logstash-core 5.3.3-java → 5.4.0-java

data/spec/logstash/execution_context_spec.rb

@@ -0,0 +1,13 @@
+# encoding: utf-8
+require "spec_helper"
+require "logstash/execution_context"
+
+describe LogStash::ExecutionContext do
+  let(:pipeline_id) { :main }
+
+  subject { described_class.new(pipeline_id) }
+
+  it "returns the `pipeline_id`" do
+    expect(subject.pipeline_id).to eq(pipeline_id)
+  end
+end

data/spec/logstash/filter_delegator_spec.rb

@@ -3,6 +3,7 @@ require "spec_helper"
 require "logstash/filter_delegator"
 require "logstash/instrument/null_metric"
 require "logstash/event"
+require "logstash/execution_context"
 
 describe LogStash::FilterDelegator do
   let(:logger) { double(:logger) }
@@ -13,6 +14,7 @@ describe LogStash::FilterDelegator do
   let(:collector) { [] }
   let(:metric) { LogStash::Instrument::NamespacedNullMetric.new(collector, :null) }
   let(:events) { [LogStash::Event.new, LogStash::Event.new] }
+  let(:default_execution_context) { LogStash::ExecutionContext.new(:main) }
 
   before :each do
     allow(metric).to receive(:namespace).with(anything).and_return(metric)
@@ -26,11 +28,11 @@ describe LogStash::FilterDelegator do
     end
   end
 
-  subject { described_class.new(logger, plugin_klass, metric, config) }
+  subject { described_class.new(logger, plugin_klass, metric, default_execution_context, config) }
 
   it "create a plugin with the passed options" do
     expect(plugin_klass).to receive(:new).with(config).and_return(plugin_klass.new(config))
-    described_class.new(logger, plugin_klass, metric, config)
+    described_class.new(logger, plugin_klass, metric, default_execution_context, config)
   end
 
   context "when the plugin support flush" do

data/spec/logstash/inputs/base_spec.rb

@@ -1,5 +1,7 @@
 # encoding: utf-8
 require "spec_helper"
+require "logstash/execution_context"
+require "logstash/inputs/base"
 
 # use a dummy NOOP input to test Inputs::Base
 class LogStash::Inputs::NOOP < LogStash::Inputs::Base
@@ -60,6 +62,45 @@ describe "LogStash::Inputs::Base#decorate" do
     expect(evt.get("field")).to eq(["value1","value2"])
     expect(evt.get("field2")).to eq("value")
   end
+
+  context "execution context" do
+    let(:default_execution_context) { LogStash::ExecutionContext.new(:main) }
+    let(:klass) { LogStash::Inputs::NOOP }
+
+    subject(:instance) { klass.new({}) }
+
+    it "allow to set the context" do
+      expect(instance.execution_context).to be_nil
+      instance.execution_context = default_execution_context
+
+      expect(instance.execution_context).to eq(default_execution_context)
+    end
+
+    it "propagate the context to the codec" do
+      expect(instance.codec.execution_context).to be_nil
+      instance.execution_context = default_execution_context
+
+      expect(instance.codec.execution_context).to eq(default_execution_context)
+    end
+  end
+
+  describe "cloning" do
+    let(:input) do
+      LogStash::Inputs::NOOP.new("add_field" => {"field" => ["value1", "value2"], "field2" => "value"})
+    end
+    
+    let(:cloned) do
+      input.clone
+    end
+    
+    it "should clone the codec when cloned" do
+      expect(input.codec).not_to eq(cloned.codec)
+    end  
+    
+    it "should preserve codec params" do
+      expect(input.codec.params).to eq(cloned.codec.params)
+    end
+  end
 end
 
 describe "LogStash::Inputs::Base#fix_streaming_codecs" do

data/spec/logstash/instrument/metric_spec.rb

@@ -85,8 +85,9 @@ describe LogStash::Instrument::Metric do
     it "return a TimedExecution" do
       execution = subject.time(:root, :duration_ms)
       sleep(sleep_time)
-      execution.stop
+      execution_time = execution.stop
 
