Open
Description
We should remove the filter that was added some time go in the geoip-enrich
parser:
- The filter was added because crowdsec was logging an error if we did not manage to enrich the IP (eg, in the case the DB had no entry for the IP)
- Due to a quirk in how parser stages are handled, if an event does not enter any parser in a given stage, it will be dropped and not reach the scenarios pipeline (which can be surprising in some situations, especially when writing scenarios that work with appsec rules).
The log spam was fixed in crowdsec, so we can remove the filter.
Metadata
Metadata
Assignees
Labels
No labels
Activity