fix(engine): apply output substitutions for all sources

Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
falcosecurity · Mar 8, 2024 · 4ef7c95 · 4ef7c95
1 parent 517b79e
commit 4ef7c95
Showing 1 changed file with 1 addition and 4 deletions.
diff --git a/userspace/engine/rule_loader_compiler.cpp b/userspace/engine/rule_loader_compiler.cpp
@@ -501,10 +501,7 @@ void rule_loader::compiler::compile_rule_infos(
 
 		// build rule output message
 		rule.output = r.output;
-		if (r.source == falco_common::syscall_source)
-		{
-			apply_output_substitutions(cfg, rule.output);
-		}
+		apply_output_substitutions(cfg, rule.output);
 
 		// validate the rule's output
 		if(!is_format_valid(*cfg.sources.at(r.source), rule.output, err))