+      expect(execution_time).to eq(collector.last)
       expect(collector.last).to be_within(sleep_time_ms).of(sleep_time_ms + 0.1)
       expect(collector[0]).to match(:root)
       expect(collector[1]).to be(:duration_ms)

data/spec/logstash/instrument/metric_store_spec.rb

@@ -53,6 +53,20 @@ describe LogStash::Instrument::MetricStore do
       end
     end
 
+    context "#has_metric?" do
+      context "when the path exist" do
+        it "returns true" do
+          expect(subject.has_metric?(:node, :sashimi, :pipelines, :pipeline01, :plugins, :"logstash-output-elasticsearch", :event_in)).to be_truthy
+        end
+      end
+
+      context "when the path doesn't exist" do
+        it "returns false" do
+          expect(subject.has_metric?(:node, :sashimi, :pipelines, :pipeline01, :plugins, :"logstash-input-nothing")).to be_falsey
+        end
+      end
+    end
+
     describe "#get" do
       context "when the path exist" do
         it "retrieves end of of a branch" do

data/spec/logstash/instrument/namespaced_metric_spec.rb

@@ -78,8 +78,9 @@ describe LogStash::Instrument::NamespacedMetric do
     it "return a TimedExecution" do
       execution = subject.time(:duration_ms)
       sleep(sleep_time)
-      execution.stop
+      execution_time = execution.stop
 
+      expect(execution_time).to eq(collector.last)
       expect(collector.last).to be_within(sleep_time_ms).of(sleep_time_ms + 0.1)
       expect(collector[0]).to match([:root])
       expect(collector[1]).to be(:duration_ms)

data/spec/logstash/instrument/periodic_poller/cgroup_spec.rb

@@ -74,7 +74,7 @@ describe LogStash::Instrument::PeriodicPoller::Cgroup do
   end
 
   context ".get_all" do
-    context "when we can retreive the stats" do
+    context "when we can retrieve the stats" do
       let(:cpuacct_control_group) { "/docker/a10687343f90e97bbb1f7181bd065a42de96c40c4aa91764a9d526ea30475f61" }
       let(:cpuacct_usage) { 1982 }
       let(:cpu_control_group) { "/docker/a10687343f90e97bbb1f7181bd065a42de96c40c4aa91764a9d526ea30475f61" }

data/spec/logstash/instrument/periodic_poller/jvm_spec.rb

@@ -54,6 +54,41 @@ describe LogStash::Instrument::PeriodicPoller::JVM do
     end
   end
 
+  describe "aggregate heap information" do
+    shared_examples "heap_information" do
+      let(:data_set) do
+        {
+          "usage.used" => 5,
+          "usage.committed" => 11,
+          "usage.max" => 21,
+          "peak.max" => 51,
+          "peak.used" => 61
+        }
+      end
+      let(:collection) { [data_set] }
+
+      it "return the right values" do
+        expect(subject.aggregate_information_for(collection)).to match({
+          :used_in_bytes => 5 * collection.size,
+          :committed_in_bytes => 11 * collection.size,
+          :max_in_bytes => 21 * collection.size,
+          :peak_max_in_bytes => 51 * collection.size,
+          :peak_used_in_bytes => 61 * collection.size
+        })
+      end
+    end
+
+    context "with only one data set in a collection" do
+      include_examples "heap_information"
+    end
+
+    context "with multiples data set in a collection" do
+      include_examples "heap_information" do
+        let(:collection) { ar = []; ar << data_set; ar << data_set; ar }
+      end
+    end
+  end
+
   describe "collections" do
     subject(:collection) { jvm.collect }
     it "should run cleanly" do

data/spec/logstash/instrument/periodic_poller/load_average_spec.rb

@@ -13,14 +13,10 @@ describe LogStash::Instrument::PeriodicPoller::LoadAverage do
       context "when it can read the file" do
         let(:proc_loadavg) { "0.00 0.01 0.05 3/180 29727" }
 
