Pathogen
/
neptune
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix sending aggs and matched fields

This commit is contained in:
Mark Veidemanis 2023-02-09 23:18:16 +00:00
parent 4042d60c57
commit 56b268bd77
Signed by: m
GPG Key ID: 5ACFCEED46C0904F
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
core/lib/rules.py
View File

@ -310,7 +310,6 @@ class NotificationRuleData(object):
"""
new_aggs = {}
for agg_name, agg in aggs.items():
# Already checked membership below
if agg_name in self.aggs:
op, value = self.aggs[agg_name]
new_aggs[agg_name] = f"{agg['value']}{op}{value}"
@ -382,7 +381,9 @@ class NotificationRuleData(object):
# We hit the return above if we don't need to notify
meta["matched"] = self.format_matched(message)
if "aggs" in meta:
meta["matched"] = self.format_aggs(meta["aggs"])
aggs_formatted = self.format_aggs(meta["aggs"])
if aggs_formatted:
meta["matched_aggs"] = aggs_formatted
rule_notify(self.object, index, message, meta)
self.store_match(index, message)
@ -414,8 +415,9 @@ class NotificationRuleData(object):
pass
# We hit the return above if we don't need to notify
if "aggs" in meta and "matched" not in meta:
meta["matched"] = self.format_aggs(meta["aggs"])
meta["matched"] = self.format_matched(message)
if "aggs" in meta:
meta["format_aggs"] = self.format_aggs(meta["aggs"])
rule_notify(self.object, index, message, meta)
self.store_match(index, message)
self.ingest_matches_sync(index, message, meta, mode)