From 77f2968267df472050adfd40dbbe3f8bb55ea703 Mon Sep 17 00:00:00 2001
From: "Thibault \"bui\" Koechlin" <thibault@crowdsec.net>
Date: Tue, 16 May 2023 09:10:38 +0200
Subject: [PATCH] fix the behavior of json unmarshal to not return the full map
 (#2199)

---
 pkg/exprhelpers/jsonextract.go | 4 ++--
 pkg/parser/runtime.go          | 9 ++++++---
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkg/exprhelpers/jsonextract.go b/pkg/exprhelpers/jsonextract.go
index f3a9ae78a..a874122ff 100644
--- a/pkg/exprhelpers/jsonextract.go
+++ b/pkg/exprhelpers/jsonextract.go
@@ -175,8 +175,8 @@ func UnmarshalJSON(params ...any) (any, error) {
 	err := json.Unmarshal([]byte(jsonBlob), &out)
 	if err != nil {
 		log.Errorf("UnmarshalJSON : %s", err)
-		return "", nil
+		return "", err
 	}
 	target[key] = out
-	return target, nil
+	return "", nil
 }
diff --git a/pkg/parser/runtime.go b/pkg/parser/runtime.go
index 5f47e0f5c..fd7c42517 100644
--- a/pkg/parser/runtime.go
+++ b/pkg/parser/runtime.go
@@ -133,11 +133,11 @@ func (n *Node) ProcessStatics(statics []types.ExtraField, event *types.Event) er
 			case int:
 				value = strconv.Itoa(out)
 			case map[string]interface{}:
-				clog.Warnf("Expression returned a map, please use ToJsonString() to convert it to string if you want to keep it as is, or refine your expression to extract a string")
+				clog.Warnf("Expression '%s' returned a map, please use ToJsonString() to convert it to string if you want to keep it as is, or refine your expression to extract a string", static.ExpValue)
 			case []interface{}:
-				clog.Warnf("Expression returned a map, please use ToJsonString() to convert it to string if you want to keep it as is, or refine your expression to extract a string")
+				clog.Warnf("Expression '%s' returned an array, please use ToJsonString() to convert it to string if you want to keep it as is, or refine your expression to extract a string", static.ExpValue)
 			case nil:
-				clog.Debugf("Expression returned nil, skipping")
+				clog.Debugf("Expression '%s' returned nil, skipping", static.ExpValue)
 			default:
 				clog.Errorf("unexpected return type for RunTimeValue : %T", output)
 				return errors.New("unexpected return type for RunTimeValue")
@@ -265,6 +265,9 @@ func Parse(ctx UnixParserCtx, xp types.Event, nodes []Node) (types.Event, error)
 	if event.Meta == nil {
 		event.Meta = make(map[string]string)
 	}
+	if event.Unmarshaled == nil {
+		event.Unmarshaled = make(map[string]interface{})
+	}
 	if event.Type == types.LOG {
 		log.Tracef("INPUT '%s'", event.Line.Raw)
 	}