lint (copyloopvar)

.golangci.yml

@@ -3,7 +3,7 @@
 linters-settings:
   cyclop:
     # lower this after refactoring
-    max-complexity: 48
+    max-complexity: 53
 
   gci:
     sections:
@@ -22,7 +22,7 @@ linters-settings:
 
   gocyclo:
     # lower this after refactoring
-    min-complexity: 48
+    min-complexity: 49
 
   funlen:
     # Checks the number of lines in a function.
@@ -82,6 +82,11 @@ linters-settings:
           - "!**/pkg/apiserver/controllers/v1/errors.go"
       yaml:
         files:
+          - "!**/cmd/notification-dummy/main.go"
+          - "!**/cmd/notification-email/main.go"
+          - "!**/cmd/notification-http/main.go"
+          - "!**/cmd/notification-slack/main.go"
+          - "!**/cmd/notification-splunk/main.go"
           - "!**/pkg/acquisition/acquisition.go"
           - "!**/pkg/acquisition/acquisition_test.go"
           - "!**/pkg/acquisition/modules/appsec/appsec.go"

cmd/crowdsec-cli/support.go

@@ -319,7 +319,7 @@ cscli support dump -f /tmp/crowdsec-support.zip
 `,
 		Args:              cobra.NoArgs,
 		DisableAutoGenTag: true,
-		RunE: func(_ *cobra.Command, _ []string) error {
+		Run: func(_ *cobra.Command, _ []string) {
 			var err error
 			var skipHub, skipDB, skipCAPI, skipLAPI, skipAgent bool
 			infos := map[string][]byte{
@@ -473,19 +473,15 @@ cscli support dump -f /tmp/crowdsec-support.zip
 
 			err = zipWriter.Close()
 			if err != nil {
-				return fmt.Errorf("could not finalize zip file: %s", err)
+				log.Fatalf("could not finalize zip file: %s", err)
 			}
 
-			if outFile == "-" {
-				_, err = os.Stdout.Write(w.Bytes())
-				return err
-			}
 			err = os.WriteFile(outFile, w.Bytes(), 0o600)
 			if err != nil {
-				return fmt.Errorf("could not write zip file to %s: %s", outFile, err)
+				log.Fatalf("could not write zip file to %s: %s", outFile, err)
 			}
+
 			log.Infof("Written zip file to %s", outFile)
-			return nil
 		},
 	}
 

cmd/notification-dummy/main.go

@@ -5,11 +5,10 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/crowdsecurity/crowdsec/pkg/protobufs"
 	"github.com/hashicorp/go-hclog"
 	plugin "github.com/hashicorp/go-plugin"
-	"gopkg.in/yaml.v3"
-
-	"github.com/crowdsecurity/crowdsec/pkg/protobufs"
+	"gopkg.in/yaml.v2"
 )
 
 type PluginConfig struct {
@@ -33,7 +32,6 @@ func (s *DummyPlugin) Notify(ctx context.Context, notification *protobufs.Notifi
 	if _, ok := s.PluginConfigByName[notification.Name]; !ok {
 		return nil, fmt.Errorf("invalid plugin config name %s", notification.Name)
 	}
-
 	cfg := s.PluginConfigByName[notification.Name]
 
 	if cfg.LogLevel != nil && *cfg.LogLevel != "" {
@@ -44,22 +42,19 @@ func (s *DummyPlugin) Notify(ctx context.Context, notification *protobufs.Notifi
 	logger.Debug(notification.Text)
 
 	if cfg.OutputFile != nil && *cfg.OutputFile != "" {
-		f, err := os.OpenFile(*cfg.OutputFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)
+		f, err := os.OpenFile(*cfg.OutputFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
 		if err != nil {
 			logger.Error(fmt.Sprintf("Cannot open notification file: %s", err))
 		}
-
 		if _, err := f.WriteString(notification.Text + "\n"); err != nil {
 			f.Close()
 			logger.Error(fmt.Sprintf("Cannot write notification to file: %s", err))
 		}
-
 		err = f.Close()
 		if err != nil {
 			logger.Error(fmt.Sprintf("Cannot close notification file: %s", err))
 		}
 	}
-
 	fmt.Println(notification.Text)
 
 	return &protobufs.Empty{}, nil
@@ -69,12 +64,11 @@ func (s *DummyPlugin) Configure(ctx context.Context, config *protobufs.Config) (
 	d := PluginConfig{}
 	err := yaml.Unmarshal(config.Config, &d)
 	s.PluginConfigByName[d.Name] = d
-
 	return &protobufs.Empty{}, err
 }
 
 func main() {
-	handshake := plugin.HandshakeConfig{
+	var handshake = plugin.HandshakeConfig{
 		ProtocolVersion:  1,
 		MagicCookieKey:   "CROWDSEC_PLUGIN_KEY",
 		MagicCookieValue: os.Getenv("CROWDSEC_PLUGIN_KEY"),

cmd/notification-email/main.go

@@ -2,17 +2,15 @@ package main
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"os"
 	"time"
 
+	"github.com/crowdsecurity/crowdsec/pkg/protobufs"
 	"github.com/hashicorp/go-hclog"
 	plugin "github.com/hashicorp/go-plugin"
 	mail "github.com/xhit/go-simple-mail/v2"
-	"gopkg.in/yaml.v3"
-
-	"github.com/crowdsecurity/crowdsec/pkg/protobufs"
+	"gopkg.in/yaml.v2"
 )
 
 var baseLogger hclog.Logger = hclog.New(&hclog.LoggerOptions{
@@ -74,20 +72,19 @@ func (n *EmailPlugin) Configure(ctx context.Context, config *protobufs.Config) (
 	}
 
 	if d.Name == "" {
-		return nil, errors.New("name is required")
+		return nil, fmt.Errorf("name is required")
 	}
 
 	if d.SMTPHost == "" {
-		return nil, errors.New("SMTP host is not set")
+		return nil, fmt.Errorf("SMTP host is not set")
 	}
 
 	if d.ReceiverEmails == nil || len(d.ReceiverEmails) == 0 {
-		return nil, errors.New("receiver emails are not set")
+		return nil, fmt.Errorf("receiver emails are not set")
 	}
 
 	n.ConfigByName[d.Name] = d
 	baseLogger.Debug(fmt.Sprintf("Email plugin '%s' use SMTP host '%s:%d'", d.Name, d.SMTPHost, d.SMTPPort))
-
 	return &protobufs.Empty{}, nil
 }
 
@@ -95,7 +92,6 @@ func (n *EmailPlugin) Notify(ctx context.Context, notification *protobufs.Notifi
 	if _, ok := n.ConfigByName[notification.Name]; !ok {
 		return nil, fmt.Errorf("invalid plugin config name %s", notification.Name)
 	}
-
 	cfg := n.ConfigByName[notification.Name]
 
 	logger := baseLogger.Named(cfg.Name)
@@ -121,7 +117,6 @@ func (n *EmailPlugin) Notify(ctx context.Context, notification *protobufs.Notifi
 		server.ConnectTimeout, err = time.ParseDuration(cfg.ConnectTimeout)
 		if err != nil {
 			logger.Warn(fmt.Sprintf("invalid connect timeout '%s', using default '10s'", cfg.ConnectTimeout))
-
 			server.ConnectTimeout = 10 * time.Second
 		}
 	}
@@ -130,18 +125,15 @@ func (n *EmailPlugin) Notify(ctx context.Context, notification *protobufs.Notifi
 		server.SendTimeout, err = time.ParseDuration(cfg.SendTimeout)
 		if err != nil {
 			logger.Warn(fmt.Sprintf("invalid send timeout '%s', using default '10s'", cfg.SendTimeout))
-
 			server.SendTimeout = 10 * time.Second
 		}
 	}
 