-        before do
-          expect(::File).to receive(:read).with("/proc/loadavg").and_return(proc_loadavg)
-        end
-
         it "return the 3 load average from `/proc/loadavg`" do
           avg_1m, avg_5m, avg_15m = proc_loadavg.chomp.split(" ")
 
-          expect(subject.get).to include(:"1m" => avg_1m.to_f, :"5m" => avg_5m.to_f, :"15m" => avg_15m.to_f)
+          expect(subject.get(proc_loadavg)).to include(:"1m" => avg_1m.to_f, :"5m" => avg_5m.to_f, :"15m" => avg_15m.to_f)
         end
       end
     end

data/spec/logstash/instrument/wrapped_write_client_spec.rb

@@ -0,0 +1,113 @@
+# encoding: utf-8
+require "logstash/instrument/metric"
+require "logstash/instrument/wrapped_write_client"
+require "logstash/util/wrapped_synchronous_queue"
+require "logstash/event"
+require_relative "../../support/mocks_classes"
+require "spec_helper"
+
+describe LogStash::Instrument::WrappedWriteClient do
+  let(:write_client) { queue.write_client }
+  let(:read_client) { queue.read_client }
+  let(:pipeline) { double("pipeline", :pipeline_id => :main) }
+  let(:collector)   { LogStash::Instrument::Collector.new }
+  let(:metric) { LogStash::Instrument::Metric.new(collector) }
+  let(:plugin) { LogStash::Inputs::DummyInput.new({ "id" => myid }) }
+  let(:event) { LogStash::Event.new }
+  let(:myid) { "1234myid" }
+
+  subject { described_class.new(write_client, pipeline, metric, plugin) }
+
+
+  shared_examples "queue tests" do
+    it "pushes single event to the `WriteClient`" do
+      t = Thread.new do
+        subject.push(event)
+      end
+      sleep(0.01) while !t.status
+      expect(read_client.read_batch.size).to eq(1)
+      t.kill rescue nil
+    end
+
+    it "pushes batch to the `WriteClient`" do
+      batch = write_client.get_new_batch
+      batch << event
+
+      t = Thread.new do
+        subject.push_batch(batch)
+      end
+
+      sleep(0.01) while !t.status
+      expect(read_client.read_batch.size).to eq(1)
+      t.kill rescue nil
+    end
+
+    context "recorded metrics" do
+      before do
+        t = Thread.new do
+          subject.push(event)
+        end
+        sleep(0.01) while !t.status
+        sleep(0.250) # make it block for some time, so duration isn't 0
+        read_client.read_batch.size
+        t.kill rescue nil
+      end
+
+      let(:snapshot_store) { collector.snapshot_metric.metric_store }
+
+      let(:snapshot_metric) { snapshot_store.get_shallow(:stats) }
+
+      it "records instance level events `in`" do
+        expect(snapshot_metric[:events][:in].value).to eq(1)
+      end
+
+      it "records pipeline level `in`" do
+        expect(snapshot_metric[:pipelines][:main][:events][:in].value).to eq(1)
+      end
+
+      it "record input `out`" do
+        expect(snapshot_metric[:pipelines][:main][:plugins][:inputs][myid.to_sym][:events][:out].value).to eq(1)
+      end
+
+      context "recording of the duration of pushing to the queue" do
+        it "records at the `global events` level" do
+          expect(snapshot_metric[:events][:queue_push_duration_in_millis].value).to be_kind_of(Integer)
+        end
+
+        it "records at the `pipeline` level" do
+          expect(snapshot_metric[:pipelines][:main][:events][:queue_push_duration_in_millis].value).to be_kind_of(Integer)
+        end
+
+        it "records at the `plugin level" do
+          expect(snapshot_metric[:pipelines][:main][:plugins][:inputs][myid.to_sym][:events][:queue_push_duration_in_millis].value).to be_kind_of(Integer)
+        end
+      end
+    end
+  end
+
+  context "WrappedSynchronousQueue" do
+    let(:queue) { LogStash::Util::WrappedSynchronousQueue.new }
+
+    before do
+      read_client.set_events_metric(metric.namespace([:stats, :events]))
+      read_client.set_pipeline_metric(metric.namespace([:stats, :pipelines, :main, :events]))
+    end
+
+    include_examples "queue tests"
+  end
+
+  context "AckedMemoryQueue" do
+    let(:queue) { LogStash::Util::WrappedAckedQueue.create_memory_based("", 1024, 10, 1024) }
+
+    before do
+      read_client.set_events_metric(metric.namespace([:stats, :events]))
+      read_client.set_pipeline_metric(metric.namespace([:stats, :pipelines, :main, :events]))
+    end
+
+    after do
+      queue.close
+    end
+
+    include_examples "queue tests"
+  end
+end

