",
PROG_VER);
408 CreateJSONEther(js, p, f, dir);
414 SCJbSetUint(js,
"tenant_id", f->
tenant_id);
427 uint32_t max_len = max_length == 0 ?
GET_PKT_LEN(p) : max_length;
430 if (!SCJbOpenObject(js,
"packet_info")) {
433 if (!SCJbSetUint(js,
"linktype", p->
datalink)) {
442 (void)SCJbSetString(js,
"linktype_name", dl_name == NULL ?
"n/a" : dl_name);
472 char srcip[46] = {0}, dstip[46] = {0};
477 if (PacketIsIPv4(p)) {
479 srcip,
sizeof(srcip));
481 dstip,
sizeof(dstip));
482 }
else if (PacketIsIPv6(p)) {
484 srcip,
sizeof(srcip));
486 dstip,
sizeof(dstip));
497 if (PacketIsIPv4(p)) {
499 srcip,
sizeof(srcip));
501 dstip,
sizeof(dstip));
502 }
else if (PacketIsIPv6(p)) {
504 srcip,
sizeof(srcip));
506 dstip,
sizeof(dstip));
511 if (PacketIsIPv4(p)) {
513 srcip,
sizeof(srcip));
515 dstip,
sizeof(dstip));
516 }
else if (PacketIsIPv6(p)) {
518 srcip,
sizeof(srcip));
520 dstip,
sizeof(dstip));
528 if (PacketIsIPv4(p)) {
530 srcip,
sizeof(srcip));
532 dstip,
sizeof(dstip));
533 }
else if (PacketIsIPv6(p)) {
535 srcip,
sizeof(srcip));
537 dstip,
sizeof(dstip));
542 if (PacketIsIPv4(p)) {
544 srcip,
sizeof(srcip));
546 dstip,
sizeof(dstip));
547 }
else if (PacketIsIPv6(p)) {
549 srcip,
sizeof(srcip));
551 dstip,
sizeof(dstip));
581 snprintf(addr->
proto,
sizeof(addr->
proto),
"%" PRIu32, PacketGetIPProto(p));
585 #define COMMUNITY_ID_BUF_SIZE 64
587 static bool CalculateCommunityFlowIdv4(
const Flow *f,
588 const uint16_t seed,
unsigned char *base64buf)
600 uint32_t
src = f->
src.addr_data32[0];
601 uint32_t
dst = f->
dst.addr_data32[0];
603 if (f->
proto == IPPROTO_ICMP)
607 if (f->
proto == IPPROTO_ICMP)
611 ipv4.seed = htons(seed);
612 if (ntohl(
src) < ntohl(
dst) || (
src ==
dst && sp < dp)) {
623 ipv4.proto = f->
proto;
627 if (SCSha1HashBuffer((
const uint8_t *)&ipv4,
sizeof(ipv4), hash,
sizeof(hash)) == 1) {
630 if (SCBase64Encode(hash,
sizeof(hash), base64buf + 2, &out_len) == SC_BASE64_OK) {
637 static bool CalculateCommunityFlowIdv6(
const Flow *f,
638 const uint16_t seed,
unsigned char *base64buf)
651 if (f->
proto == IPPROTO_ICMPV6)
655 if (f->
proto == IPPROTO_ICMPV6)
659 ipv6.seed = htons(seed);
660 int cmp_r = memcmp(&f->
src, &f->
dst,
sizeof(f->
src));
661 if ((cmp_r < 0) || (cmp_r == 0 && sp < dp)) {
662 memcpy(&ipv6.src, &f->
src.addr_data32, 16);
663 memcpy(&ipv6.dst, &f->
dst.addr_data32, 16);
667 memcpy(&ipv6.src, &f->
dst.addr_data32, 16);
668 memcpy(&ipv6.dst, &f->
src.addr_data32, 16);
672 ipv6.proto = f->
proto;
676 if (SCSha1HashBuffer((
const uint8_t *)&ipv6,
sizeof(ipv6), hash,
sizeof(hash)) == 1) {
679 if (SCBase64Encode(hash,
sizeof(hash), base64buf + 2, &out_len) == SC_BASE64_OK) {
686 static void CreateEveCommunityFlowId(SCJsonBuilder *js,
const Flow *f,
const uint16_t seed)
690 if (CalculateCommunityFlowIdv4(f, seed, buf)) {
691 SCJbSetString(js,
"community_id", (
const char *)buf);
694 if (CalculateCommunityFlowIdv6(f, seed, buf)) {
695 SCJbSetString(js,
"community_id", (
const char *)buf);
705 int64_t flow_id = FlowGetId(f);
706 SCJbSetUint(js,
"flow_id", flow_id);
708 SCJbSetUint(js,
"parent_id", f->
parent_id);
715 (void) snprintf(eth_addr, 19,
"%02x:%02x:%02x:%02x:%02x:%02x",
716 val[0], val[1], val[2], val[3], val[4], val[5]);
718 SCJbAppendString(js, eth_addr);
720 SCJbSetString(js, key, eth_addr);
729 static int MacSetIterateToJSON(uint8_t *val,
MacSetSide side,
void *data)
740 static int CreateJSONEther(
745 if (PacketIsEthernet(p)) {
746 const EthernetHdr *ethh = PacketGetEthernet(p);
747 SCJbOpenObject(js,
"ether");
748 SCJbSetUint(js,
"ether_type", ethh->eth_type);
781 }
else if (f != NULL) {
790 if (
dst != NULL &&
src != NULL) {
791 SCJbOpenObject(js,
"ether");
798 }
else if (f != NULL) {
803 SCJbOpenObject(js,
"ether");
805 info.
