From ca5eb5382ab9d67ce340e64b1692ef681c3167da Mon Sep 17 00:00:00 2001
From: Seth Hall <seth@icir.org>
Date: Fri, 15 Jun 2012 21:06:06 -0400
Subject: [PATCH] Flush logs to ES daemon as Bro is shutting down.

---
 src/logging/writers/ElasticSearch.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/logging/writers/ElasticSearch.cc b/src/logging/writers/ElasticSearch.cc
index ed1c046143..5e1efa504e 100644
--- a/src/logging/writers/ElasticSearch.cc
+++ b/src/logging/writers/ElasticSearch.cc
@@ -51,12 +51,12 @@ bool ElasticSearch::DoInit(string path, int num_fields, const Field* const * fie
 
 bool ElasticSearch::DoFlush()
 	{
-	//TODO: Send flush command to ElasticSearch
 	return true;
 	}
 
 bool ElasticSearch::DoFinish()
 	{
+	BatchIndex();
 	return WriterBackend::DoFinish();
 	}
 	
@@ -120,7 +120,7 @@ bool ElasticSearch::AddFieldValueToBuffer(Value* val, const Field* field)
 				{
 				char c = val->val.string_val->data()[i];
 				// HTML entity encode special characters.
-				if ( c < 32 || c > 126 || c == '\n' || c == '"' || c == '\'' || c == '\\' )
+				if ( c < 32 || c > 126 || c == '\n' || c == '"' || c == '\'' || c == '\\' || c == '&' )
 					{
 					buffer.AddRaw("&#", 2);
 					buffer.Add((uint8_t) c);