Documentation #7298
openDocumentation #6478: schema: add missing fields
schema/netflow: add missing field
Description
Running
git grep 'js, "' src/output-json-netflow.c | cut -d'"' -f2 | sort | uniq | while read i; do echo -n $i " "; git grep $i etc/schema.json | wc -l; done
Will show that sesnsor_id comes with a 0, meaning we are missing this field in our json schema.
https://github.com/OISF/suricata/pull/11844 showcases how a similar issue (#7287) was fixed.
PA Updated by Philippe Antoine almost 2 years ago
I see three fields missing besides DNP3 :
git grep 'js, "' src/output-json-*.c | grep -v dnp3 | cut -d'"' -f2 | sort | uniq | while read i; do echo -n $i; git grep $i etc/schema.json | wc -l; done | awk '$2 == 0' payload_hex 0 sensor_id 0 tenant_id 0
PA Updated by Philippe Antoine about 1 month ago
- Status changed from New to Triaged
OM Updated by Omar Merroun 15 days ago ยท Edited
The grep-based schema check produces a false positive on sensor_id because the emitting code is behind #if 0 // TODO and has been since 2014 (present in both output-json-flow.c and output-json-netflow.c).
running:
git grep 'js, "' src/output-json-*.c | cut -d'"' -f2 | sort | uniq | while read i; do echo -n $i " "; git grep $i etc/schema.json | wc -l; done
exposes tens of fields with 0. So I'd suggest opening another ticket to fully investigate them.
JF Updated by Juliana Fajardini Reichow 14 days ago
Omar Merroun wrote in #note-3:
s a false positive on sensor_id because the emitting code is behind #if 0 /
Wouldn't this suffice, for tracking them? https://redmine.openinfosecfoundation.org/issues/6478
OM Updated by Omar Merroun 14 days ago
Yeah you're right, it works as a tracker, it would be great if sub-tickets are created to divide output files. Or maybe it could be done in one go