From 135bc713a08121e7d542cc6cfd325dfaccd17a78 Mon Sep 17 00:00:00 2001 From: Dmitri Dolguikh Date: Wed, 1 Jul 2026 14:43:11 +0200 Subject: [PATCH] force setting non-empty rule id on aggregated events Signed-off-by: Dmitri Dolguikh --- client/internal/netflow/store/memory.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/client/internal/netflow/store/memory.go b/client/internal/netflow/store/memory.go index aba2c6e48..0343b15c8 100644 --- a/client/internal/netflow/store/memory.go +++ b/client/internal/netflow/store/memory.go @@ -145,6 +145,9 @@ func (am *AggregatingMemory) GetAggregatedEvents() []*types.Event { aggregatedEvent.ID = v.ID aggregatedEvent.SourcePort = v.SourcePort } + if len(aggregatedEvent.RuleID) == 0 && len(v.RuleID) != 0 { + aggregatedEvent.RuleID = slices.Clone(v.RuleID) + } } return slices.Collect(maps.Values(aggregated)) // could return an iterator instead here