From f3317f78d5c95e58ecb3e07b8c7e9b92646448a5 Mon Sep 17 00:00:00 2001 From: Manuel Sabban Date: Wed, 7 Sep 2022 14:16:47 +0200 Subject: [PATCH] acually postoverflow _before_ reprocessing (#1739) Co-authored-by: sabban <15465465+sabban@users.noreply.github.com> --- cmd/crowdsec/output.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/cmd/crowdsec/output.go b/cmd/crowdsec/output.go index 88e85e04b..52bc04e3a 100644 --- a/cmd/crowdsec/output.go +++ b/cmd/crowdsec/output.go @@ -144,10 +144,6 @@ LOOP: buckets.Bucket_map.Delete(event.Overflow.Mapkey) break } - if event.Overflow.Reprocess { - log.Debugf("Overflow being reprocessed.") - input <- event - } /* process post overflow parser nodes */ event, err := parser.Parse(postOverflowCTX, event, postOverflowNodes) if err != nil { @@ -158,6 +154,10 @@ LOOP: log.Printf("[%s] is whitelisted, skip.", *event.Overflow.Alert.Message) continue } + if event.Overflow.Reprocess { + log.Debugf("Overflow being reprocessed.") + input <- event + } if dumpStates { continue }