-#ifdef GEOIP
- field_add_string(syslog_msg, OS_SIZE_2048 - padding, " \"src_city\": \"%s\",", al_data->geoipdatasrc );
- field_add_string(syslog_msg, OS_SIZE_2048 - padding, " \"dst_city\": \"%s\",", al_data->geoipdatadst );
+ /* Add data if it exists */
+ if (al_data->user) {
+ cJSON_AddStringToObject(root, "acct", al_data->user);
+ }
+ if (al_data->srcip) {
+ cJSON_AddStringToObject(root, "src_ip", al_data->srcip);
+ }
+ if (al_data->srcport) {
+ cJSON_AddNumberToObject(root, "src_port", al_data->srcport);
+ }
+ if (al_data->dstip) {
+ cJSON_AddStringToObject(root, "dst_ip", al_data->dstip);
+ }
+ if (al_data->dstport) {
+ cJSON_AddNumberToObject(root, "dst_port", al_data->dstport);
+ }
+ if (al_data->filename) {
+ cJSON_AddStringToObject(root, "file", al_data->filename);
+ }
+ if (al_data->old_md5) {
+ cJSON_AddStringToObject(root, "md5_old", al_data->old_md5);
+ }
+ if (al_data->new_md5) {
+ cJSON_AddStringToObject(root, "md5_new", al_data->new_md5);
+ }
+ if (al_data->old_sha1) {
+ cJSON_AddStringToObject(root, "sha1_old", al_data->old_sha1);
+ }
+ if (al_data->new_sha1) {
+ cJSON_AddStringToObject(root, "sha1_new", al_data->new_sha1);
+ }
+#ifdef LIBGEOIP_ENABLED
+ if (al_data->srcgeoip) {
+ cJSON_AddStringToObject(root, "src_city", al_data->srcgeoip);
+ }
+ if (al_data->dstgeoip) {
+ cJSON_AddStringToObject(root, "dst_city", al_data->dstgeoip);
+ }