 	logger.Debug("making smtp connection")
-
 	smtpClient, err := server.Connect()
 	if err != nil {
 		return &protobufs.Empty{}, err
 	}
-
 	logger.Debug("smtp connection done")
 
 	email := mail.NewMSG()
@@ -154,14 +146,12 @@ func (n *EmailPlugin) Notify(ctx context.Context, notification *protobufs.Notifi
 	if err != nil {
 		return &protobufs.Empty{}, err
 	}
-
 	logger.Info(fmt.Sprintf("sent email to %v", cfg.ReceiverEmails))
-
 	return &protobufs.Empty{}, nil
 }
 
 func main() {
-	handshake := plugin.HandshakeConfig{
+	var handshake = plugin.HandshakeConfig{
 		ProtocolVersion:  1,
 		MagicCookieKey:   "CROWDSEC_PLUGIN_KEY",
 		MagicCookieValue: os.Getenv("CROWDSEC_PLUGIN_KEY"),

cmd/notification-http/main.go

@@ -12,11 +12,10 @@ import (
 	"os"
 	"strings"
 
+	"github.com/crowdsecurity/crowdsec/pkg/protobufs"
 	"github.com/hashicorp/go-hclog"
 	plugin "github.com/hashicorp/go-plugin"
-	"gopkg.in/yaml.v3"
-
-	"github.com/crowdsecurity/crowdsec/pkg/protobufs"
+	"gopkg.in/yaml.v2"
 )
 
 type PluginConfig struct {
@@ -91,23 +90,18 @@ func getTLSClient(c *PluginConfig) error {
 
 		tlsConfig.Certificates = []tls.Certificate{cert}
 	}
-
 	transport := &http.Transport{
 		TLSClientConfig: tlsConfig,
 	}
-
 	if c.UnixSocket != "" {
 		logger.Info(fmt.Sprintf("Using socket '%s'", c.UnixSocket))
-
 		transport.DialContext = func(_ context.Context, _, _ string) (net.Conn, error) {
 			return net.Dial("unix", strings.TrimSuffix(c.UnixSocket, "/"))
 		}
 	}
-
 	c.Client = &http.Client{
 		Transport: transport,
 	}
-
 	return nil
 }
 
@@ -115,7 +109,6 @@ func (s *HTTPPlugin) Notify(ctx context.Context, notification *protobufs.Notific
 	if _, ok := s.PluginConfigByName[notification.Name]; !ok {
 		return nil, fmt.Errorf("invalid plugin config name %s", notification.Name)
 	}
-
 	cfg := s.PluginConfigByName[notification.Name]
 
 	if cfg.LogLevel != nil && *cfg.LogLevel != "" {
@@ -128,14 +121,11 @@ func (s *HTTPPlugin) Notify(ctx context.Context, notification *protobufs.Notific
 	if err != nil {
 		return nil, err
 	}
-
 	for headerName, headerValue := range cfg.Headers {
 		logger.Debug(fmt.Sprintf("adding header %s: %s", headerName, headerValue))
 		request.Header.Add(headerName, headerValue)
 	}
-
 	logger.Debug(fmt.Sprintf("making HTTP %s call to %s with body %s", cfg.Method, cfg.URL, notification.Text))
-
 	resp, err := cfg.Client.Do(request.WithContext(ctx))
 	if err != nil {
 		logger.Error(fmt.Sprintf("Failed to make HTTP request : %s", err))
@@ -145,7 +135,7 @@ func (s *HTTPPlugin) Notify(ctx context.Context, notification *protobufs.Notific
 
 	respData, err := io.ReadAll(resp.Body)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read response body got error %w", err)
+		return nil, fmt.Errorf("failed to read response body got error %s", err)
 	}
 
 	logger.Debug(fmt.Sprintf("got response %s", string(respData)))
@@ -153,7 +143,6 @@ func (s *HTTPPlugin) Notify(ctx context.Context, notification *protobufs.Notific
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
 		logger.Warn(fmt.Sprintf("HTTP server returned non 200 status code: %d", resp.StatusCode))
 		logger.Debug(fmt.Sprintf("HTTP server returned body: %s", string(respData)))
-
 		return &protobufs.Empty{}, nil
 	}
 
@@ -162,25 +151,21 @@ func (s *HTTPPlugin) Notify(ctx context.Context, notification *protobufs.Notific
 
 func (s *HTTPPlugin) Configure(ctx context.Context, config *protobufs.Config) (*protobufs.Empty, error) {
 	d := PluginConfig{}
-
 	err := yaml.Unmarshal(config.Config, &d)
 	if err != nil {
 		return nil, err
 	}
-
 	err = getTLSClient(&d)
 	if err != nil {
 		return nil, err
 	}
-
 	s.PluginConfigByName[d.Name] = d
 	logger.Debug(fmt.Sprintf("HTTP plugin '%s' use URL '%s'", d.Name, d.URL))
-
 	return &protobufs.Empty{}, err
 }
 
 func main() {
-	handshake := plugin.HandshakeConfig{
+	var handshake = plugin.HandshakeConfig{
 		ProtocolVersion:  1,
 		MagicCookieKey:   "CROWDSEC_PLUGIN_KEY",
 		MagicCookieValue: os.Getenv("CROWDSEC_PLUGIN_KEY"),

cmd/notification-slack/main.go

@@ -5,12 +5,12 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/crowdsecurity/crowdsec/pkg/protobufs"
 	"github.com/hashicorp/go-hclog"
 	plugin "github.com/hashicorp/go-plugin"
-	"github.com/slack-go/slack"
-	"gopkg.in/yaml.v3"
 
-	"github.com/crowdsecurity/crowdsec/pkg/protobufs"
+	"github.com/slack-go/slack"
+	"gopkg.in/yaml.v2"
 )
 
 type PluginConfig struct {
@@ -33,16 +33,13 @@ func (n *Notify) Notify(ctx context.Context, notification *protobufs.Notificatio
 	if _, ok := n.ConfigByName[notification.Name]; !ok {
 		return nil, fmt.Errorf("invalid plugin config name %s", notification.Name)
 	}
-
 	cfg := n.ConfigByName[notification.Name]
 
 	if cfg.LogLevel != nil && *cfg.LogLevel != "" {
 		logger.SetLevel(hclog.LevelFromString(*cfg.LogLevel))
 	}
-
 	logger.Info(fmt.Sprintf("found notify signal for %s config", notification.Name))
 	logger.Debug(fmt.Sprintf("posting to %s webhook, message %s", cfg.Webhook, notification.Text))
-
 	err := slack.PostWebhookContext(ctx, n.ConfigByName[notification.Name].Webhook, &slack.WebhookMessage{
 		Text: notification.Text,
 	})
@@ -55,19 +52,16 @@ func (n *Notify) Notify(ctx context.Context, notification *protobufs.Notificatio
 
 func (n *Notify) Configure(ctx context.Context, config *protobufs.Config) (*protobufs.Empty, error) {
 	d := PluginConfig{}
-
 	if err := yaml.Unmarshal(config.Config, &d); err != nil {
 		return nil, err
 	}
-
 	n.ConfigByName[d.Name] = d
 	logger.Debug(fmt.Sprintf("Slack plugin '%s' use URL '%s'", d.Name, d.Webhook))
-
 	return &protobufs.Empty{}, nil
 }
 
 func main() {
-	handshake := plugin.HandshakeConfig{
+	var handshake = plugin.HandshakeConfig{
 		ProtocolVersion:  1,
 		MagicCookieKey:   "CROWDSEC_PLUGIN_KEY",
 		MagicCookieValue: os.Getenv("CROWDSEC_PLUGIN_KEY"),

cmd/notification-splunk/main.go

@@ -10,11 +10,11 @@ import (
 	"os"
 	"strings"
 
