From 86d938495452bb156f0ae7db89b9e93b80002aaf Mon Sep 17 00:00:00 2001 From: Laurence Jones Date: Wed, 23 Aug 2023 14:51:37 +0100 Subject: [PATCH] Whitelist reason (#2439) * Update node.go Dont update whitelist reason if event is whitelisted * oops --- pkg/parser/node.go | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/pkg/parser/node.go b/pkg/parser/node.go index f3341cb2b..065575416 100644 --- a/pkg/parser/node.go +++ b/pkg/parser/node.go @@ -211,9 +211,6 @@ func (n *Node) process(p *types.Event, ctx UnixParserCtx, expressionEnv map[stri } } - if isWhitelisted { - p.Whitelisted = true - } /* run whitelist expression tests anyway */ for eidx, e := range n.Whitelist.B_Exprs { output, err := expr.Run(e.Filter, cachedExprEnv) @@ -237,7 +234,8 @@ func (n *Node) process(p *types.Event, ctx UnixParserCtx, expressionEnv map[stri log.Errorf("unexpected type %t (%v) while running '%s'", output, output, n.Whitelist.Exprs[eidx]) } } - if isWhitelisted { + if isWhitelisted && !p.Whitelisted { + p.Whitelisted = true p.WhitelistReason = n.Whitelist.Reason /*huglily wipe the ban order if the event is whitelisted and it's an overflow */ if p.Type == types.OVFLW { /*don't do this at home kids */