logstash-core 1.5.0.rc3.snapshot6-java → 1.5.0.rc4-java

data/spec/core/config_mixin_spec.rb

@@ -0,0 +1,99 @@
+require "spec_helper"
+require "logstash/config/mixin"
+
+describe LogStash::Config::Mixin do
+  context "when validating :bytes successfully" do
+    subject do
+      local_num_bytes = num_bytes # needs to be locally scoped :(
+      Class.new(LogStash::Filters::Base) do
+        include LogStash::Config::Mixin
+        config_name "test"
+        milestone 1
+        config :size_bytes, :validate => :bytes
+        config :size_default, :validate => :bytes, :default => "#{local_num_bytes}"
+        config :size_upcase, :validate => :bytes
+        config :size_downcase, :validate => :bytes
+        config :size_space, :validate => :bytes
+      end.new({
+        "size_bytes" => "#{local_num_bytes}",
+        "size_upcase" => "#{local_num_bytes}KiB".upcase,
+        "size_downcase" => "#{local_num_bytes}KiB".downcase,
+        "size_space" => "#{local_num_bytes} KiB"
+      })
+    end
+
+    let!(:num_bytes) { rand(1000) }
+    let!(:num_kbytes) { num_bytes * 1024 }
+
+    it "should validate :bytes successfully with no units" do
+      expect(subject.size_bytes).to eq(num_bytes)
+    end
+
+    it "should allow setting valid default" do
+      expect(subject.size_default).to eq(num_bytes)
+    end
+
+    it "should be case-insensitive when parsing units" do
+      expect(subject.size_upcase).to eq(num_kbytes)
+      expect(subject.size_downcase).to eq(num_kbytes)
+    end
+
+    it "should accept one space between num_bytes and unit suffix" do
+      expect(subject.size_space).to eq(num_kbytes)
+    end
+  end
+
+  context "when raising configuration errors while validating" do
+    it "should raise configuration error when provided with invalid units" do
+      expect {
+        Class.new(LogStash::Filters::Base) do
+          include LogStash::Config::Mixin
+          config_name "test"
+          milestone 1
+          config :size_file, :validate => :bytes
+        end.new({"size_file" => "10 yolobytes"})
+      }.to raise_error(LogStash::ConfigurationError)
+    end
+
+    it "should raise configuration error when provided with too many spaces" do
+      expect {
+        Class.new(LogStash::Filters::Base) do
+          include LogStash::Config::Mixin
+          config_name "test"
+          milestone 1
+          config :size_file, :validate => :bytes
+        end.new({"size_file" => "10  kib"})
+      }.to raise_error(LogStash::ConfigurationError)
+    end
+  end
+
+  context "when validating :password" do
+    let(:klass) do
+      Class.new(LogStash::Filters::Base)  do
+        config_name "fake"
+        config :password, :validate => :password
+      end
+    end
+
+    let(:secret) { "fancy pants" }
+    subject { klass.new("password" => secret) }
+
+    it "should be a Password object" do
+      expect(subject.password).to(be_a(LogStash::Util::Password))
+    end
+
+    it "should make password values hidden" do
+      expect(subject.password.to_s).to(be == "<password>")
+      expect(subject.password.inspect).to(be == "<password>")
+    end
+
+    it "should show password values via #value" do
+      expect(subject.password.value).to(be == secret)
+    end
+
+    it "should correctly copy password types" do
+      clone = subject.class.new(subject.params)
+      expect(clone.password.value).to(be == secret)
+    end
+  end
+end

data/spec/core/config_spec.rb

@@ -0,0 +1,108 @@
+# encoding: utf-8
+# config syntax tests
+#
+require "spec_helper"
+require "logstash/config/grammar"
+require "logstash/config/config_ast"
+
+describe LogStashConfigParser do
+  context '#parse' do
+    context "valid configuration" do
+      it "should permit single-quoted attribute names" do
+        parser = LogStashConfigParser.new
+        config = parser.parse(%q(
+          input {