+	"github.com/crowdsecurity/crowdsec/pkg/protobufs"
 	"github.com/hashicorp/go-hclog"
 	plugin "github.com/hashicorp/go-plugin"
-	"gopkg.in/yaml.v3"
 
-	"github.com/crowdsecurity/crowdsec/pkg/protobufs"
+	"gopkg.in/yaml.v2"
 )
 
 var logger hclog.Logger = hclog.New(&hclog.LoggerOptions{
@@ -44,7 +44,6 @@ func (s *Splunk) Notify(ctx context.Context, notification *protobufs.Notificatio
 	if _, ok := s.PluginConfigByName[notification.Name]; !ok {
 		return &protobufs.Empty{}, fmt.Errorf("splunk invalid config name %s", notification.Name)
 	}
-
 	cfg := s.PluginConfigByName[notification.Name]
 
 	if cfg.LogLevel != nil && *cfg.LogLevel != "" {
@@ -54,7 +53,6 @@ func (s *Splunk) Notify(ctx context.Context, notification *protobufs.Notificatio
 	logger.Info(fmt.Sprintf("received notify signal for %s config", notification.Name))
 
 	p := Payload{Event: notification.Text}
-
 	data, err := json.Marshal(p)
 	if err != nil {
 		return &protobufs.Empty{}, err
@@ -67,7 +65,6 @@ func (s *Splunk) Notify(ctx context.Context, notification *protobufs.Notificatio
 
 	req.Header.Add("Authorization", fmt.Sprintf("Splunk %s", cfg.Token))
 	logger.Debug(fmt.Sprintf("posting event %s to %s", string(data), req.URL))
-
 	resp, err := s.Client.Do(req.WithContext(ctx))
 	if err != nil {
 		return &protobufs.Empty{}, err
@@ -76,19 +73,15 @@ func (s *Splunk) Notify(ctx context.Context, notification *protobufs.Notificatio
 	if resp.StatusCode != http.StatusOK {
 		content, err := io.ReadAll(resp.Body)
 		if err != nil {
-			return &protobufs.Empty{}, fmt.Errorf("got non 200 response and failed to read error %w", err)
+			return &protobufs.Empty{}, fmt.Errorf("got non 200 response and failed to read error %s", err)
 		}
-
 		return &protobufs.Empty{}, fmt.Errorf("got non 200 response %s", string(content))
 	}
-
 	respData, err := io.ReadAll(resp.Body)
 	if err != nil {
-		return &protobufs.Empty{}, fmt.Errorf("failed to read response body got error %w", err)
+		return &protobufs.Empty{}, fmt.Errorf("failed to read response body got error %s", err)
 	}
-
 	logger.Debug(fmt.Sprintf("got response %s", string(respData)))
-
 	return &protobufs.Empty{}, nil
 }
 
@@ -97,12 +90,11 @@ func (s *Splunk) Configure(ctx context.Context, config *protobufs.Config) (*prot
 	err := yaml.Unmarshal(config.Config, &d)
 	s.PluginConfigByName[d.Name] = d
 	logger.Debug(fmt.Sprintf("Splunk plugin '%s' use URL '%s'", d.Name, d.URL))
-
 	return &protobufs.Empty{}, err
 }
 
 func main() {
-	handshake := plugin.HandshakeConfig{
+	var handshake = plugin.HandshakeConfig{
 		ProtocolVersion:  1,
 		MagicCookieKey:   "CROWDSEC_PLUGIN_KEY",
 		MagicCookieValue: os.Getenv("CROWDSEC_PLUGIN_KEY"),

pkg/acquisition/acquisition_test.go

@@ -178,7 +178,6 @@ wowo: ajsajasjas
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.TestName, func(t *testing.T) {
 			common := configuration.DataSourceCommonCfg{}
 			yaml.Unmarshal([]byte(tc.String), &common)
@@ -281,7 +280,6 @@ func TestLoadAcquisitionFromFile(t *testing.T) {
 		},
 	}
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.TestName, func(t *testing.T) {
 			dss, err := LoadAcquisitionFromFile(&tc.Config, nil)
 			cstest.RequireErrorContains(t, err, tc.ExpectedError)
@@ -548,7 +546,6 @@ func TestConfigureByDSN(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.dsn, func(t *testing.T) {
 			srcs, err := LoadAcquisitionFromDSN(tc.dsn, map[string]string{"type": "test_label"}, "")
 			cstest.RequireErrorContains(t, err, tc.ExpectedError)

pkg/acquisition/modules/appsec/appsec.go

@@ -253,7 +253,6 @@ func (w *AppsecSource) StreamingAcquisition(out chan types.Event, t *tomb.Tomb)
 
 		w.logger.Infof("%d appsec runner to start", len(w.AppsecRunners))
 		for _, runner := range w.AppsecRunners {
-			runner := runner
 			runner.outChan = out
 			t.Go(func() error {
 				defer trace.CatchPanic("crowdsec/acquis/appsec/live/runner")

pkg/acquisition/modules/cloudwatch/cloudwatch_test.go

@@ -422,7 +422,6 @@ stream_name: test_stream`),
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			dbgLogger := log.New().WithField("test", tc.name)
 			dbgLogger.Logger.SetLevel(log.DebugLevel)
@@ -555,7 +554,6 @@ stream_name: test_stream`),
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			dbgLogger := log.New().WithField("test", tc.name)
 			dbgLogger.Logger.SetLevel(log.DebugLevel)
@@ -620,7 +618,6 @@ func TestConfigureByDSN(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			dbgLogger := log.New().WithField("test", tc.name)
 			dbgLogger.Logger.SetLevel(log.DebugLevel)
@@ -742,7 +739,6 @@ func TestOneShotAcquisition(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			dbgLogger := log.New().WithField("test", tc.name)
 			dbgLogger.Logger.SetLevel(log.DebugLevel)

pkg/acquisition/modules/file/file_test.go

@@ -54,7 +54,6 @@ exclude_regexps: ["as[a-$d"]`,
 	})
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			f := fileacquisition.FileSource{}
 			err := f.Configure([]byte(tc.config), subLogger, configuration.METRICS_NONE)
@@ -96,7 +95,6 @@ func TestConfigureDSN(t *testing.T) {
 	})
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.dsn, func(t *testing.T) {
 			f := fileacquisition.FileSource{}
 			err := f.ConfigureByDSN(tc.dsn, map[string]string{"type": "testtype"}, subLogger, "")
@@ -206,7 +204,6 @@ filename: test_files/test_delete.log`,
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			logger, hook := test.NewNullLogger()
 			logger.SetLevel(tc.logLevel)
@@ -367,7 +364,6 @@ force_inotify: true`, testPattern),
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			logger, hook := test.NewNullLogger()
 			logger.SetLevel(tc.logLevel)

pkg/acquisition/modules/kafka/kafka_test.go

@@ -163,7 +163,6 @@ func TestStreamingAcquisition(t *testing.T) {
 	}
 
 	for _, ts := range tests {
-		ts := ts
 		t.Run(ts.name, func(t *testing.T) {
 			k := KafkaSource{}
 			err := k.Configure([]byte(`
@@ -233,7 +232,6 @@ func TestStreamingAcquisitionWithSSL(t *testing.T) {
 	}
 
