diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 832d3f6a99e..8b38cebce6f 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -296,6 +296,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff] - Add new metricset cluster for the vSphere module. {pull}40536[40536] - Disable event normalization for netflow input {pull}40635[40635] - Allow attribute selection in the Active Directory entity analytics provider. {issue}40482[40482] {pull}40662[40662] +- Improve error quality when CEL program does not correctly return an events array. {pull}40580[40580] *Auditbeat* diff --git a/x-pack/filebeat/input/cel/input.go b/x-pack/filebeat/input/cel/input.go index 99d5cfad788..2096383de39 100644 --- a/x-pack/filebeat/input/cel/input.go +++ b/x-pack/filebeat/input/cel/input.go @@ -366,9 +366,7 @@ func (i input) run(env v2.Context, src *source, cursor map[string]interface{}, p e, ok := state["events"] if !ok { - log.Error("unexpected missing events array from evaluation") - env.UpdateStatus(status.Degraded, "unexpected missing events array from evaluation") - isDegraded = true + return errors.New("unexpected missing events array from evaluation") } var events []interface{} switch e := e.(type) {