+            example {
+              'foo' => 'bar'
+              test => { 'bar' => 'baz' }
+            }
+          }
+          ))
+
+        expect(config).not_to be_nil
+      end
+
+      it "should permit empty plugin sections" do
+        parser = LogStashConfigParser.new
+        config = parser.parse(%q(
+          filter {
+          }
+          ))
+
+        expect(config).not_to be_nil
+      end
+
+      it 'permits hash to contains array' do
+        parser = LogStashConfigParser.new
+        config = parser.parse(%q(
+          input{
+            example {
+              match => {
+                "message"=> ["pattern1", "pattern2", "pattern3"]
+              }
+            }
+          }))
+        expect(config).not_to be_nil
+      end
+    end
+  end
+
+  context "#compile" do
+    context "invalid configuration" do
+      it "rejects duplicate hash key" do
+        parser = LogStashConfigParser.new
+        config = parser.parse(%q(
+          input {
+            example {
+              match => {
+                "message"=> "pattern1"
+                "message"=> "pattern2"
+                "message"=> "pattern3"
+              }
+            }
+          }
+        ))
+
+        expect { config.compile }.to raise_error(LogStash::ConfigurationError, /Duplicate keys found in your configuration: \["message"\]/)
+      end
+
+      it "rejects duplicate keys in nested hash" do
+        parser = LogStashConfigParser.new
+        config = parser.parse(%q(
+          input {
+            example {
+              match => {
+                "message"=> "pattern1"
+                "more" => {
+                  "cool" => true
+                  "cool" => true
+                }
+              }
+            }
+          }
+        ))
+
+        expect { config.compile }.to raise_error(LogStash::ConfigurationError, /Duplicate keys found in your configuration: \["cool"\]/)
+      end
+
+      it "rejects a key with multiple double quotes" do
+        parser = LogStashConfigParser.new
+        config = parser.parse(%q(
+          input {
+            example {
+              match => {
+                "message"=> "pattern1"
+                ""more"" => {
+                  "cool" => true
+                  "cool" => true
+                }
+              }
+            }
+          }
+        ))
+
+        expect(config).to be_nil
+      end
+    end
+  end
+end

data/spec/core/environment_spec.rb

@@ -0,0 +1,44 @@
+require "spec_helper"
+require "logstash/environment"
+
+describe LogStash::Environment do
+
+  context "when loading jars dependencies" do
+
+    let(:default_jars_location)    { File.join("vendor", "jar-dependencies") }
+    let(:default_runtime_location) { File.join(default_jars_location,"runtime-jars","*.jar") }
+    let(:default_test_location)    { File.join(default_jars_location,"test-jars","*.jar") }
+
+    it "raises an exception if jruby is not available" do
+      expect(subject).to receive(:jruby?).and_return(false)
+      expect { subject.load_runtime_jars! }.to raise_error
+    end
+
+    it "find runtime jars in the default location" do
+      expect(subject).to receive(:find_jars).with(default_runtime_location).and_return([])
+      subject.load_runtime_jars!
+    end
+
+    it "find test jars in the default location" do
+      expect(subject).to receive(:find_jars).with(default_test_location).and_return([])
+      subject.load_test_jars!
+    end
+
+    context "when loading a jar file" do
+
+      let(:dummy_jar_file) { File.join(default_jars_location,"runtime-jars","elasticsearch.jar") }
+
+      it "requires the jar files if there are jars to load" do
+        expect(subject).to receive(:find_jars).with(default_runtime_location).and_return([dummy_jar_file])
+        expect(subject).to receive(:require).with(dummy_jar_file)
+        subject.load_runtime_jars!