 	for _, ts := range tests {
-		ts := ts
 		t.Run(ts.name, func(t *testing.T) {
 			k := KafkaSource{}
 			err := k.Configure([]byte(`

pkg/acquisition/modules/syslog/internal/parser/rfc3164/parse_test.go

@@ -22,7 +22,6 @@ func TestPri(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.input, func(t *testing.T) {
 			r := &RFC3164{}
 			r.buf = []byte(test.input)
@@ -64,7 +63,6 @@ func TestTimestamp(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.input, func(t *testing.T) {
 			opts := []RFC3164Option{}
 			if test.currentYear {
@@ -118,7 +116,6 @@ func TestHostname(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.input, func(t *testing.T) {
 			opts := []RFC3164Option{}
 			if test.strictHostname {
@@ -163,7 +160,6 @@ func TestTag(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.input, func(t *testing.T) {
 			r := &RFC3164{}
 			r.buf = []byte(test.input)
@@ -207,7 +203,6 @@ func TestMessage(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.input, func(t *testing.T) {
 			r := &RFC3164{}
 			r.buf = []byte(test.input)
@@ -329,7 +324,6 @@ func TestParse(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.input, func(t *testing.T) {
 			r := NewRFC3164Parser(test.opts...)
 			err := r.Parse([]byte(test.input))

pkg/acquisition/modules/syslog/internal/parser/rfc3164/perf_test.go

@@ -51,7 +51,6 @@ func BenchmarkParse(b *testing.B) {
 	}
 	var err error
 	for _, test := range tests {
-		test := test
 		b.Run(string(test.input), func(b *testing.B) {
 			for i := 0; i < b.N; i++ {
 				r := NewRFC3164Parser(test.opts...)

pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse_test.go

@@ -25,7 +25,6 @@ func TestPri(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.input, func(t *testing.T) {
 			r := &RFC5424{}
 			r.buf = []byte(test.input)
@@ -61,7 +60,6 @@ func TestHostname(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.input, func(t *testing.T) {
 			opts := []RFC5424Option{}
 			if test.strictHostname {
@@ -200,7 +198,6 @@ func TestParse(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			r := NewRFC5424Parser(test.opts...)
 			err := r.Parse([]byte(test.input))

pkg/acquisition/modules/syslog/internal/parser/rfc5424/perf_test.go

@@ -92,7 +92,6 @@ func BenchmarkParse(b *testing.B) {
 	}
 	var err error
 	for _, test := range tests {
-		test := test
 		b.Run(test.label, func(b *testing.B) {
 			for i := 0; i < b.N; i++ {
 				r := NewRFC5424Parser()

pkg/acquisition/modules/syslog/syslog_test.go

@@ -132,7 +132,6 @@ listen_addr: 127.0.0.1`,
 	}
 
 	for _, ts := range tests {
-		ts := ts
 		t.Run(ts.name, func(t *testing.T) {
 			subLogger := log.WithFields(log.Fields{
 				"type": "syslog",

pkg/apiclient/decisions_service_test.go

@@ -459,7 +459,6 @@ func TestDecisionsStreamOpts_addQueryParamsToURL(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			o := &DecisionsStreamOpts{
 				Startup:                tt.fields.Startup,

pkg/apiserver/apic_metrics_test.go

@@ -65,7 +65,6 @@ func TestAPICSendMetrics(t *testing.T) {
 	defer httpmock.Deactivate()
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			url, err := url.ParseRequestURI("http://api.crowdsec.net/")
 			require.NoError(t, err)

pkg/apiserver/apic_test.go

@@ -162,7 +162,6 @@ func TestAPICFetchScenariosListFromDB(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			api := getAPIC(t)
 			for machineID, scenarios := range tc.machineIDsWithScenarios {
@@ -229,7 +228,6 @@ func TestNewAPIC(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			setConfig()
 			httpmock.Activate()
@@ -348,7 +346,6 @@ func TestAPICGetMetrics(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			apiClient := getAPIC(t)
 			cleanUp(apiClient)
@@ -455,7 +452,6 @@ func TestCreateAlertsForDecision(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			if got := createAlertsForDecisions(tc.args.decisions); !reflect.DeepEqual(got, tc.want) {
 				t.Errorf("createAlertsForDecisions() = %v, want %v", got, tc.want)
@@ -535,7 +531,6 @@ func TestFillAlertsWithDecisions(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			addCounters, _ := makeAddAndDeleteCounters()
 			if got := fillAlertsWithDecisions(tc.args.alerts, tc.args.decisions, addCounters); !reflect.DeepEqual(got, tc.want) {
@@ -1092,7 +1087,6 @@ func TestAPICPush(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			api := getAPIC(t)
 			api.pushInterval = time.Millisecond
@@ -1152,7 +1146,6 @@ func TestAPICPull(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			api = getAPIC(t)
 			api.pullInterval = time.Millisecond
@@ -1279,7 +1272,6 @@ func TestShouldShareAlert(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			ret := shouldShareAlert(tc.alert, tc.consoleConfig)
 			assert.Equal(t, tc.expectedRet, ret)

pkg/csconfig/api_test.go

@@ -64,7 +64,6 @@ func TestLoadLocalApiClientCfg(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			err := tc.input.Load()
 			cstest.RequireErrorContains(t, err, tc.expectedErr)
@@ -122,7 +121,6 @@ func TestLoadOnlineApiClientCfg(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			err := tc.input.Load()
 			cstest.RequireErrorContains(t, err, tc.expectedErr)
@@ -245,7 +243,6 @@ func TestLoadAPIServer(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			err := tc.input.LoadAPIServer(false)
 			cstest.RequireErrorContains(t, err, tc.expectedErr)
@@ -309,7 +306,6 @@ func TestParseCapiWhitelists(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			wl, err := parseCapiWhitelists(strings.NewReader(tc.input))
 			cstest.RequireErrorContains(t, err, tc.expectedErr)

pkg/csconfig/config_test.go

@@ -32,7 +32,6 @@ func TestNewCrowdSecConfig(t *testing.T) {
 		},
 	}
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			result := &Config{}
 			assert.Equal(t, tc.expected, result)

pkg/csconfig/crowdsec_service_test.go

@@ -181,7 +181,6 @@ func TestLoadCrowdsec(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			err := tc.input.LoadCrowdsec()
 			cstest.RequireErrorContains(t, err, tc.expectedErr)

pkg/csconfig/cscli_test.go

@@ -39,7 +39,6 @@ func TestLoadCSCLI(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			err := tc.input.loadCSCLI()
 			cstest.RequireErrorContains(t, err, tc.expectedErr)

pkg/csconfig/database_test.go

@@ -46,7 +46,6 @@ func TestLoadDBConfig(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			err := tc.input.LoadDBConfig(false)
 			cstest.RequireErrorContains(t, err, tc.expectedErr)

pkg/csconfig/hub_test.go

@@ -35,7 +35,6 @@ func TestLoadHub(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			err := tc.input.loadHub()
 			cstest.RequireErrorContains(t, err, tc.expectedErr)

pkg/csconfig/simulation_test.go

@@ -76,7 +76,6 @@ func TestSimulationLoading(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			err := tc.input.LoadSimulation()
 			cstest.RequireErrorContains(t, err, tc.expectedErr)
@@ -124,7 +123,6 @@ func TestIsSimulated(t *testing.T) {
 		},
 	}
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			isSimulated := tc.SimulationConfig.IsSimulated(tc.Input)
 			require.Equal(t, tc.expected, isSimulated)

pkg/csplugin/broker_test.go

@@ -129,7 +129,6 @@ func (s *PluginSuite) TestBrokerInit() {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		s.Run(tc.name, func() {
 			t := s.T()
 			if tc.action != nil {

