Check longer time field first

falcosecurity · Apr 5, 2019 · 92d6be8 · 92d6be8
1 parent b02273b
commit 92d6be8
Showing 1 changed file with 6 additions and 6 deletions.
diff --git a/userspace/engine/json_evt.cpp b/userspace/engine/json_evt.cpp
@@ -303,18 +303,18 @@ jevt_filter_check::~jevt_filter_check()
 
 int32_t jevt_filter_check::parse_field_name(const char *str, bool alloc_state, bool needed_for_filtering)
 {
-	if(strncmp(s_jevt_time_field.c_str(), str, s_jevt_time_field.size()) == 0)
-	{
-		m_field = s_jevt_time_field;
-		return s_jevt_time_field.size();
-	}
-
 	if(strncmp(s_jevt_time_iso_8601_field.c_str(), str, s_jevt_time_iso_8601_field.size()) == 0)
 	{
 		m_field = s_jevt_time_iso_8601_field;
 		return s_jevt_time_iso_8601_field.size();
 	}
 
+	if(strncmp(s_jevt_time_field.c_str(), str, s_jevt_time_field.size()) == 0)
+	{
+		m_field = s_jevt_time_field;
+		return s_jevt_time_field.size();
+	}
+
 	if(strncmp(s_jevt_rawtime_field.c_str(), str, s_jevt_rawtime_field.size()) == 0)
 	{
 		m_field = s_jevt_rawtime_field;