Revert "fix(engine): apply output substitutions for all sources"

This reverts commit 4ef7c95. Signed-off-by: Gianmatteo Palmieri <[email protected]>
falcosecurity · Jun 5, 2024 · 1c66b64 · 1c66b64
1 parent 3539572
commit 1c66b64
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/userspace/engine/rule_loader_compiler.cpp b/userspace/engine/rule_loader_compiler.cpp
@@ -509,7 +509,10 @@ void rule_loader::compiler::compile_rule_infos(
 
 		// build rule output message
 		rule.output = r.output;
-		apply_output_substitutions(cfg, rule.output);
+		if (r.source == falco_common::syscall_source)
+		{
+			apply_output_substitutions(cfg, rule.output);
+		}
 
 		// validate the rule's output
 		if(!is_format_valid(*cfg.sources.at(r.source), rule.output, err))