pkg/csplugin/listfiles_test.go

@@ -47,7 +47,6 @@ func TestListFilesAtPath(t *testing.T) {
 		},
 	}
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			got, err := listFilesAtPath(tc.path)
 			cstest.RequireErrorContains(t, err, tc.expectedErr)

pkg/csplugin/utils_test.go

@@ -37,7 +37,6 @@ func TestGetPluginNameAndTypeFromPath(t *testing.T) {
 		},
 	}
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			got, got1, err := getPluginTypeAndSubtypeFromPath(tc.path)
 			cstest.RequireErrorContains(t, err, tc.expectedErr)

pkg/csprofiles/csprofiles_test.go

@@ -102,7 +102,6 @@ func TestNewProfile(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			profilesCfg := []*csconfig.ProfileCfg{
 				test.profileCfg,
@@ -196,7 +195,6 @@ func TestEvaluateProfile(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			profilesCfg := []*csconfig.ProfileCfg{
 				tt.args.profileCfg,

pkg/exprhelpers/exprlib_test.go

@@ -1150,7 +1150,6 @@ func TestParseUnixTime(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			output, err := ParseUnixTime(tc.value)
 			cstest.RequireErrorContains(t, err, tc.expectedErr)
@@ -1252,7 +1251,6 @@ func TestIsIp(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			vm, err := expr.Compile(tc.expr, GetExprOptions(map[string]interface{}{"value": tc.value})...)
 			if tc.expectedBuildErr {
@@ -1304,7 +1302,6 @@ func TestToString(t *testing.T) {
 		},
 	}
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			vm, err := expr.Compile(tc.expr, GetExprOptions(map[string]interface{}{"value": tc.value})...)
 			require.NoError(t, err)
@@ -1351,7 +1348,6 @@ func TestB64Decode(t *testing.T) {
 		},
 	}
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			vm, err := expr.Compile(tc.expr, GetExprOptions(map[string]interface{}{"value": tc.value})...)
 			if tc.expectedBuildErr {
@@ -1421,7 +1417,6 @@ func TestParseKv(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			outMap := make(map[string]interface{})
 			env := map[string]interface{}{

pkg/exprhelpers/jsonextract_test.go

@@ -161,7 +161,6 @@ func TestJsonExtractSlice(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			env := map[string]interface{}{
 				"blob":   test.jsonBlob,
@@ -217,7 +216,6 @@ func TestJsonExtractObject(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			env := map[string]interface{}{
 				"blob":   test.jsonBlob,

pkg/fflag/features_test.go

@@ -50,8 +50,6 @@ func TestRegisterFeature(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
-
 		t.Run("", func(t *testing.T) {
 			fr := fflag.FeatureRegister{EnvPrefix: "FFLAG_TEST_"}
 			err := fr.RegisterFeature(&tc.feature)
@@ -112,7 +110,6 @@ func TestGetFeature(t *testing.T) {
 	fr := setUp(t)
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			_, err := fr.GetFeature(tc.feature)
 			cstest.RequireErrorMessage(t, err, tc.expectedErr)
@@ -145,7 +142,6 @@ func TestIsEnabled(t *testing.T) {
 	fr := setUp(t)
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			feat, err := fr.GetFeature(tc.feature)
 			require.NoError(t, err)
@@ -204,7 +200,6 @@ func TestFeatureSet(t *testing.T) {
 	fr := setUp(t)
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			feat, err := fr.GetFeature(tc.feature)
 			cstest.RequireErrorMessage(t, err, tc.expectedGetErr)
@@ -284,7 +279,6 @@ func TestSetFromEnv(t *testing.T) {
 	fr := setUp(t)
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			logger, hook := logtest.NewNullLogger()
 			logger.SetLevel(logrus.DebugLevel)
@@ -344,7 +338,6 @@ func TestSetFromYaml(t *testing.T) {
 	fr := setUp(t)
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			logger, hook := logtest.NewNullLogger()
 			logger.SetLevel(logrus.DebugLevel)

pkg/parser/enrich_date_test.go

@@ -46,7 +46,6 @@ func TestDateParse(t *testing.T) {
 		"test": "test",
 	})
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			strTime, err := ParseDate(tt.evt.StrTime, &tt.evt, nil, logger)
 			cstest.RequireErrorContains(t, err, tt.expectedErr)

pkg/parser/node.go

@@ -22,70 +22,69 @@ import (
 
 type Node struct {
 	FormatVersion string `yaml:"format"`
-	// Enable config + runtime debug of node via config o/
+	//Enable config + runtime debug of node via config o/
 	Debug bool `yaml:"debug,omitempty"`
-	// If enabled, the node (and its child) will report their own statistics
+	//If enabled, the node (and its child) will report their own statistics
 	Profiling bool `yaml:"profiling,omitempty"`
-	// Name, author, description and reference(s) for parser pattern
+	//Name, author, description and reference(s) for parser pattern
 	Name        string   `yaml:"name,omitempty"`
 	Author      string   `yaml:"author,omitempty"`
 	Description string   `yaml:"description,omitempty"`
 	References  []string `yaml:"references,omitempty"`
-	// if debug is present in the node, keep its specific Logger in runtime structure
+	//if debug is present in the node, keep its specific Logger in runtime structure
 	Logger *log.Entry `yaml:"-"`
-	// This is mostly a hack to make writing less repetitive.
-	// relying on stage, we know which field to parse, and we
-	// can also promote log to next stage on success
+	//This is mostly a hack to make writing less repetitive.
+	//relying on stage, we know which field to parse, and we
+	//can also promote log to next stage on success
 	Stage string `yaml:"stage,omitempty"`
-	// OnSuccess allows to tag a node to be able to move log to next stage on success
+	//OnSuccess allows to tag a node to be able to move log to next stage on success
 	OnSuccess string `yaml:"onsuccess,omitempty"`
-	rn        string // this is only for us in debug, a random generated name for each node
-	// Filter is executed at runtime (with current log line as context)
-	// and must succeed or node is exited
+	rn        string //this is only for us in debug, a random generated name for each node
+	//Filter is executed at runtime (with current log line as context)
+	//and must succeed or node is exited
 	Filter        string      `yaml:"filter,omitempty"`
-	RunTimeFilter *vm.Program `yaml:"-" json:"-"` // the actual compiled filter
-	// If node has leafs, execute all of them until one asks for a 'break'
+	RunTimeFilter *vm.Program `yaml:"-" json:"-"` //the actual compiled filter
+	//If node has leafs, execute all of them until one asks for a 'break'
 	LeavesNodes []Node `yaml:"nodes,omitempty"`
-	// Flag used to describe when to 'break' or return an 'error'
+	//Flag used to describe when to 'break' or return an 'error'
 	EnrichFunctions EnricherCtx
 
 	/* If the node is actually a leaf, it can have : grok, enrich, statics */
-	// pattern_syntax are named grok patterns that are re-utilized over several grok patterns
+	//pattern_syntax are named grok patterns that are re-utilized over several grok patterns
 	SubGroks yaml.MapSlice `yaml:"pattern_syntax,omitempty"`
 