dst = SCJbNewArray();
806 info.
src = SCJbNewArray();
819 SCJbSetObject(js,
"dest_macs", info.
src);
820 SCJbSetObject(js,
"src_macs", info.
dst);
823 SCJbSetObject(js,
"dest_macs", info.
dst);
824 SCJbSetObject(js,
"src_macs", info.
src);
840 SCJsonBuilder *js = SCJbNewObject();
847 SCJbSetString(js,
"timestamp", timebuf);
852 if (sensor_id >= 0) {
853 SCJbSetUint(js,
"sensor_id", sensor_id);
858 SCJbSetString(js,
"in_iface", p->
livedev->
dev);
863 SCJbSetUint(js,
"pcap_cnt", p->
pcap_cnt);
867 SCJbSetString(js,
"event_type", event_type);
872 SCJbOpenArray(js,
"vlan");
873 SCJbAppendUint(js, p->
vlan_id[0]);
875 SCJbAppendUint(js, p->
vlan_id[1]);
878 SCJbAppendUint(js, p->
vlan_id[2]);
889 if (addr->
src_ip[0] !=
'\0') {
890 SCJbSetString(js,
"src_ip", addr->
src_ip);
893 SCJbSetUint(js,
"src_port", addr->
sp);
895 if (addr->
dst_ip[0] !=
'\0') {
896 SCJbSetString(js,
"dest_ip", addr->
dst_ip);
899 SCJbSetUint(js,
"dest_port", addr->
dp);
901 if (addr->
proto[0] !=
'\0') {
902 SCJbSetString(js,
"proto", addr->
proto);
908 if (PacketIsICMPv4(p)) {
909 SCJbSetUint(js,
"icmp_type", p->
icmp_s.type);
910 SCJbSetUint(js,
"icmp_code", p->
icmp_s.code);
914 if (PacketIsICMPv6(p)) {
915 SCJbSetUint(js,
"icmp_type", PacketGetICMPv6(p)->
type);
916 SCJbSetUint(js,
"icmp_code", PacketGetICMPv6(p)->code);
923 if (eve_ctx != NULL) {
933 SCJsonBuilder *js =
CreateEveHeader(p, dir, event_type, addr, eve_ctx);
938 SCJbSetUint(js,
"tx_id", tx_id);
960 json_object_set_new(js,
"host",
1009 MemBufferReset(*buffer);
1015 size_t jslen = SCJbLen(js);
1018 if (jslen >= remaining) {
1019 size_t expand_by = jslen + 1 - remaining;
1021 if (!
