Support for multiple-logger for drop eve-log
Hello according to the documetation, https://github.com/OISF/suricata/blob/d6903e70c1b653984ca95f8808755efbc6a9ece4/doc/userguide/output/eve/eve-json-output.rst#multiple-logger-instances, one cannot have multiple-logger instances for the drop eve-log.
Is this something that could be implemented?
Updated by Victor Julien 5 months ago
- Assignee set to Community Ticket
- Target version set to TBD
The issue is that the tracking of the flow logging 'flows: all|start' is done using a flag in the flow. Since the first logger would set the flag, the 2nd would not log as the flag is already set. Working around this is not impossible but would require some thought.