-	// Holds a grok pattern
+	//Holds a grok pattern
 	Grok GrokPattern `yaml:"grok,omitempty"`
-	// Statics can be present in any type of node and is executed last
+	//Statics can be present in any type of node and is executed last
 	Statics []ExtraField `yaml:"statics,omitempty"`
-	// Stash allows to capture data from the log line and store it in an accessible cache
+	//Stash allows to capture data from the log line and store it in an accessible cache
 	Stash []DataCapture `yaml:"stash,omitempty"`
-	// Whitelists
+	//Whitelists
 	Whitelist Whitelist           `yaml:"whitelist,omitempty"`
 	Data      []*types.DataSource `yaml:"data,omitempty"`
 }
 
 func (n *Node) validate(pctx *UnixParserCtx, ectx EnricherCtx) error {
-	// stage is being set automagically
+
+	//stage is being set automagically
 	if n.Stage == "" {
-		return errors.New("stage needs to be an existing stage")
+		return fmt.Errorf("stage needs to be an existing stage")
 	}
 
 	/* "" behaves like continue */
 	if n.OnSuccess != "continue" && n.OnSuccess != "next_stage" && n.OnSuccess != "" {
 		return fmt.Errorf("onsuccess '%s' not continue,next_stage", n.OnSuccess)
 	}
-
 	if n.Filter != "" && n.RunTimeFilter == nil {
 		return fmt.Errorf("non-empty filter '%s' was not compiled", n.Filter)
 	}
 
 	if n.Grok.RunTimeRegexp != nil || n.Grok.TargetField != "" {
 		if n.Grok.TargetField == "" && n.Grok.ExpValue == "" {
-			return errors.New("grok requires 'expression' or 'apply_on'")
+			return fmt.Errorf("grok requires 'expression' or 'apply_on'")
 		}
-
 		if n.Grok.RegexpName == "" && n.Grok.RegexpValue == "" {
-			return errors.New("grok needs 'pattern' or 'name'")
+			return fmt.Errorf("grok needs 'pattern' or 'name'")
 		}
 	}
 
@@ -94,7 +93,6 @@ func (n *Node) validate(pctx *UnixParserCtx, ectx EnricherCtx) error {
 			if static.ExpValue == "" {
 				return fmt.Errorf("static %d : when method is set, expression must be present", idx)
 			}
-
 			if _, ok := ectx.Registered[static.Method]; !ok {
 				log.Warningf("the method '%s' doesn't exist or the plugin has not been initialized", static.Method)
 			}
@@ -102,7 +100,6 @@ func (n *Node) validate(pctx *UnixParserCtx, ectx EnricherCtx) error {
 			if static.Meta == "" && static.Parsed == "" && static.TargetByName == "" {
 				return fmt.Errorf("static %d : at least one of meta/event/target must be set", idx)
 			}
-
 			if static.Value == "" && static.RunTimeValue == nil {
 				return fmt.Errorf("static %d value or expression must be set", idx)
 			}
@@ -113,76 +110,72 @@ func (n *Node) validate(pctx *UnixParserCtx, ectx EnricherCtx) error {
 		if stash.Name == "" {
 			return fmt.Errorf("stash %d : name must be set", idx)
 		}
-
 		if stash.Value == "" {
 			return fmt.Errorf("stash %s : value expression must be set", stash.Name)
 		}
-
 		if stash.Key == "" {
 			return fmt.Errorf("stash %s : key expression must be set", stash.Name)
 		}
-
 		if stash.TTL == "" {
 			return fmt.Errorf("stash %s : ttl must be set", stash.Name)
 		}
-
 		if stash.Strategy == "" {
 			stash.Strategy = "LRU"
 		}
-		// should be configurable
+		//should be configurable
 		if stash.MaxMapSize == 0 {
 			stash.MaxMapSize = 100
 		}
 	}
-
 	return nil
 }
 
-func (n *Node) processFilter(cachedExprEnv map[string]interface{}) (bool, error) {
+func (n *Node) process(p *types.Event, ctx UnixParserCtx, expressionEnv map[string]interface{}) (bool, error) {
+	var NodeState bool
+	var NodeHasOKGrok bool
 	clog := n.Logger
-	if n.RunTimeFilter == nil {
-		clog.Tracef("Node has not filter, enter")
-		return true, nil
-	}
 
-	// Evaluate node's filter
-	output, err := exprhelpers.Run(n.RunTimeFilter, cachedExprEnv, clog, n.Debug)
-	if err != nil {
-		clog.Warningf("failed to run filter : %v", err)
-		clog.Debugf("Event leaving node : ko")
+	cachedExprEnv := expressionEnv
 
-		return false, nil
-	}
-
-	switch out := output.(type) {
-	case bool:
-		if !out {
-			clog.Debugf("Event leaving node : ko (failed filter)")
+	clog.Tracef("Event entering node")
+	if n.RunTimeFilter != nil {
+		//Evaluate node's filter
+		output, err := exprhelpers.Run(n.RunTimeFilter, cachedExprEnv, clog, n.Debug)
+		if err != nil {
+			clog.Warningf("failed to run filter : %v", err)
+			clog.Debugf("Event leaving node : ko")
 			return false, nil
 		}
-	default:
-		clog.Warningf("Expr '%s' returned non-bool, abort : %T", n.Filter, output)
-		clog.Debugf("Event leaving node : ko")
 
-		return false, nil
+		switch out := output.(type) {
+		case bool:
+			if !out {
+				clog.Debugf("Event leaving node : ko (failed filter)")
+				return false, nil
+			}
+		default:
+			clog.Warningf("Expr '%s' returned non-bool, abort : %T", n.Filter, output)
+			clog.Debugf("Event leaving node : ko")
+			return false, nil
+		}
+		NodeState = true
+	} else {
+		clog.Tracef("Node has not filter, enter")
+		NodeState = true
 	}
 
-	return true, nil
-}
-
-func (n *Node) processWhitelist(cachedExprEnv map[string]interface{}, p *types.Event) (bool, error) {
-	var exprErr error
-
+	if n.Name != "" {
+		NodesHits.With(prometheus.Labels{"source": p.Line.Src, "type": p.Line.Module, "name": n.Name}).Inc()
+	}
+	exprErr := error(nil)
 	isWhitelisted := n.CheckIPsWL(p)
 	if !isWhitelisted {
 		isWhitelisted, exprErr = n.CheckExprWL(cachedExprEnv, p)
 	}
-
 	if exprErr != nil {
 		// Previous code returned nil if there was an error, so we keep this behavior
 		return false, nil //nolint:nilerr
 	}
-
 	if isWhitelisted && !p.Whitelisted {
 		p.Whitelisted = true
 		p.WhitelistReason = n.Whitelist.Reason
@@ -192,51 +185,18 @@ func (n *Node) processWhitelist(cachedExprEnv map[string]interface{}, p *types.E
 			for k := range p.Overflow.Sources {
 				ips = append(ips, k)
 			}
-
-			n.Logger.Infof("Ban for %s whitelisted, reason [%s]", strings.Join(ips, ","), n.Whitelist.Reason)
-
+			clog.Infof("Ban for %s whitelisted, reason [%s]", strings.Join(ips, ","), n.Whitelist.Reason)
 			p.Overflow.Whitelisted = true
 		}
 	}
 
