From e211e97e2a3f026dc09060429a3dd7a436063bd9 Mon Sep 17 00:00:00 2001 From: Jason Dellaluce Date: Thu, 22 Feb 2024 14:38:54 +0000 Subject: [PATCH] fix(userspace/engine): make sure exception fields are not optional in replace mode Signed-off-by: Jason Dellaluce --- userspace/engine/rule_loader_reader.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/userspace/engine/rule_loader_reader.cpp b/userspace/engine/rule_loader_reader.cpp index 517f2144..4d875cb4 100644 --- a/userspace/engine/rule_loader_reader.cpp +++ b/userspace/engine/rule_loader_reader.cpp @@ -650,7 +650,7 @@ void rule_loader::reader::read_item( if (check_update_expected(expected_keys, override_replace, "replace", "exceptions", ctx)) { - read_rule_exceptions(cfg, item, v.exceptions, ctx, true); + read_rule_exceptions(cfg, item, v.exceptions, ctx, false); } if (check_update_expected(expected_keys, override_replace, "replace", "output", ctx)) @@ -771,7 +771,7 @@ void rule_loader::reader::read_item( decode_optional_val(item, "warn_evttypes", v.warn_evttypes, ctx); decode_optional_val(item, "skip-if-unknown-filter", v.skip_if_unknown_filter, ctx); decode_tags(item, v.tags, ctx); - read_rule_exceptions(cfg, item, v.exceptions, ctx, has_append_flag); + read_rule_exceptions(cfg, item, v.exceptions, ctx, false); collector.define(cfg, v); } }