+      end
+
+      it "raises an exception if there are no jars to load" do
+        allow(Dir).to receive(:glob).and_return([])
+        expect { subject.load_runtime_jars! }.to raise_error
+      end
+
+    end
+  end
+end

data/spec/core/event_spec.rb

@@ -0,0 +1,468 @@
+# encoding: utf-8
+require "spec_helper"
+
+describe LogStash::Event do
+
+  shared_examples "all event tests" do
+    context "[]=" do
+      it "should raise an exception if you attempt to set @timestamp to a value type other than a Time object" do
+        expect{subject["@timestamp"] = "crash!"}.to raise_error(TypeError)
+      end
+
+      it "should assign simple fields" do
+        expect(subject["foo"]).to be_nil
+        expect(subject["foo"] = "bar").to eq("bar")
+        expect(subject["foo"]).to eq("bar")
+      end
+
+      it "should overwrite simple fields" do
+        expect(subject["foo"]).to be_nil
+        expect(subject["foo"] = "bar").to eq("bar")
+        expect(subject["foo"]).to eq("bar")
+
+        expect(subject["foo"] = "baz").to eq("baz")
+        expect(subject["foo"]).to eq("baz")
+      end
+
+      it "should assign deep fields" do
+        expect(subject["[foo][bar]"]).to be_nil
+        expect(subject["[foo][bar]"] = "baz").to eq("baz")
+        expect(subject["[foo][bar]"]).to eq("baz")
+      end
+
+      it "should overwrite deep fields" do
+        expect(subject["[foo][bar]"]).to be_nil
+        expect(subject["[foo][bar]"] = "baz").to eq("baz")
+        expect(subject["[foo][bar]"]).to eq("baz")
+
+        expect(subject["[foo][bar]"] = "zab").to eq("zab")
+        expect(subject["[foo][bar]"]).to eq("zab")
+      end
+    end
+
+    context "#sprintf" do
+      it "should report a unix timestamp for %{+%s}" do
+        expect(subject.sprintf("%{+%s}")).to eq("1356998400")
+      end
+
+      it "should raise error when formatting %{+%s} when @timestamp field is missing" do
+        str = "hello-%{+%s}"
+        subj = subject.clone
+        subj.remove("[@timestamp]")
+        expect{ subj.sprintf(str) }.to raise_error(LogStash::Error)
+      end
+
+      it "should report a time with %{+format} syntax", :if => RUBY_ENGINE == "jruby" do
+        expect(subject.sprintf("%{+YYYY}")).to eq("2013")
+        expect(subject.sprintf("%{+MM}")).to eq("01")
+        expect(subject.sprintf("%{+HH}")).to eq("00")
+      end
+
+      it "should raise error with %{+format} syntax when @timestamp field is missing", :if => RUBY_ENGINE == "jruby" do
+        str = "logstash-%{+YYYY}"
+        subj = subject.clone
+        subj.remove("[@timestamp]")
+        expect{ subj.sprintf(str) }.to raise_error(LogStash::Error)
+      end
+
+      it "should report fields with %{field} syntax" do
+        expect(subject.sprintf("%{type}")).to eq("sprintf")
+        expect(subject.sprintf("%{message}")).to eq(subject["message"])
+      end
+
+      it "should print deep fields" do
+        expect(subject.sprintf("%{[j][k1]}")).to eq("v")
+        expect(subject.sprintf("%{[j][k2][0]}")).to eq("w")
+      end
+
+      it "should be able to take a non-string for the format" do
+        expect(subject.sprintf(2)).to eq("2")
+      end
+
+      it "should allow to use the metadata when calling #sprintf" do
+        expect(subject.sprintf("super-%{[@metadata][fancy]}")).to eq("super-pants")
+      end
+
+      it "should allow to use nested hash from the metadata field" do
+        expect(subject.sprintf("%{[@metadata][have-to-go][deeper]}")).to eq("inception")
+      end
+    end
+
+    context "#[]" do
+      it "should fetch data" do
+        expect(subject["type"]).to eq("sprintf")
+      end
+      it "should fetch fields" do
+        expect(subject["a"]).to eq("b")
+        expect(subject['c']['d']).to eq("f")
+      end
+      it "should fetch deep fields" do
+        expect(subject["[j][k1]"]).to eq("v")
+        expect(subject["[c][d]"]).to eq("f")
+        expect(subject['[f][g][h]']).to eq("i")
+        expect(subject['[j][k3][4]']).to eq("m")
+        expect(subject['[j][5]']).to eq(7)
+
+      end
+
+      it "should be fast?", :performance => true do
+        count = 1000000
+        2.times do
+          start = Time.now
+          count.times { subject["[j][k1]"] }
+          duration = Time.now - start
+          puts "event #[] rate: #{"%02.0f/sec" % (count / duration)}, elapsed: #{duration}s"
+        end
+      end
+    end
+
+    context "#include?" do
+      it "should include existing fields" do
+        expect(subject.include?("c")).to be_true
+        expect(subject.include?("[c][d]")).to be_true
+        expect(subject.include?("[j][k4][0][nested]")).to be_true
+      end
+
+      it "should include field with nil value" do
+        expect(subject.include?("nilfield")).to be_true
+      end
+
+      it "should include @metadata field" do
