From fc63582aa58c0fde30c73ddc1cbe9b92224a69d6 Mon Sep 17 00:00:00 2001 From: Jason Dellaluce Date: Thu, 22 Feb 2024 14:38:54 +0000 Subject: [PATCH] fix(userspace/engine): make sure exception fields are not optional in replace mode Signed-off-by: Jason Dellaluce --- userspace/engine/rule_loader_reader.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/userspace/engine/rule_loader_reader.cpp b/userspace/engine/rule_loader_reader.cpp index fc4c6fdae5e..2f5441e9013 100644 --- a/userspace/engine/rule_loader_reader.cpp +++ b/userspace/engine/rule_loader_reader.cpp @@ -607,7 +607,7 @@ void rule_loader::reader::read_item( if (check_update_expected(expected_keys, override_replace, "replace", "exceptions", ctx)) { - read_rule_exceptions(item, v.exceptions, ctx, true); + read_rule_exceptions(item, v.exceptions, ctx, false); } if (check_update_expected(expected_keys, override_replace, "replace", "output", ctx)) @@ -728,7 +728,7 @@ void rule_loader::reader::read_item( decode_optional_val(item, "warn_evttypes", v.warn_evttypes, ctx); decode_optional_val(item, "skip-if-unknown-filter", v.skip_if_unknown_filter, ctx); decode_tags(item, v.tags, ctx); - read_rule_exceptions(item, v.exceptions, ctx, has_append_flag); + read_rule_exceptions(item, v.exceptions, ctx, false); collector.define(cfg, v); } }