diff --git a/pkg/fieldfilters/fields.go b/pkg/fieldfilters/fields.go index 84a9e45e358..c159ea6c30c 100644 --- a/pkg/fieldfilters/fields.go +++ b/pkg/fieldfilters/fields.go @@ -209,15 +209,23 @@ func (f *FieldFilter) Filter(event *tetragon.GetEventsResponse) (*tetragon.GetEv dst := src.New() var filterErrs []error src.Range(func(fd protoreflect.FieldDescriptor, v protoreflect.Value) bool { - if fd.ContainingOneof() == nil || !src.Has(fd) { + if !src.Has(fd) { return true } - event := src.Get(fd).Message().Interface() - dstEvent := dst.Mutable(fd).Message().Interface() - err := fieldmask_utils.StructToStruct(f.fields, event, dstEvent) - if err != nil { - filterErrs = append(filterErrs, err) + + if fd.ContainingOneof() != nil && fd.ContainingOneof().Name() == "event" { + event := src.Get(fd).Message().Interface() + dstEvent := dst.Mutable(fd).Message().Interface() + err := fieldmask_utils.StructToStruct(f.fields, event, dstEvent) + if err != nil { + filterErrs = append(filterErrs, err) + } + return true } + + // Preserve all information that is not in the Event field + dst.Set(fd, v) + return true }) diff --git a/pkg/fieldfilters/fields_test.go b/pkg/fieldfilters/fields_test.go index bde72f0ad54..22fc23420a9 100644 --- a/pkg/fieldfilters/fields_test.go +++ b/pkg/fieldfilters/fields_test.go @@ -217,6 +217,32 @@ func TestEmptyFieldFilter(t *testing.T) { assert.True(t, proto.Equal(ev, expected), "events are equal after filter") } +func TestEmptyFieldFilterTopLevelInformation(t *testing.T) { + ev := &tetragon.GetEventsResponse{ + NodeName: "foobarqux", + AggregationInfo: &tetragon.AggregationInfo{ + Count: 1000, + }, + Time: ×tamppb.Timestamp{ + Seconds: 1000, + Nanos: 1000, + }, + Event: &tetragon.GetEventsResponse_ProcessExec{ + ProcessExec: &tetragon.ProcessExec{ + Process: &tetragon.Process{}, + Parent: &tetragon.Process{}, + }, + }, + } + + filter, err := NewExcludeFieldFilter(nil, nil, false) + require.NoError(t, err) + ev, _ = filter.Filter(ev) + assert.NotEmpty(t, ev.NodeName, "node name must not be empty") + assert.NotEmpty(t, ev.Time, "timestamp must not be empty") + assert.NotEmpty(t, ev.AggregationInfo, "aggregation info must not be empty") +} + func TestFieldFilterInvertedEventSet(t *testing.T) { ev := &tetragon.GetEventsResponse{ Event: &tetragon.GetEventsResponse_ProcessExec{