+        expect(subject.include?("@metadata")).to be_true
+      end
+
+      it "should include field within @metadata" do
+        expect(subject.include?("[@metadata][fancy]")).to be_true
+      end
+
+      it "should not include non-existing fields" do
+        expect(subject.include?("doesnotexist")).to be_false
+        expect(subject.include?("[j][doesnotexist]")).to be_false
+        expect(subject.include?("[tag][0][hello][yes]")).to be_false
+      end
+
+      it "should include within arrays" do
+        expect(subject.include?("[tags][0]")).to be_true
+        expect(subject.include?("[tags][1]")).to be_false
+      end
+    end
+
+    context "#overwrite" do
+      it "should swap data with new content" do
+        new_event = LogStash::Event.new(
+          "type" => "new",
+          "message" => "foo bar",
+        )
+        subject.overwrite(new_event)
+
+        expect(subject["message"]).to eq("foo bar")
+        expect(subject["type"]).to eq("new")
+
+        ["tags", "source", "a", "c", "f", "j"].each do |field|
+          expect(subject[field]).to be_nil
+        end
+      end
+    end
+
+    context "#append" do
+      it "should append strings to an array" do
+        subject.append(LogStash::Event.new("message" => "another thing"))
+        expect(subject["message"]).to eq([ "hello world", "another thing" ])
+      end
+
+      it "should concatenate tags" do
+        subject.append(LogStash::Event.new("tags" => [ "tag2" ]))
+        # added to_a for when array is a Java Collection when produced from json input
+        # TODO: we have to find a better way to handle this in tests. maybe override
+        # rspec eq or == to do an explicit to_a when comparing arrays?
+        expect(subject["tags"].to_a).to eq([ "tag1", "tag2" ])
+      end
+
+      context "when event field is nil" do
+        it "should add single value as string" do
+          subject.append(LogStash::Event.new({"field1" => "append1"}))
+          expect(subject[ "field1" ]).to eq("append1")
+        end
+        it "should add multi values as array" do
+          subject.append(LogStash::Event.new({"field1" => [ "append1","append2" ]}))
+          expect(subject[ "field1" ]).to eq([ "append1","append2" ])
+        end
+      end
+
+      context "when event field is a string" do
+        before { subject[ "field1" ] = "original1" }
+
+        it "should append string to values, if different from current" do
+          subject.append(LogStash::Event.new({"field1" => "append1"}))
+          expect(subject[ "field1" ]).to eq([ "original1", "append1" ])
+        end
+        it "should not change value, if appended value is equal current" do
+          subject.append(LogStash::Event.new({"field1" => "original1"}))
+          expect(subject[ "field1" ]).to eq("original1")
+        end
+        it "should concatenate values in an array" do
+          subject.append(LogStash::Event.new({"field1" => [ "append1" ]}))
+          expect(subject[ "field1" ]).to eq([ "original1", "append1" ])
+        end
+        it "should join array, removing duplicates" do
+          subject.append(LogStash::Event.new({"field1" => [ "append1","original1" ]}))
+          expect(subject[ "field1" ]).to eq([ "original1", "append1" ])
+        end
+      end
+      context "when event field is an array" do
+        before { subject[ "field1" ] = [ "original1", "original2" ] }
+
+        it "should append string values to array, if not present in array" do
+          subject.append(LogStash::Event.new({"field1" => "append1"}))
+          expect(subject[ "field1" ]).to eq([ "original1", "original2", "append1" ])
+        end
+        it "should not append string values, if the array already contains it" do
+          subject.append(LogStash::Event.new({"field1" => "original1"}))
+          expect(subject[ "field1" ]).to eq([ "original1", "original2" ])
+        end
+        it "should join array, removing duplicates" do
+          subject.append(LogStash::Event.new({"field1" => [ "append1","original1" ]}))
+          expect(subject[ "field1" ]).to eq([ "original1", "original2", "append1" ])
+        end
+      end
+    end
+
+    it "timestamp parsing speed", :performance => true do
+      warmup = 10000
+      count = 1000000
+
+      data = { "@timestamp" => "2013-12-21T07:25:06.605Z" }
+      event = LogStash::Event.new(data)
+      expect(event["@timestamp"]).to be_a(LogStash::Timestamp)
+
+      duration = 0
+      [warmup, count].each do |i|
+        start = Time.now
+        i.times do
+          data = { "@timestamp" => "2013-12-21T07:25:06.605Z" }
+          LogStash::Event.new(data.clone)
+        end
+        duration = Time.now - start
+      end
+      puts "event @timestamp parse rate: #{"%02.0f/sec" % (count / duration)}, elapsed: #{duration}s"
