Skip to content

Commit 8a21d2f

Browse files
robbaveyrobbavey
committed
More test fixes
1 parent b56b87c commit 8a21d2f

File tree

1 file changed

+70
-38
lines changed

1 file changed

+70
-38
lines changed

‎spec/filters/grok_spec.rb‎

Lines changed: 70 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -32,58 +32,90 @@ def self.sample(message, &block)
3232
context "in ecs mode disabled" do
3333
let(:config) { super().merge('ecs_compatibility' => 'disabled') }
3434

35-
it "matches pattern" do
36-
expect( event.get("tags") ).to be nil
37-
expect( event.get("timestamp") ).to eql "Mar 16 00:01:25"
38-
expect( event.get("logsource") ).to eql "evita"
39-
expect( event.get("program") ).to eql "postfix/smtpd"
40-
expect( event.get("pid") ).to eql "1713"
41-
expect( event.get("message") ).to eql "connect from camomile.cloud9.net[168.100.1.3]"
42-
end
43-
end
35+
context 'when overwriting message' do
36+
let(:config) { super().merge("overwrite" => [ "message" ]) }
4437

38+
it "matches pattern" do
39+
expect( event.get("tags") ).to be nil
40+
expect( event.get("logsource") ).to eql "evita"
41+
expect( event.get("timestamp") ).to eql "Mar 16 00:01:25"
42+
expect( event.get("message") ).to eql "connect from camomile.cloud9.net[168.100.1.3]"
43+
expect( event.get("program") ).to eql "postfix/smtpd"
44+
expect( event.get("pid") ).to eql "1713"
45+
end
46+
end
4547

46-
%w(v1 v8).each do |ecs_mode|
47-
context "in ecs mode #{ecs_mode}" do
48-
let(:config) { super().merge('ecs_compatibility' => ecs_mode) }
48+
context 'with target' do
49+
let(:config) { super().merge("target" => "grok") }
4950

5051
it "matches pattern" do
51-
expect( event.get("host") ).to eql "hostname"=>"evita"
52-
expect( event.get("process") ).to eql "name"=>"postfix/smtpd", "pid"=>1713
53-
expect( event.get("message") ).to eql "connect from camomile.cloud9.net[168.100.1.3]"
52+
expect( event.get("message") ).to eql message
53+
expect( event.get("tags") ).to be nil
54+
expect( event.get("grok") ).to_not be nil
55+
expect( event.get("[grok][timestamp]") ).to eql "Mar 16 00:01:25"
56+
expect( event.get("[grok][message]") ).to eql "connect from camomile.cloud9.net[168.100.1.3]"
57+
expect( event.get("[grok][pid]") ).to eql "1713"
5458
end
5559
end
56-
end
5760

58-
context 'with target' do
59-
let(:config) { { "match" => { "message" => "%{SYSLOGLINE}" }, "target" => "grok" } }
61+
context 'with [deep] target' do
62+
let(:config) { super().merge("target" => "[@metadata][grok]") }
6063

61-
it "matches pattern" do
62-
expect( event.get("message") ).to eql message
63-
expect( event.get("tags") ).to be nil
64-
expect( event.get("grok") ).to_not be nil
65-
expect( event.get("[grok][timestamp]") ).to eql "Mar 16 00:01:25"
66-
expect( event.get("[grok][message]") ).to eql "connect from camomile.cloud9.net[168.100.1.3]"
67-
expect( event.get("[grok][process][pid]") ).to eql 1713
64+
it "matches pattern" do
65+
expect( event.get("message") ).to eql message
66+
expect( event.get("tags") ).to be nil
67+
expect( event.get("grok") ).to be nil
68+
expect( event.get("[@metadata][grok][logsource]") ).to eql "evita"
69+
expect( event.get("[@metadata][grok][message]") ).to eql "connect from camomile.cloud9.net[168.100.1.3]"
70+
end
6871
end
6972
end
7073

