diff --git a/pkg/hubtest/parser_assert.go b/pkg/hubtest/parser_assert.go index 82efed9e3..f3546b0b9 100644 --- a/pkg/hubtest/parser_assert.go +++ b/pkg/hubtest/parser_assert.go @@ -396,25 +396,21 @@ func DumpTree(parser_results ParserResults, bucket_pour BucketPourInfo, opts Dum detailsDisplay := "" if res { - if prev_item.Stage == "" { - changeStr = "first_parser" - } else { - changelog, _ := diff.Diff(prev_item, parsers[parser].Evt) - for _, change := range changelog { - switch change.Type { - case "create": - created++ - detailsDisplay += fmt.Sprintf("\t%s\t\t%s %s evt.%s : %s\n", presep, sep, change.Type, strings.Join(change.Path, "."), green(change.To)) - case "update": - detailsDisplay += fmt.Sprintf("\t%s\t\t%s %s evt.%s : %s -> %s\n", presep, sep, change.Type, strings.Join(change.Path, "."), change.From, yellow(change.To)) - if change.Path[0] == "Whitelisted" && change.To == true { - whitelisted = true - } - updated++ - case "delete": - deleted++ - detailsDisplay += fmt.Sprintf("\t%s\t\t%s %s evt.%s\n", presep, sep, change.Type, red(strings.Join(change.Path, "."))) + changelog, _ := diff.Diff(prev_item, parsers[parser].Evt) + for _, change := range changelog { + switch change.Type { + case "create": + created++ + detailsDisplay += fmt.Sprintf("\t%s\t\t%s %s evt.%s : %s\n", presep, sep, change.Type, strings.Join(change.Path, "."), green(change.To)) + case "update": + detailsDisplay += fmt.Sprintf("\t%s\t\t%s %s evt.%s : %s -> %s\n", presep, sep, change.Type, strings.Join(change.Path, "."), change.From, yellow(change.To)) + if change.Path[0] == "Whitelisted" && change.To == true { + whitelisted = true } + updated++ + case "delete": + deleted++ + detailsDisplay += fmt.Sprintf("\t%s\t\t%s %s evt.%s\n", presep, sep, change.Type, red(strings.Join(change.Path, "."))) } } prev_item = parsers[parser].Evt diff --git a/tests/bats/testdata/explain/explain-log.txt b/tests/bats/testdata/explain/explain-log.txt index 828899348..c4f244192 100644 --- a/tests/bats/testdata/explain/explain-log.txt +++ b/tests/bats/testdata/explain/explain-log.txt @@ -1,6 +1,6 @@ line: Sep 19 18:33:22 scw-d95986 sshd[24347]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4 ├ s00-raw - | └ 🟢 crowdsecurity/syslog-logs (first_parser) + | └ 🟢 crowdsecurity/syslog-logs (+12 ~9) ├ s01-parse | └ 🟢 crowdsecurity/sshd-logs (+8 ~1) ├ s02-enrich