diff --git a/rust/src/events/serialize.rs b/rust/src/events/serialize.rs index a15d5c5953..fe488f525f 100644 --- a/rust/src/events/serialize.rs +++ b/rust/src/events/serialize.rs @@ -468,15 +468,21 @@ fn serialize_event_value( Value::String(event.event_id().to_owned()), ); - // age_ts -> age - if let Some(Value::Object(unsigned)) = d.get_mut(UNSIGNED) { - if let Some(age_ts) = unsigned.get(unsigned_field::AGE_TS).and_then(Value::as_i64) { - unsigned.insert( - unsigned_field::AGE.to_owned(), - Value::Number(Number::from(time_now_ms - age_ts)), - ); - unsigned.remove(unsigned_field::AGE_TS); - } + // Replace `age_ts` with `age`, with `age` calculated as the difference + // between the current time and `age_ts`. This is an optional field in the + // spec. + // + // We might not have an `age_ts`, e.g. if a remote server did not include + // the `age` field in the event it sent us. Since `age_ts` is generated by + // us it *should* be an integer, but it is possible for it to be out of i64 + // range. In that case, just omit `age` rather than erroring. + let unsigned = unsigned_mut(&mut d); + if let Some(age_ts) = unsigned.get(unsigned_field::AGE_TS).and_then(Value::as_i64) { + unsigned.insert( + unsigned_field::AGE.to_owned(), + Value::Number(Number::from(time_now_ms - age_ts)), + ); + unsigned.remove(unsigned_field::AGE_TS); } // Include the transaction_id / delay_id in the unsigned section if the event