diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index b649d7950dc9..283af29fde68 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -278,6 +278,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff] - Update CEL mito extensions to v1.15.0. {pull}40294[40294] - Allow cross-region bucket configuration in s3 input. {issue}22161[22161] {pull}40309[40309] - Improve logging in Okta Entity Analytics provider. {issue}40106[40106] {pull}40347[40347] +- Improve error quality when CEL program does not correctly return an events array. {pull}[] *Auditbeat* diff --git a/x-pack/filebeat/input/cel/input.go b/x-pack/filebeat/input/cel/input.go index 99d5cfad7889..2096383de392 100644 --- a/x-pack/filebeat/input/cel/input.go +++ b/x-pack/filebeat/input/cel/input.go @@ -366,9 +366,7 @@ func (i input) run(env v2.Context, src *source, cursor map[string]interface{}, p e, ok := state["events"] if !ok { - log.Error("unexpected missing events array from evaluation") - env.UpdateStatus(status.Degraded, "unexpected missing events array from evaluation") - isDegraded = true + return errors.New("unexpected missing events array from evaluation") } var events []interface{} switch e := e.(type) {