fix: error processing event (#3238)

Co-authored-by: Tal <tal@keephq.dev>

keep/api/bl/maintenance_windows_bl.py

@@ -72,10 +72,19 @@ def check_if_alert_in_maintenance_windows(self, alert: AlertDto) -> bool:
             try:
                 cel_result = prgm.evaluate(activation)
             except celpy.evaluation.CELEvalError as e:
-                if "no such member" in str(e):
+                error_msg = str(e).lower()
+                if "no such member" in error_msg or "undeclared reference" in error_msg:
+                    self.logger.debug(
+                        f"Skipping maintenance window rule due to missing field: {str(e)}",
+                        extra={**extra, "maintenance_rule_id": maintenance_rule.id},
+                    )
                     continue
-                # wtf
-                raise
+                # Log unexpected CEL errors but don't fail the entire event processing
+                self.logger.error(
+                    f"Unexpected CEL evaluation error: {str(e)}",
+                    extra={**extra, "maintenance_rule_id": maintenance_rule.id},
+                )
+                continue
             if cel_result:
                 self.logger.info(
                     "Alert is in maintenance window",

tests/test_maintenance_windows_bl.py

@@ -182,3 +182,19 @@ def test_alert_ignored_due_to_acknowledged_status(
 
     # Should return False because the alert status is ACKNOWLEDGED
     assert result is False
+
+
+def test_alert_with_missing_cel_field(mock_session, active_maintenance_window_rule, alert_dto):
+    # Modify the cel_query to reference a non-existent field
+    active_maintenance_window_rule.cel_query = 'alertname == "test-alert"'
+    mock_session.query.return_value.filter.return_value.filter.return_value.filter.return_value.all.return_value = [
+        active_maintenance_window_rule
+    ]
+
+    maintenance_window_bl = MaintenanceWindowsBl(
+        tenant_id="test-tenant", session=mock_session
+    )
+    result = maintenance_window_bl.check_if_alert_in_maintenance_windows(alert_dto)
+
+    # Should return False because the field doesn't exist
+    assert result is False