diff --git a/cmd/crowdsec/output.go b/cmd/crowdsec/output.go index c4a2c0b6ac1..c3100a01729 100644 --- a/cmd/crowdsec/output.go +++ b/cmd/crowdsec/output.go @@ -122,6 +122,18 @@ LOOP: log.Printf("[%s] is whitelisted, skip.", *event.Overflow.Alert.Message) continue } + /* Inject postoverflow meta into the overflown state*/ + for key, value := range event.Meta { + kv := &models.MetaItems0{ + Key: key, + Value: value, + } + for _, alert := range event.Overflow.APIAlerts { + for _, event := range alert.Events { + event.Meta = append(event.Meta, kv) + } + } + } if event.Overflow.Reprocess { log.Debugf("Overflow being reprocessed.") input <- event