diff --git a/core/lib/rules.py b/core/lib/rules.py index a6ed4d3..a4ea864 100644 --- a/core/lib/rules.py +++ b/core/lib/rules.py @@ -379,7 +379,8 @@ class NotificationRuleData(object): pass # We hit the return above if we don't need to notify - meta["matched"] = self.format_matched(message) + if "matched" not in meta: + meta["matched"] = self.format_matched(message) if "aggs" in meta: aggs_formatted = self.format_aggs(meta["aggs"]) if aggs_formatted: @@ -415,9 +416,13 @@ class NotificationRuleData(object): pass # We hit the return above if we don't need to notify - meta["matched"] = self.format_matched(message) + if "matched" not in meta: + meta["matched"] = self.format_matched(message) if "aggs" in meta: - meta["format_aggs"] = self.format_aggs(meta["aggs"]) + aggs_formatted = self.format_aggs(meta["aggs"]) + if aggs_formatted: + meta["matched_aggs"] = aggs_formatted + rule_notify(self.object, index, message, meta) self.store_match(index, message) self.ingest_matches_sync(index, message, meta, mode)