data/spec/logstash/json_spec.rb

@@ -37,7 +37,7 @@ describe "LogStash::Json" do
 
     ### JRuby specific
     # Former expectation in this code were removed because of https://github.com/rspec/rspec-mocks/issues/964
-    # as soon as is fix we can re introduce them if decired, however for now the completeness of the test
+    # as soon as is fix we can re introduce them if desired, however for now the completeness of the test
     # is also not affected as the conversion would not work if the expectation where not meet.
     ###
     context "jruby deserialize" do

data/spec/logstash/legacy_ruby_event_spec.rb

@@ -0,0 +1,636 @@
+# encoding: utf-8
+require "spec_helper"
+require "logstash/util/decorators"
+require "json"
+
+describe LogStash::Event do
+
+  shared_examples "all event tests" do
+    context "[]=" do
+      it "should raise an exception if you attempt to set @timestamp to a value type other than a Time object" do
+        expect{subject.set("@timestamp", "crash!")}.to raise_error(TypeError)
+      end
+
+      it "should assign simple fields" do
+        expect(subject.get("foo")).to be_nil
+        expect(subject.set("foo", "bar")).to eq("bar")
+        expect(subject.get("foo")).to eq("bar")
+      end
+
+      it "should overwrite simple fields" do
+        expect(subject.get("foo")).to be_nil
+        expect(subject.set("foo", "bar")).to eq("bar")
+        expect(subject.get("foo")).to eq("bar")
+
+        expect(subject.set("foo", "baz")).to eq("baz")
+        expect(subject.get("foo")).to eq("baz")
+      end
+
+      it "should assign deep fields" do
+        expect(subject.get("[foo][bar]")).to be_nil
+        expect(subject.set("[foo][bar]", "baz")).to eq("baz")
+        expect(subject.get("[foo][bar]")).to eq("baz")
+      end
+
+      it "should overwrite deep fields" do
+        expect(subject.get("[foo][bar]")).to be_nil
+        expect(subject.set("[foo][bar]", "baz")).to eq("baz")
+        expect(subject.get("[foo][bar]")).to eq("baz")
+
+        expect(subject.set("[foo][bar]", "zab")).to eq("zab")
+        expect(subject.get("[foo][bar]")).to eq("zab")
+      end
+
+      it "allow to set the @metadata key to a hash" do
+        subject.set("@metadata", { "action" => "index" })
+        expect(subject.get("[@metadata][action]")).to eq("index")
+      end
+
+      it "should add key when setting nil value" do
+        subject.set("[baz]", nil)
+        expect(subject.to_hash).to include("baz" => nil)
+      end
+
+      it "should set nil element within existing array value" do
+        subject.set("[foo]", ["bar", "baz"])
+
+        expect(subject.set("[foo][0]", nil)).to eq(nil)
+        expect(subject.get("[foo]")).to eq([nil, "baz"])
+      end
+
+      it "should set nil in first element within empty array" do
+        subject.set("[foo]", [])
+
+        expect(subject.set("[foo][0]", nil)).to eq(nil)
+        expect(subject.get("[foo]")).to eq([nil])
+      end
+
+      it "should set nil in second element within empty array" do
+        subject.set("[foo]", [])
+
+        expect(subject.set("[foo][1]", nil)).to eq(nil)
+        expect(subject.get("[foo]")).to eq([nil, nil])
+      end
+    end
+
+    context "#sprintf" do
+      it "should not return a String reference" do
+        data = "NOT-A-REFERENCE"
+        event = LogStash::Event.new({ "reference" => data })
