Method processWhitelist

pkg/parser/node.go:136–166

(cachedExprEnv map[string]any, p *pipeline.Event)

}

func (n *Node) processWhitelist(cachedExprEnv map[string]any, p *pipeline.Event) (bool, error) {
	var exprErr error

	isWhitelisted := n.CheckIPsWL(p)
	if !isWhitelisted {
		isWhitelisted, exprErr = n.CheckExprWL(cachedExprEnv, p)
	}

	if exprErr != nil {
		// Previous code returned nil if there was an error, so we keep this behavior
		return false, nil //nolint:nilerr
	}

	if isWhitelisted && !p.Whitelisted {
		p.Whitelisted = true
		p.WhitelistReason = n.Whitelist.Reason
		// huglily wipe the ban order if the event is whitelisted and it's an overflow
		if p.Type == pipeline.OVFLW { // don't do this at home kids
			ips := []string{}
			for k := range p.Overflow.Sources {
				ips = append(ips, k)
			}

			n.Logger.Infof("Ban for %s whitelisted, reason [%s]", strings.Join(ips, ","), n.Whitelist.Reason)

			p.Overflow.Whitelisted = true
		}
	}

	return isWhitelisted, nil
}

func (n *Node) processGrok(p *pipeline.Event, cachedExprEnv map[string]any) (bool, bool, error) {
	// Process grok if present, should be exclusive with nodes :)