fix(engine): apply output substitutions for all sources

Signed-off-by: Gianmatteo Palmieri <[email protected]>
federico-sysdig · Mar 25, 2024 · d1707be · d1707be
1 parent 1882def
commit d1707be
Showing 1 changed file with 1 addition and 4 deletions.
diff --git a/userspace/engine/rule_loader_compiler.cpp b/userspace/engine/rule_loader_compiler.cpp
@@ -501,10 +501,7 @@ void rule_loader::compiler::compile_rule_infos(
 
 		// build rule output message
 		rule.output = r.output;
-		if (r.source == falco_common::syscall_source)
-		{
-			apply_output_substitutions(cfg, rule.output);
-		}
+		apply_output_substitutions(cfg, rule.output);
 
 		// validate the rule's output
 		if(!is_format_valid(*cfg.sources.at(r.source), rule.output, err))