+        LogStash::Util::Decorators.add_fields({"reference_test" => "%{reference}"}, event, "dummy-plugin")
+        data.downcase!
+        expect(event.get("reference_test")).not_to eq(data)
+      end
+
+      it "should not return a Fixnum reference" do
+        data = 1
+        event = LogStash::Event.new({ "reference" => data })
+        LogStash::Util::Decorators.add_fields({"reference_test" => "%{reference}"}, event, "dummy-plugin")
+        data += 41
+        expect(event.get("reference_test")).to eq("1")
+      end
+
+      it "should report a unix timestamp for %{+%s}" do
+        expect(subject.sprintf("%{+%s}")).to eq("1356998400")
+      end
+
+      it "should work if there is no fieldref in the string" do
+        expect(subject.sprintf("bonjour")).to eq("bonjour")
+      end
+
+      it "should raise error when formatting %{+%s} when @timestamp field is missing" do
+        str = "hello-%{+%s}"
+        subj = subject.clone
+        subj.remove("[@timestamp]")
+        expect{ subj.sprintf(str) }.to raise_error(LogStash::Error)
+      end
+
+      it "should report a time with %{+format} syntax", :if => RUBY_ENGINE == "jruby" do
+        expect(subject.sprintf("%{+YYYY}")).to eq("2013")
+        expect(subject.sprintf("%{+MM}")).to eq("01")
+        expect(subject.sprintf("%{+HH}")).to eq("00")
+      end
+
+      it "should support mixed string" do
+        expect(subject.sprintf("foo %{+YYYY-MM-dd} %{type}")).to eq("foo 2013-01-01 sprintf")
+      end
+
+      it "should raise error with %{+format} syntax when @timestamp field is missing", :if => RUBY_ENGINE == "jruby" do
+        str = "logstash-%{+YYYY}"
+        subj = subject.clone
+        subj.remove("[@timestamp]")
+        expect{ subj.sprintf(str) }.to raise_error(LogStash::Error)
+      end
+
+      it "should report fields with %{field} syntax" do
+        expect(subject.sprintf("%{type}")).to eq("sprintf")
+        expect(subject.sprintf("%{message}")).to eq(subject.get("message"))
+      end
+
+      it "should print deep fields" do
+        expect(subject.sprintf("%{[j][k1]}")).to eq("v")
+        expect(subject.sprintf("%{[j][k2][0]}")).to eq("w")
+      end
+
+      it "should be able to take a non-string for the format" do
+        expect(subject.sprintf(2)).to eq("2")
+      end
+
+      it "should allow to use the metadata when calling #sprintf" do
+        expect(subject.sprintf("super-%{[@metadata][fancy]}")).to eq("super-pants")
+      end
+
+      it "should allow to use nested hash from the metadata field" do
+        expect(subject.sprintf("%{[@metadata][have-to-go][deeper]}")).to eq("inception")
+      end
+
+      it "should return a json string if the key is a hash" do
+        expect(subject.sprintf("%{[j][k3]}")).to eq("{\"4\":\"m\"}")
+      end
+
+      it "should not strip last character" do
+        expect(subject.sprintf("%{type}%{message}|")).to eq("sprintfhello world|")
+      end
+
+      it "should render nil array values as leading empty string" do
+        expect(subject.set("foo", [nil, "baz"])).to eq([nil, "baz"])
+
+        expect(subject.get("[foo][0]")).to be_nil
+        expect(subject.get("[foo][1]")).to eq("baz")
+
+        expect(subject.sprintf("%{[foo]}")).to eq(",baz")
+      end
+
+      it "should render nil array values as middle empty string" do
+        expect(subject.set("foo", ["bar", nil, "baz"])).to eq(["bar", nil, "baz"])
+
+        expect(subject.get("[foo][0]")).to eq("bar")