71-
context 'with [deep] target' do
72-
let(:config) { { "match" => { "message" => "%{SYSLOGLINE}" }, "target" => "[@metadata][grok]" } }
74+
%w(v1 v8).each do |ecs_mode|
75+
context "in ecs mode #{ecs_mode}" do
76+
let(:config) { super().merge('ecs_compatibility' => ecs_mode) }
7377

74-
it "matches pattern" do
75-
expect( event.get("message") ).to eql message
76-
expect( event.get("tags") ).to be nil
77-
expect( event.get("grok") ).to be nil
78-
expect( event.get("[@metadata][grok][host][hostname]") ).to eql "evita"
79-
expect( event.get("[@metadata][grok][message]") ).to eql "connect from camomile.cloud9.net[168.100.1.3]"
78+
context 'when overwriting message' do
79+
let(:config) { super().merge("overwrite" => [ "message" ]) }
80+
81+
it "matches pattern" do
82+
expect( event.get("host") ).to eql "hostname"=>"evita"
83+
expect( event.get("process") ).to eql "name"=>"postfix/smtpd", "pid"=>1713
84+
expect( event.get("message") ).to eql "connect from camomile.cloud9.net[168.100.1.3]"
85+
end
86+
end
87+
88+
context 'with target' do
89+
let(:config) { super().merge("target" => "grok") }
90+
91+
it "matches pattern" do
92+
expect( event.get("message") ).to eql message
93+
expect( event.get("tags") ).to be nil
94+
expect( event.get("grok") ).to_not be nil
95+
expect( event.get("[grok][timestamp]") ).to eql "Mar 16 00:01:25"
96+
expect( event.get("[grok][message]") ).to eql "connect from camomile.cloud9.net[168.100.1.3]"
97+
expect( event.get("[grok][process][pid]") ).to eql 1713
98+
end
99+
end
100+
101+
context 'with [deep] target' do
102+
let(:config) { super().merge("target" => "[@metadata][grok]") }
103+
104+
it "matches pattern" do
105+
expect( event.get("message") ).to eql message
106+
expect( event.get("tags") ).to be nil
107+
expect( event.get("grok") ).to be nil
108+
expect( event.get("[@metadata][grok][host][hostname]") ).to eql "evita"
109+
expect( event.get("[@metadata][grok][message]") ).to eql "connect from camomile.cloud9.net[168.100.1.3]"
110+
end
111+
end
80112
end
81113
end
114+
82115
end
83116

84-
%w(disabled).each do |ecs_mode|
85-
describe "ietf 5424 syslog line" do
86-
let(:config) { { 'ecs_compatibility' => ecs_mode, "match" => { "message" => "%{SYSLOG5424LINE}" } } }
117+
describe "ietf 5424 syslog line - ecs mode disabled" do
118+
let(:config) { { 'ecs_compatibility' => 'disabled', "match" => { "message" => "%{SYSLOG5424LINE}" } } }
87119

88120
sample "<191>1 2009-06-30T18:30:00+02:00 paxton.local grokdebug 4123 - [id1 foo=\"bar\"][id2 baz=\"something\"] Hello, syslog." do
89121
expect( event.get("tags") ).to be nil
@@ -191,10 +223,10 @@ def self.sample(message, &block)
191223
expect( event.get("syslog5424_sd") ).to be nil
192224
expect( event.get("syslog5424_msg") ).to eql "Appname is nil"
193225
end
194-
end
195226
end
227+
196228
%w(v1 v8).each do |ecs_mode|
197-
describe "ietf 5424 syslog line" do
229+
describe "ietf 5424 syslog line - ecs_mode #{ecs_mode}" do
198230
let(:config) { { "overwrite" => [ "message" ], 'ecs_compatibility' => ecs_mode, "match" => { "message" => "%{SYSLOG5424LINE}" } } }
199231

200232
sample "<191>1 2009-06-30T18:30:00+02:00 paxton.local grokdebug 4123 - [id1 foo=\"bar\"][id2 baz=\"something\"] Hello, syslog." do

0 commit comments

Comments
 (0)