From d3ea62a8ce35ab180d42c9ea1a9dbc221569435d Mon Sep 17 00:00:00 2001
From: Dante Catalfamo <43040593+dantecatalfamo@users.noreply.github.com>
Date: Thu, 16 Jan 2025 10:08:52 -0500
Subject: [PATCH] Address double json-unmarshal in note (#25454)

#24390

Add a comment to provide context on why it's done this way, and a
suggestion to revisit it once the new `json/v2` is released
---
 server/service/osquery.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/server/service/osquery.go b/server/service/osquery.go
index 403af5fcad..07e63c999d 100644
--- a/server/service/osquery.go
+++ b/server/service/osquery.go
@@ -2226,6 +2226,10 @@ func submitLogsEndpoint(ctx context.Context, request interface{}, svc fleet.Serv
 		}
 
 	case "result":
+		// NOTE(dantecatalfamo) We partially unmarshal the data here because osquery can send data we don't
+		// support unmarshaling, like differential query results. We also pass the raw data to logging
+		// facilities further down. Results are unmarshaled one at a time inside of SubmitResultLogs.
+		// We should re-address this once json/v2 releases and we can speed up parsing times.
 		var results []json.RawMessage
 		// NOTE(lucas): This unmarshal error is not being sent back to osquery (`if err :=` vs. `if err =`)
 		// Maybe there's a reason for it, we need to test such a change before fixing what appears