-	return isWhitelisted, nil
-}
-
-func (n *Node) process(p *types.Event, ctx UnixParserCtx, expressionEnv map[string]interface{}) (bool, error) {
-	var NodeHasOKGrok bool
-
-	clog := n.Logger
-
-	cachedExprEnv := expressionEnv
-
-	clog.Tracef("Event entering node")
-
-	NodeState, err := n.processFilter(cachedExprEnv)
-	if err != nil {
-		return false, err
-	}
-
-	if !NodeState {
-		return false, nil
-	}
-
-	if n.Name != "" {
-		NodesHits.With(prometheus.Labels{"source": p.Line.Src, "type": p.Line.Module, "name": n.Name}).Inc()
-	}
-
-	isWhitelisted, err := n.processWhitelist(cachedExprEnv, p)
-	if err != nil {
-		return false, err
-	}
-
-	// Process grok if present, should be exclusive with nodes :)
+	//Process grok if present, should be exclusive with nodes :)
 	gstr := ""
-
 	if n.Grok.RunTimeRegexp != nil {
 		clog.Tracef("Processing grok pattern : %s : %p", n.Grok.RegexpName, n.Grok.RunTimeRegexp)
-		// for unparsed, parsed etc. set sensible defaults to reduce user hassle
+		//for unparsed, parsed etc. set sensible defaults to reduce user hassle
 		if n.Grok.TargetField != "" {
-			// it's a hack to avoid using real reflect
+			//it's a hack to avoid using real reflect
 			if n.Grok.TargetField == "Line.Raw" {
 				gstr = p.Line.Raw
 			} else if val, ok := p.Parsed[n.Grok.TargetField]; ok {
@@ -251,7 +211,6 @@ func (n *Node) process(p *types.Event, ctx UnixParserCtx, expressionEnv map[stri
 				clog.Warningf("failed to run RunTimeValue : %v", err)
 				NodeState = false
 			}
-
 			switch out := output.(type) {
 			case string:
 				gstr = out
@@ -270,14 +229,12 @@ func (n *Node) process(p *types.Event, ctx UnixParserCtx, expressionEnv map[stri
 		} else {
 			groklabel = n.Grok.RegexpName
 		}
-
 		grok := n.Grok.RunTimeRegexp.Parse(gstr)
 		if len(grok) > 0 {
 			/*tag explicitly that the *current* node had a successful grok pattern. it's important to know success state*/
 			NodeHasOKGrok = true
-
 			clog.Debugf("+ Grok '%s' returned %d entries to merge in Parsed", groklabel, len(grok))
-			// We managed to grok stuff, merged into parse
+			//We managed to grok stuff, merged into parse
 			for k, v := range grok {
 				clog.Debugf("\t.Parsed['%s'] = '%s'", k, v)
 				p.Parsed[k] = v
@@ -289,37 +246,34 @@ func (n *Node) process(p *types.Event, ctx UnixParserCtx, expressionEnv map[stri
 				return false, err
 			}
 		} else {
-			// grok failed, node failed
+			//grok failed, node failed
 			clog.Debugf("+ Grok '%s' didn't return data on '%s'", groklabel, gstr)
 			NodeState = false
 		}
+
 	} else {
 		clog.Tracef("! No grok pattern : %p", n.Grok.RunTimeRegexp)
 	}
 
-	// Process the stash (data collection) if : a grok was present and succeeded, or if there is no grok
+	//Process the stash (data collection) if : a grok was present and succeeded, or if there is no grok
 	if NodeHasOKGrok || n.Grok.RunTimeRegexp == nil {
 		for idx, stash := range n.Stash {
-			var (
-				key   string
-				value string
-			)
-
+			var value string
+			var key string
 			if stash.ValueExpression == nil {
 				clog.Warningf("Stash %d has no value expression, skipping", idx)
 				continue
 			}
-
 			if stash.KeyExpression == nil {
 				clog.Warningf("Stash %d has no key expression, skipping", idx)
 				continue
 			}
-			// collect the data
+			//collect the data
 			output, err := exprhelpers.Run(stash.ValueExpression, cachedExprEnv, clog, n.Debug)
 			if err != nil {
 				clog.Warningf("Error while running stash val expression : %v", err)
 			}
-			// can we expect anything else than a string ?
+			//can we expect anything else than a string ?
 			switch output := output.(type) {
 			case string:
 				value = output
@@ -328,12 +282,12 @@ func (n *Node) process(p *types.Event, ctx UnixParserCtx, expressionEnv map[stri
 				continue
 			}
 
-			// collect the key
+			//collect the key
 			output, err = exprhelpers.Run(stash.KeyExpression, cachedExprEnv, clog, n.Debug)
 			if err != nil {
 				clog.Warningf("Error while running stash key expression : %v", err)
 			}
-			// can we expect anything else than a string ?
+			//can we expect anything else than a string ?
 			switch output := output.(type) {
 			case string:
 				key = output
@@ -345,7 +299,7 @@ func (n *Node) process(p *types.Event, ctx UnixParserCtx, expressionEnv map[stri
 		}
 	}
 
-	// Iterate on leafs
+	//Iterate on leafs
 	for _, leaf := range n.LeavesNodes {
 		ret, err := leaf.process(p, ctx, cachedExprEnv)
 		if err != nil {
@@ -353,9 +307,7 @@ func (n *Node) process(p *types.Event, ctx UnixParserCtx, expressionEnv map[stri
 			clog.Debugf("Event leaving node : ko")
 			return false, err
 		}
-
 		clog.Tracef("\tsub-node (%s) ret : %v (strategy:%s)", leaf.rn, ret, n.OnSuccess)
-
 		if ret {
 			NodeState = true
 			/* if child is successful, stop processing */
@@ -376,14 +328,12 @@ func (n *Node) process(p *types.Event, ctx UnixParserCtx, expressionEnv map[stri
 
 	clog.Tracef("State after nodes : %v", NodeState)
 
-	// grok or leafs failed, don't process statics
+	//grok or leafs failed, don't process statics
 	if !NodeState {
 		if n.Name != "" {
 			NodesHitsKo.With(prometheus.Labels{"source": p.Line.Src, "type": p.Line.Module, "name": n.Name}).Inc()
 		}
-
 		clog.Debugf("Event leaving node : ko")
-
 		return NodeState, nil
 	}
 
@@ -410,10 +360,9 @@ func (n *Node) process(p *types.Event, ctx UnixParserCtx, expressionEnv map[stri
 	if NodeState {
 		clog.Debugf("Event leaving node : ok")
 		log.Tracef("node is successful, check strategy")
-
 		if n.OnSuccess == "next_stage" {
 			idx := stageidx(p.Stage, ctx.Stages)
-			// we're at the last stage
+			//we're at the last stage
 			if idx+1 == len(ctx.Stages) {
 				clog.Debugf("node reached the last stage : %s", p.Stage)
 			} else {
@@ -426,16 +375,15 @@ func (n *Node) process(p *types.Event, ctx UnixParserCtx, expressionEnv map[stri
 	} else {
 		clog.Debugf("Event leaving node : ko")
 	}
-
 	clog.Tracef("Node successful, continue")
-
 	return NodeState, nil
 }
 
 func (n *Node) compile(pctx *UnixParserCtx, ectx EnricherCtx) error {
 	var err error
+	var valid bool
 
-	valid := false
+	valid = false
 
 	dumpr := spew.ConfigState{MaxDepth: 1, DisablePointerAddresses: true}
 	n.rn = seed.Generate()
@@ -445,11 +393,10 @@ func (n *Node) compile(pctx *UnixParserCtx, ectx EnricherCtx) error {
 	/* if the node has debugging enabled, create a specific logger with debug
 	that will be used only for processing this node ;) */
 	if n.Debug {
-		clog := log.New()
+		var clog = log.New()
 		if err = types.ConfigureLogger(clog); err != nil {
 			log.Fatalf("While creating bucket-specific logger : %s", err)
 		}
-
 		clog.SetLevel(log.DebugLevel)
 		n.Logger = clog.WithFields(log.Fields{
 			"id": n.rn,
@@ -467,7 +414,7 @@ func (n *Node) compile(pctx *UnixParserCtx, ectx EnricherCtx) error {
 
 	n.Logger.Tracef("Compiling : %s", dumpr.Sdump(n))
 
