diff --git a/pkg/parser/node.go b/pkg/parser/node.go index 065575416..159a11813 100644 --- a/pkg/parser/node.go +++ b/pkg/parser/node.go @@ -226,7 +226,6 @@ func (n *Node) process(p *types.Event, ctx UnixParserCtx, expressionEnv map[stri } if out { clog.Debugf("Event is whitelisted by expr, reason [%s]", n.Whitelist.Reason) - p.Whitelisted = true isWhitelisted = true } hasWhitelist = true