ctx->too_large_warning) {
1025 size_t partial_len =
MIN(
sizeof(partial), jslen);
1026 memcpy(partial, SCJbPtr(js), partial_len - 1);
1027 partial[partial_len - 1] =
'\0';
1028 SCLogWarning(
"Formatted JSON EVE record too large, will be dropped: %s", partial);
1029 ctx->too_large_warning =
true;
1039 static inline enum LogFileType FileTypeFromConf(
const char *typestr)
1043 if (typestr == NULL) {
1045 }
else if (strcmp(typestr,
"file") == 0 || strcmp(typestr,
"regular") == 0) {
1047 }
else if (strcmp(typestr,
"unix_dgram") == 0) {
1049 }
else if (strcmp(typestr,
"unix_stream") == 0) {
1051 }
else if (strcmp(typestr,
"redis") == 0) {
1052 #ifdef HAVE_LIBHIREDIS
1055 FatalError(
"redis JSON output option is not compiled");
1058 SCLogDebug(
"type %s, file type value %d", typestr, log_filetype);
1059 return log_filetype;
1062 static int LogFileTypePrepare(
1072 #ifdef HAVE_LIBHIREDIS
1077 char hostname[1024];
1078 gethostname(hostname, 1023);
1085 if (SCConfLogOpenRedis(redis_node, json_ctx->
file_ctx) < 0) {
1125 SCLogDebug(
"could not create new OutputJsonCtx");
1132 if (sensor_name != NULL) {
1133 SCLogWarning(
"Found deprecated eve-log setting \"sensor-name\". "
1134 "Please set sensor-name globally.");
1137 (void)
SCConfGet(
"sensor-name", &sensor_name);
1142 SCLogDebug(
"AlertJsonInitCtx: Could not create new LogFileCtx");
1156 if (
unlikely(output_ctx == NULL)) {
1160 output_ctx->
data = json_ctx;
1161 output_ctx->
DeInit = OutputJsonDeInitCtx;
1166 if (output_s == NULL) {
1170 enum LogFileType log_filetype = FileTypeFromConf(output_s);
1173 if (filetype != NULL) {
1177 FatalError(
"Invalid JSON output option: %s", output_s);
1183 SCLogInfo(
"Using prefix '%s' for JSON messages", prefix);
1187 FatalError(
"Failed to allocate memory for eve-log.prefix setting.");
1200 if (LogFileTypePrepare(json_ctx, log_filetype, conf) < 0) {
1205 if (sensor_id_s != NULL) {
1207 FatalError(
"Failed to initialize JSON output, "
1208 "invalid sensor-id: %s",
1225 SCLogConfig(
"Enabling Ethernet MAC address logging.");
1233 SCLogConfig(
"Enabling Suricata version logging.");
1242 SCLogConfig(
"Enabling eve community_id logging.");
1248 if (cid_seed != NULL) {
1250 10, 0, cid_seed) < 0)
1252 FatalError(
"Failed to initialize JSON output, "
1253 "invalid community-id-seed: %s",
1275 SCLogDebug(
"returning output_ctx %p", output_ctx);
1277 result.
ctx = output_ctx;
1296 static void OutputJsonDeInitCtx(
OutputCtx *output_ctx)
1300 if (logfile_ctx->dropped) {
1301 SCLogWarning(
"%" PRIu64
" events were dropped due to slow or "
1302 "disconnected socket",
1303 logfile_ctx->dropped);
1305 if (json_ctx->
xff_cfg != NULL) {
#define PKT_IS_TOCLIENT(p)
struct Packet_::@24::@31 icmp_s
void OutputJsonFlush(OutputJsonThreadCtx *ctx)
int SCConfValIsTrue(const char *val)
Check if a value is true.
struct Flow_::@118::@124 icmp_s
void CreateIsoTimeString(const SCTime_t ts, char *str, size_t size)
OutputJsonCommonSettings cfg
void HttpXFFGetCfg(SCConfNode *conf, HttpXFFCfg *result)
Function to return XFF configuration from a configuration node.
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
int MemBufferExpand(MemBuffer **buffer, uint32_t expand_by)
expand membuffer by size of 'expand_by'
void LogFileFlush(LogFileCtx *file_ctx)
SCJsonBuilder * CreateEveHeader(const Packet *p, enum SCOutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
#define JSON_OUTPUT_BUFFER_SIZE
int StringParseUint16(uint16_t *res, int base, size_t len, const char *str)
int SCConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
void EveTcpFlags(const uint8_t flags, SCJsonBuilder *js)
jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact.
const JsonAddrInfo json_addr_info_zero
#define COMMUNITY_ID_BUF_SIZE
bool include_community_id
int SCConfValIsFalse(const char *val)
Check if a value is false.
const char * known_proto[256]
void OutputJsonBuilderBuffer(ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *js, OutputJsonThreadCtx *ctx)
void CreateEveFlowId(SCJsonBuilder *js, const Flow *f)
const char * SCConfNodeLookupChildValue(const SCConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
struct JSONMACAddrInfo JSONMACAddrInfo
uint8_t sha1[SC_SHA1_LEN]
#define GET_IPV6_DST_ADDR(p)
json_t * SCJsonString(const char *val)
bool include_suricata_version
void PrintStringsToBuffer(uint8_t *dst_buf, uint32_t *dst_buf_offset_ptr, uint32_t dst_buf_size, const uint8_t *src_buf, const uint32_t src_buf_len)
void OutputJsonRegister(void)
size_t strlcpy(char *dst, const char *src, size_t siz)
enum @13 __attribute__
DNP3 application header.