-	// compile filter if present
+	//compile filter if present
 	if n.Filter != "" {
 		n.RunTimeFilter, err = expr.Compile(n.Filter, exprhelpers.GetExprOptions(map[string]interface{}{"evt": &types.Event{}})...)
 		if err != nil {
@@ -478,15 +425,12 @@ func (n *Node) compile(pctx *UnixParserCtx, ectx EnricherCtx) error {
 	/* handle pattern_syntax and groks */
 	for _, pattern := range n.SubGroks {
 		n.Logger.Tracef("Adding subpattern '%s' : '%s'", pattern.Key, pattern.Value)
-
 		if err = pctx.Grok.Add(pattern.Key.(string), pattern.Value.(string)); err != nil {
 			if errors.Is(err, grokky.ErrAlreadyExist) {
 				n.Logger.Warningf("grok '%s' already registred", pattern.Key)
 				continue
 			}
-
 			n.Logger.Errorf("Unable to compile subpattern %s : %v", pattern.Key, err)
-
 			return err
 		}
 	}
@@ -494,36 +438,28 @@ func (n *Node) compile(pctx *UnixParserCtx, ectx EnricherCtx) error {
 	/* load grok by name or compile in-place */
 	if n.Grok.RegexpName != "" {
 		n.Logger.Tracef("+ Regexp Compilation '%s'", n.Grok.RegexpName)
-
 		n.Grok.RunTimeRegexp, err = pctx.Grok.Get(n.Grok.RegexpName)
 		if err != nil {
 			return fmt.Errorf("unable to find grok '%s' : %v", n.Grok.RegexpName, err)
 		}
-
 		if n.Grok.RunTimeRegexp == nil {
 			return fmt.Errorf("empty grok '%s'", n.Grok.RegexpName)
 		}
-
 		n.Logger.Tracef("%s regexp: %s", n.Grok.RegexpName, n.Grok.RunTimeRegexp.String())
-
 		valid = true
 	} else if n.Grok.RegexpValue != "" {
 		if strings.HasSuffix(n.Grok.RegexpValue, "\n") {
 			n.Logger.Debugf("Beware, pattern ends with \\n : '%s'", n.Grok.RegexpValue)
 		}
-
 		n.Grok.RunTimeRegexp, err = pctx.Grok.Compile(n.Grok.RegexpValue)
 		if err != nil {
 			return fmt.Errorf("failed to compile grok '%s': %v", n.Grok.RegexpValue, err)
 		}
-
 		if n.Grok.RunTimeRegexp == nil {
 			// We shouldn't be here because compilation succeeded, so regexp shouldn't be nil
 			return fmt.Errorf("grok compilation failure: %s", n.Grok.RegexpValue)
 		}
-
 		n.Logger.Tracef("%s regexp : %s", n.Grok.RegexpValue, n.Grok.RunTimeRegexp.String())
-
 		valid = true
 	}
 
@@ -537,7 +473,7 @@ func (n *Node) compile(pctx *UnixParserCtx, ectx EnricherCtx) error {
 	}
 
 	/* load grok statics */
-	// compile expr statics if present
+	//compile expr statics if present
 	for idx := range n.Grok.Statics {
 		if n.Grok.Statics[idx].ExpValue != "" {
 			n.Grok.Statics[idx].RunTimeValue, err = expr.Compile(n.Grok.Statics[idx].ExpValue,
@@ -546,7 +482,6 @@ func (n *Node) compile(pctx *UnixParserCtx, ectx EnricherCtx) error {
 				return err
 			}
 		}
-
 		valid = true
 	}
 
@@ -570,7 +505,7 @@ func (n *Node) compile(pctx *UnixParserCtx, ectx EnricherCtx) error {
 		}
 
 		logLvl := n.Logger.Logger.GetLevel()
-		// init the cache, does it make sense to create it here just to be sure everything is fine ?
+		//init the cache, does it make sense to create it here just to be sure everything is fine ?
 		if err = cache.CacheInit(cache.CacheCfg{
 			Size:     n.Stash[i].MaxMapSize,
 			TTL:      n.Stash[i].TTLVal,
@@ -591,18 +526,14 @@ func (n *Node) compile(pctx *UnixParserCtx, ectx EnricherCtx) error {
 		if !n.LeavesNodes[idx].Debug && n.Debug {
 			n.LeavesNodes[idx].Debug = true
 		}
-
 		if !n.LeavesNodes[idx].Profiling && n.Profiling {
 			n.LeavesNodes[idx].Profiling = true
 		}
-
 		n.LeavesNodes[idx].Stage = n.Stage
-
 		err = n.LeavesNodes[idx].compile(pctx, ectx)
 		if err != nil {
 			return err
 		}
-
 		valid = true
 	}
 
@@ -615,7 +546,6 @@ func (n *Node) compile(pctx *UnixParserCtx, ectx EnricherCtx) error {
 				return err
 			}
 		}
-
 		valid = true
 	}
 
@@ -624,15 +554,13 @@ func (n *Node) compile(pctx *UnixParserCtx, ectx EnricherCtx) error {
 	if err != nil {
 		return err
 	}
-
 	valid = valid || whitelistValid
 
 	if !valid {
 		/* node is empty, error force return */
 		n.Logger.Error("Node is empty or invalid, abort")
 		n.Stage = ""
-
-		return errors.New("Node is empty")
+		return fmt.Errorf("Node is empty")
 	}
 
 	if err := n.validate(pctx, ectx); err != nil {

pkg/parser/whitelist_test.go

@@ -62,7 +62,6 @@ func TestWhitelistCompile(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			node.Whitelist = tt.whitelist
 			_, err := node.CompileWLs()
@@ -284,7 +283,6 @@ func TestWhitelistCheck(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var err error
 			node.Whitelist = tt.whitelist

pkg/setup/detect_test.go

@@ -94,7 +94,6 @@ func TestPathExists(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		env := setup.NewExprEnvironment(setup.DetectOptions{}, setup.ExprOS{})
 
 		t.Run(tc.path, func(t *testing.T) {
@@ -147,7 +146,6 @@ func TestVersionCheck(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		e := setup.ExprOS{RawVersion: tc.version}
 
 		t.Run(fmt.Sprintf("Check(%s,%s)", tc.version, tc.constraint), func(t *testing.T) {
@@ -246,7 +244,6 @@ func TestListSupported(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			f := tempYAML(t, tc.yml)
@@ -329,7 +326,6 @@ func TestApplyRules(t *testing.T) {
 	env := setup.ExprEnvironment{}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			svc := setup.Service{When: tc.rules}
@@ -419,7 +415,6 @@ detect:
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			f := tempYAML(t, tc.config)
 			defer os.Remove(f.Name())
@@ -513,7 +508,6 @@ detect:
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			f := tempYAML(t, tc.config)
 			defer os.Remove(f.Name())
@@ -825,7 +819,6 @@ func TestDetectForcedOS(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			f := tempYAML(t, tc.config)
 			defer os.Remove(f.Name())
@@ -1011,7 +1004,6 @@ func TestDetectDatasourceValidation(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			f := tempYAML(t, tc.config)
 			defer os.Remove(f.Name())

pkg/types/event_test.go

@@ -41,7 +41,6 @@ func TestSetParsed(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			tt.evt.SetParsed(tt.key, tt.value)
 			assert.Equal(t, tt.value, tt.evt.Parsed[tt.key])
@@ -82,7 +81,6 @@ func TestSetMeta(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			tt.evt.SetMeta(tt.key, tt.value)
 			assert.Equal(t, tt.value, tt.evt.GetMeta(tt.key))
@@ -152,7 +150,6 @@ func TestParseIPSources(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ips := tt.evt.ParseIPSources()
 			assert.Equal(t, tt.expected, ips)