From 486f96e7accaf2a8bdf40f30e2a5fc00135f7589 Mon Sep 17 00:00:00 2001 From: mmetc <92726601+mmetc@users.noreply.github.com> Date: Tue, 5 Dec 2023 12:08:35 +0100 Subject: [PATCH] cscli context detect: fix nil dereference (#2635) * cscli context detect: fix nil dereference * Remove log.warning for missing pattern --- cmd/crowdsec-cli/lapi.go | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/cmd/crowdsec-cli/lapi.go b/cmd/crowdsec-cli/lapi.go index 755c2cb6d..9b6900a8f 100644 --- a/cmd/crowdsec-cli/lapi.go +++ b/cmd/crowdsec-cli/lapi.go @@ -332,7 +332,7 @@ cscli lapi context detect crowdsecurity/sshd-logs } // to avoid all the log.Info from the loaders functions - log.SetLevel(log.ErrorLevel) + log.SetLevel(log.WarnLevel) err = exprhelpers.Init(nil) if err != nil { @@ -499,13 +499,13 @@ func detectNode(node parser.Node, parserCTX parser.UnixParserCtx) []string { if node.Grok.RegexpName != "" { grokCompiled, err := parserCTX.Grok.Get(node.Grok.RegexpName) - if err != nil { - log.Warningf("Can't get subgrok: %s", err) - } - for _, capturedField := range grokCompiled.Names() { - fieldName := fmt.Sprintf("evt.Parsed.%s", capturedField) - if !slices.Contains(ret, fieldName) { - ret = append(ret, fieldName) + // ignore error (parser does not exist?) + if err == nil { + for _, capturedField := range grokCompiled.Names() { + fieldName := fmt.Sprintf("evt.Parsed.%s", capturedField) + if !slices.Contains(ret, fieldName) { + ret = append(ret, fieldName) + } } } } @@ -545,13 +545,13 @@ func detectSubNode(node parser.Node, parserCTX parser.UnixParserCtx) []string { } if subnode.Grok.RegexpName != "" { grokCompiled, err := parserCTX.Grok.Get(subnode.Grok.RegexpName) - if err != nil { - log.Warningf("Can't get subgrok: %s", err) - } - for _, capturedField := range grokCompiled.Names() { - fieldName := fmt.Sprintf("evt.Parsed.%s", capturedField) - if !slices.Contains(ret, fieldName) { - ret = append(ret, fieldName) + if err == nil { + // ignore error (parser does not exist?) + for _, capturedField := range grokCompiled.Names() { + fieldName := fmt.Sprintf("evt.Parsed.%s", capturedField) + if !slices.Contains(ret, fieldName) { + ret = append(ret, fieldName) + } } } }