+    end
+
+    context "acceptable @timestamp formats" do
+      subject { LogStash::Event.new }
+
+      formats = [
+        "YYYY-MM-dd'T'HH:mm:ss.SSSZ",
+        "YYYY-MM-dd'T'HH:mm:ss.SSSSSSZ",
+        "YYYY-MM-dd'T'HH:mm:ss.SSS",
+        "YYYY-MM-dd'T'HH:mm:ss",
+        "YYYY-MM-dd'T'HH:mm:ssZ",
+      ]
+      formats.each do |format|
+        it "includes #{format}" do
+          time = subject.sprintf("%{+#{format}}")
+          begin
+            LogStash::Event.new("@timestamp" => time)
+          rescue => e
+            raise StandardError, "Time '#{time}' was rejected. #{e.class}: #{e.to_s}"
+          end
+        end
+      end
+
+      context "from LOGSTASH-1738" do
+        it "does not error" do
+          LogStash::Event.new("@timestamp" => "2013-12-29T23:12:52.371240+02:00")
+        end
+      end
+
+      context "from LOGSTASH-1732" do
+        it "does not error" do
+          LogStash::Event.new("@timestamp" => "2013-12-27T11:07:25+00:00")
+        end
+      end
+    end
+
+    context "timestamp initialization" do
+      let(:logger) { double("logger") }
+
+      it "should coerce timestamp" do
+        t = Time.iso8601("2014-06-12T00:12:17.114Z")
+        expect(LogStash::Timestamp).to receive(:coerce).exactly(3).times.and_call_original
+        expect(LogStash::Event.new("@timestamp" => t).timestamp.to_i).to eq(t.to_i)
+        expect(LogStash::Event.new("@timestamp" => LogStash::Timestamp.new(t)).timestamp.to_i).to eq(t.to_i)
+        expect(LogStash::Event.new("@timestamp" => "2014-06-12T00:12:17.114Z").timestamp.to_i).to eq(t.to_i)
+      end
+
+      it "should assign current time when no timestamp" do
+        ts = LogStash::Timestamp.now
+        expect(LogStash::Timestamp).to receive(:now).and_return(ts)
+        expect(LogStash::Event.new({}).timestamp.to_i).to eq(ts.to_i)
+      end
+
+      it "should tag and warn for invalid value" do
+        ts = LogStash::Timestamp.now
+        expect(LogStash::Timestamp).to receive(:now).twice.and_return(ts)
+        expect(LogStash::Event::LOGGER).to receive(:warn).twice
+
+        event = LogStash::Event.new("@timestamp" => :foo)
+        expect(event.timestamp.to_i).to eq(ts.to_i)
+        expect(event["tags"]).to eq([LogStash::Event::TIMESTAMP_FAILURE_TAG])
+        expect(event[LogStash::Event::TIMESTAMP_FAILURE_FIELD]).to eq(:foo)
+
+        event = LogStash::Event.new("@timestamp" => 666)
+        expect(event.timestamp.to_i).to eq(ts.to_i)
+        expect(event["tags"]).to eq([LogStash::Event::TIMESTAMP_FAILURE_TAG])
+        expect(event[LogStash::Event::TIMESTAMP_FAILURE_FIELD]).to eq(666)
+      end
+
+      it "should tag and warn for invalid string format" do
+        ts = LogStash::Timestamp.now
+        expect(LogStash::Timestamp).to receive(:now).and_return(ts)
+        expect(LogStash::Event::LOGGER).to receive(:warn)
+
+        event = LogStash::Event.new("@timestamp" => "foo")
+        expect(event.timestamp.to_i).to eq(ts.to_i)
+        expect(event["tags"]).to eq([LogStash::Event::TIMESTAMP_FAILURE_TAG])
+        expect(event[LogStash::Event::TIMESTAMP_FAILURE_FIELD]).to eq("foo")
+      end
+    end
+
+    context "to_json" do
+      it "should support to_json" do
+        new_event = LogStash::Event.new(
+          "@timestamp" => Time.iso8601("2014-09-23T19:26:15.832Z"),
+          "message" => "foo bar",
+        )
+        json = new_event.to_json
+
+        expect(json).to eq( "{\"@timestamp\":\"2014-09-23T19:26:15.832Z\",\"message\":\"foo bar\",\"@version\":\"1\"}")
+      end
+
+      it "should support to_json and ignore arguments" do
+        new_event = LogStash::Event.new(
+          "@timestamp" => Time.iso8601("2014-09-23T19:26:15.832Z"),
+          "message" => "foo bar",
+        )
+        json = new_event.to_json(:foo => 1, :bar => "baz")
+
+        expect(json).to eq( "{\"@timestamp\":\"2014-09-23T19:26:15.832Z\",\"message\":\"foo bar\",\"@version\":\"1\"}")
+      end
+    end
+
+    context "metadata" do
+      context "with existing metadata" do
+        subject { LogStash::Event.new("hello" => "world", "@metadata" => { "fancy" => "pants" }) }
+
+        it "should not include metadata in to_hash" do
+          expect(subject.to_hash.keys).not_to include("@metadata")
+
+          # 'hello', '@timestamp', and '@version'
+          expect(subject.to_hash.keys.count).to eq(3)
+        end
+
+        it "should still allow normal field access" do
+          expect(subject["hello"]).to eq("world")
+        end
+      end
+
+      context "with set metadata" do
+        let(:fieldref) { "[@metadata][foo][bar]" }
+        let(:value) { "bar" }
+        subject { LogStash::Event.new("normal" => "normal") }
+        before do
+          # Verify the test is configured correctly.
