How to get community id from lua script in suricata

Question

I am using suricata with community id to correlate zeek and suricata logs. I need to get the value of community id for each tuple in lua script.
Is there any method to get community id for suricata using lua?

Answer 1

There is a limited set of Lua functions available in Suricata (cf https://suricata.readthedocs.io/en/latest/lua/lua-functions.html#lua-functions).

If you really have to use a Lua script for this, I suppose you could add something locally to your Suri, although that can be a bit convoluted to do, as the community id is only calculated during EVE logs generation.

Extra: if Lua isn't mandatory, jq could be of great help for extracting the info you need from the EVE logs, and then you'd have easy access to the community_id and much more.