From f0ba8958266ea13502145a6e2d2a5d44d087022d Mon Sep 17 00:00:00 2001
From: Laurence <laurence.jones@live.co.uk>
Date: Sat, 30 Sep 2023 15:30:23 +0100
Subject: [PATCH] Reinject postoverflow meta within the events of alerts

---
 cmd/crowdsec/output.go | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/cmd/crowdsec/output.go b/cmd/crowdsec/output.go
index 348504034..ba33ab977 100644
--- a/cmd/crowdsec/output.go
+++ b/cmd/crowdsec/output.go
@@ -167,6 +167,18 @@ LOOP:
 				log.Printf("[%s] is whitelisted, skip.", *event.Overflow.Alert.Message)
 				continue
 			}
+			/* Inject postoverflow meta into the overflown state*/
+			for key, value := range event.Meta {
+				kv := &models.MetaItems0{
+					Key:   key,
+					Value: value,
+				}
+				for _, alert := range event.Overflow.APIAlerts {
+					for _, event := range alert.Events {
+						event.Meta = append(event.Meta, kv)
+					}
+				}
+			}
 			if event.Overflow.Reprocess {
 				log.Debugf("Overflow being reprocessed.")
 				input <- event