+          expect(fieldref).to start_with("[@metadata]")
+
+          # Set it.
+          subject[fieldref] = value
+        end
+
+        it "should still allow normal field access" do
+          expect(subject["normal"]).to eq("normal")
+        end
+
+        it "should allow getting" do
+          expect(subject[fieldref]).to eq(value)
+        end
+
+        it "should be hidden from .to_json" do
+          require "json"
+          obj = JSON.parse(subject.to_json)
+          expect(obj).not_to include("@metadata")
+        end
+
+        it "should be hidden from .to_hash" do
+          expect(subject.to_hash).not_to include("@metadata")
+        end
+
+        it "should be accessible through #to_hash_with_metadata" do
+          obj = subject.to_hash_with_metadata
+          expect(obj).to include("@metadata")
+          expect(obj["@metadata"]["foo"]["bar"]).to eq(value)
+        end
+      end
+
+      context "with no metadata" do
+        subject { LogStash::Event.new("foo" => "bar") }
+        it "should have no metadata" do
+          expect(subject["@metadata"]).to be_empty
+        end
+        it "should still allow normal field access" do
+          expect(subject["foo"]).to eq("bar")
+        end
+
+        it "should not include the @metadata key" do
+          expect(subject.to_hash_with_metadata).not_to include("@metadata")
+        end
+      end
+    end
+  end
+
+  context "signal events" do
+    it "should define the shutdown event" do
+      # the SHUTDOWN and FLUSH constants are part of the plugin API contract
+      # if they are changed, all plugins must be updated
+      expect(LogStash::SHUTDOWN).to be_a(LogStash::ShutdownEvent)
+      expect(LogStash::FLUSH).to be_a(LogStash::FlushEvent)
+    end
+  end
+
+  let(:event_hash) do
+    {
+      "@timestamp" => "2013-01-01T00:00:00.000Z",
+      "type" => "sprintf",
+      "message" => "hello world",
+      "tags" => [ "tag1" ],
+      "source" => "/home/foo",
+      "a" => "b",
+      "c" => {
+        "d" => "f",
+        "e" => {"f" => "g"}
+      },
+      "f" => { "g" => { "h" => "i" } },
+      "j" => {
+          "k1" => "v",
+          "k2" => [ "w", "x" ],
+          "k3" => {"4" => "m"},
+          "k4" => [ {"nested" => "cool"} ],
+          5 => 6,
+          "5" => 7
+      },
+      "nilfield" => nil,
+      "@metadata" => { "fancy" => "pants", "have-to-go" => { "deeper" => "inception" } }
+    }
+  end
+
+  describe "using normal hash input" do
+    it_behaves_like "all event tests" do
+      subject{LogStash::Event.new(event_hash)}
+    end
+  end
+
+  describe "using hash input from deserialized json" do
+    # this is to test the case when JrJackson deserialises Json and produces
+    # native Java Collections objects for efficiency
+    it_behaves_like "all event tests" do
+      subject{LogStash::Event.new(LogStash::Json.load(LogStash::Json.dump(event_hash)))}
+    end
+  end
+end