Changed format of the 'output' field in the JSON payload

Signed-off-by: h4l0gen <[email protected]>

userspace/engine/formats.cpp

@@ -44,7 +44,6 @@ std::string falco_formats::format_event(gen_event *evt, const std::string &rule,
 	formatter = m_falco_engine->create_formatter(source, format);
 
 	// Format the original output string, regardless of output format
-	formatter->tostring_withformat(evt, line, gen_event_formatter::OF_NORMAL);
 
 	if(formatter->get_output_format() == gen_event_formatter::OF_JSON)
 	{
@@ -89,6 +88,7 @@ std::string falco_formats::format_event(gen_event *evt, const std::string &rule,
 		if(m_json_include_output_property)
 		{
 			// This is the filled-in output line.
+			formatter->tostring_withformat(evt, line, gen_event_formatter::OF_JSON);
 			event["output"] = line;
 		}
 
@@ -127,6 +127,10 @@ std::string falco_formats::format_event(gen_event *evt, const std::string &rule,
 		full_line.append("}");
 		line = full_line;
 	}
+    else
+	{
+		formatter->tostring_withformat(evt, line, gen_event_formatter::OF_NORMAL);
+	}
 
 	return line.c_str();
 }