All event_type:smb events have double tree_id in the eve logs. Version 6.0.9

On all SMB eve events have double tree_id in the events. “tree_id”:0,“tree_id”:0,
This is a problem when I use elastic to store all eve events.

can you provide a test case?

This is a exemple of the eve event:

What version are you using?
Can you post your suricata.yaml and also how you start suricata?

Besides that I can confirm that this happens even on some of the suricata-verify tests. We created a bug tracking ticket for that at our redmine, see Bug #5811: SMB events sometimes have duplicate `tree_id` output. - Suricata - Open Information Security Foundation

The sample data is from a default confige. Only changed the interface.
But I see you have the bug created.