void JsonAddrInfoInit(const Packet *p, enum SCOutputJsonLogDirection dir, JsonAddrInfo *addr)
SCRunMode SCRunmodeGet(void)
Get the current run mode.
int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer)
#define JB_SET_STRING(jb, key, val)
struct GenericVar_ * next
#define GET_IPV4_DST_ADDR_PTR(p)
#define PKT_IS_TOSERVER(p)
struct Flow_::@120::@126 icmp_d
#define DEFAULT_LOG_FILENAME
void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f, SCJsonBuilder *js, enum SCOutputJsonLogDirection dir)
void OutputRegisterModule(const char *, const char *, OutputInitFunc)
OutputInitResult OutputJsonInitCtx(SCConfNode *conf)
Create a new LogFileCtx for "fast" output style.
Per thread variable structure.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
uint64_t FileTrackedSize(const File *file)
get the size of the file
const char * PktSrcToString(enum PktSrcEnum pkt_src)
#define JB_SET_TRUE(jb, key)
#define SCLogWarning(...)
Macro used to log WARNING messages.
void SyslogInitialize(void)
void NullLogInitialize(void)
void EveFileInfo(SCJsonBuilder *jb, const File *ff, const uint64_t tx_id, const uint16_t flags)
void JSONFormatAndAddMACAddr(SCJsonBuilder *js, const char *key, const uint8_t *val, bool is_array)
struct LiveDevice_ * livedev
@ LOGFILE_TYPE_UNIX_DGRAM
FlowStorageId MacSetGetFlowStorageID(void)
bool SCLogOpenThreadedFile(const char *log_path, const char *append, LogFileCtx *parent_ctx)
@ LOGFILE_TYPE_UNIX_STREAM
void EvePacket(const Packet *p, SCJsonBuilder *js, uint32_t max_length)
Jsonify a packet.
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
void EveAddMetadata(const Packet *p, const Flow *f, SCJsonBuilder *js)
int(* Init)(const SCConfNode *conf, const bool threaded, void **init_data)
Function to initialize this filetype.
char proto[JSON_PROTO_LEN]
SCConfNode * SCConfNodeLookupChild(const SCConfNode *node, const char *name)
Lookup a child configuration node by name.
int StringParseUint64(uint64_t *res, int base, size_t len, const char *str)
#define GET_IPV4_SRC_ADDR_PTR(p)
#define PrintBufferData(buf, buf_offset_ptr, buf_size,...)
void(* DeInit)(struct OutputCtx_ *)
const char * VarNameStoreLookupById(const uint32_t id, const enum VarTypes type)
find name for id+type at packet time.
int MacSetSize(const MacSet *ms)
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
SCJsonBuilder * CreateEveHeaderWithTxId(const Packet *p, enum SCOutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, uint64_t tx_id, OutputJsonCtx *eve_ctx)
uint8_t sha256[SC_SHA256_LEN]
#define JB_SET_FALSE(jb, key)
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
char src_ip[JSON_ADDR_LEN]
int SCConfLogOpenGeneric(SCConfNode *conf, LogFileCtx *log_ctx, const char *default_filename, int rotate)
open a generic output "log file", which may be a regular file or a socket
#define GET_IPV6_SRC_ADDR(p)
uint8_t * MacSetGetFirst(const MacSet *ms, MacSetSide side)
#define MEMBUFFER_SIZE(mem_buffer)
Get the MemBuffers current size.
int MacSetForEach(const MacSet *ms, MacSetIteratorFunc IterFunc, void *data)
char dst_ip[JSON_ADDR_LEN]
const char * PcapFileGetFilename(void)
int OutputJSONMemBufferCallback(const char *str, size_t size, void *data)
int OutputJSONBuffer(json_t *js, LogFileCtx *file_ctx, MemBuffer **buffer)
uint32_t MemBufferWriteRaw(MemBuffer *dst, const uint8_t *raw, const uint32_t raw_len)
Write a raw buffer to the MemBuffer dst.
SCEveFileType * SCEveFindFileType(const char *name)
uint16_t vlan_id[VLAN_MAX_LAYERS]
int(* ThreadInit)(const void *init_data, const ThreadId thread_id, void **thread_data)
Initialize thread specific data.
uint16_t community_id_seed
#define MEMBUFFER_OFFSET(mem_buffer)
Get the MemBuffers current offset.
const char * DatalinkValueToName(int datalink_value)
#define DEBUG_VALIDATE_BUG_ON(exp)
void SCEveRunCallbacks(ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *jb)
union FlowVar_::@113 data
Structure used to define an EVE output file type plugin.