OISF · regit · Feb 3, 2026 · Feb 3, 2026 · Feb 6, 2026
diff --git a/tests/eve-suricata-version/suricata.yaml b/tests/eve-suricata-version/suricata.yaml
@@ -3,6 +3,7 @@
 
 outputs:
   - eve-log:
+      version: 2
       enabled: yes
       suricata-version: yes
       types:

diff --git a/tests/eve-suricata-version/test.yaml b/tests/eve-suricata-version/test.yaml
@@ -64,4 +64,8 @@ checks:
         event_type: fileinfo
         dest_ip: 192.168.118.10
         has-key: suricata_version
-
+  - filter:
+      min-version: 9
+      count: 53
+      match:
+        has-key: v
diff --git a/tests/force-eve-logging-v1/README.md b/tests/force-eve-logging-v1/README.md
@@ -0,0 +1 @@
+Test that forcing EVE version to 1 trigger app_proto not to be logged.
diff --git a/tests/force-eve-logging-v1/input.pcap b/tests/force-eve-logging-v1/input.pcap
@@ -0,0 +1 @@
+../smtp-startssl/input.pcap
diff --git a/tests/force-eve-logging-v1/suricata.yaml b/tests/force-eve-logging-v1/suricata.yaml
@@ -0,0 +1,23 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      version: 1
+      types:
+        - alert:
+            payload: yes
+            payload-buffer-size: 4kb
+            payload-printable: yes
+            packet: yes
+            xff:
+              enabled: yes
+              mode: extra-data
+              deployment: reverse
+              header: X-Forwarded-For
+        - flow
+        - smtp
+        - tls
diff --git a/tests/force-eve-logging-v1/test.yaml b/tests/force-eve-logging-v1/test.yaml
@@ -0,0 +1,26 @@
+args:
+- -k none
+
+requires:
+  min-version: 9
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: smtp
+  - filter:
+      count: 0
+      match:
+        smtp.helo: "desktop.unx.ca"
+        not-has-key: "email"
+        app_proto: smtp
+  - filter:
+      count: 1
+      match:
+        event_type: tls
+  - filter:
+      count: 0
+      match:
+        event_type: tls
+        app_proto_orig: smtp
diff --git a/tests/smtp-startssl/test.yaml b/tests/smtp-startssl/test.yaml
@@ -11,3 +11,9 @@ checks:
       match:
         smtp.helo: "desktop.unx.ca"
         not-has-key: "email"
+  - filter:
+      min-version: 9
+      count: 1
+      match:
+        event_type: tls
+        app_proto_orig: smtp
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Test that forcing EVE version to 1 trigger app_proto not to be logged.