diff --git a/userspace/engine/formats.cpp b/userspace/engine/formats.cpp index ca33753debc..199c31c78d7 100644 --- a/userspace/engine/formats.cpp +++ b/userspace/engine/formats.cpp @@ -146,11 +146,13 @@ int falco_formats::format_event (lua_State *ls) if(strcmp(source, "syscall") == 0) { try { + // This is "output" s_formatters->tostring((sinsp_evt *) evt, sformat, &line); if(s_json_output) { - switch(s_inspector->get_buffer_format()) + sinsp_evt::param_fmt cur_fmt = s_inspector->get_buffer_format(); + switch(cur_fmt) { case sinsp_evt::PF_NORMAL: s_inspector->set_buffer_format(sinsp_evt::PF_JSON); @@ -171,6 +173,7 @@ int falco_formats::format_event (lua_State *ls) // do nothing break; } + // This is output fields s_formatters->tostring((sinsp_evt *) evt, sformat, &json_line); // The formatted string might have a leading newline. If it does, remove it. @@ -178,8 +181,7 @@ int falco_formats::format_event (lua_State *ls) { json_line.erase(0, 1); } - - s_inspector->set_buffer_format(sinsp_evt::PF_NORMAL); + s_inspector->set_buffer_format(cur_fmt); } } catch (sinsp_exception& e)