+        expect(subject.get("[foo][1]")).to be_nil
+        expect(subject.get("[foo][2]")).to eq("baz")
+
+        expect(subject.sprintf("%{[foo]}")).to eq("bar,,baz")
+      end
+
+     it "should render nil array values as trailing empty string" do
+        expect(subject.set("foo", ["bar", nil])).to eq(["bar", nil])
+
+        expect(subject.get("[foo][0]")).to eq("bar")
+        expect(subject.get("[foo][1]")).to be_nil
+
+        expect(subject.sprintf("%{[foo]}")).to eq("bar,")
+     end
+
+      it "should render deep arrays with nil value" do
+        subject.set("[foo]", [[12, nil], 56])
+        expect(subject.sprintf("%{[foo]}")).to eq("12,,56")
+      end
+
+      context "#encoding" do
+        it "should return known patterns as UTF-8" do
+          expect(subject.sprintf("%{message}").encoding).to eq(Encoding::UTF_8)
+        end
+
+        it "should return unknown patterns as UTF-8" do
+          expect(subject.sprintf("%{unknown_pattern}").encoding).to eq(Encoding::UTF_8)
+        end
+      end
+    end
+
+    context "#[]" do
+      it "should fetch data" do
+        expect(subject.get("type")).to eq("sprintf")
+      end
+      it "should fetch fields" do
+        expect(subject.get("a")).to eq("b")
+        expect(subject.get('c')['d']).to eq("f")
+      end
+      it "should fetch deep fields" do
+        expect(subject.get("[j][k1]")).to eq("v")
+        expect(subject.get("[c][d]")).to eq("f")
+        expect(subject.get('[f][g][h]')).to eq("i")
+        expect(subject.get('[j][k3][4]')).to eq("m")
+        expect(subject.get('[j][5]')).to eq(7)
+
+      end
+
+      it "should be fast?", :performance => true do
+        count = 1000000
+        2.times do
+          start = Time.now
+          count.times { subject.get("[j][k1]") }
+          duration = Time.now - start
+          puts "event #[] rate: #{"%02.0f/sec" % (count / duration)}, elapsed: #{duration}s"
+        end
+      end
+    end
+
+    context "#include?" do
+      it "should include existing fields" do
+        expect(subject.include?("c")).to eq(true)
+        expect(subject.include?("[c][d]")).to eq(true)
+        expect(subject.include?("[j][k4][0][nested]")).to eq(true)
+      end
+
+      it "should include field with nil value" do
+        expect(subject.include?("nilfield")).to eq(true)
+      end
+
+      it "should include @metadata field" do
+        expect(subject.include?("@metadata")).to eq(true)
+      end
+
+      it "should include field within @metadata" do
+        expect(subject.include?("[@metadata][fancy]")).to eq(true)
+      end
+
+      it "should not include non-existing fields" do
+        expect(subject.include?("doesnotexist")).to eq(false)
+        expect(subject.include?("[j][doesnotexist]")).to eq(false)
+        expect(subject.include?("[tag][0][hello][yes]")).to eq(false)
+      end
+
+      it "should include within arrays" do
+        expect(subject.include?("[tags][0]")).to eq(true)
+        expect(subject.include?("[tags][1]")).to eq(false)
+      end
+    end
+
+    context "#overwrite" do
+      it "should swap data with new content" do
+        new_event = LogStash::Event.new(
+          "type" => "new",
+          "message" => "foo bar",
+        )
+        subject.overwrite(new_event)
+
+        expect(subject.get("message")).to eq("foo bar")
+        expect(subject.get("type")).to eq("new")
+
+        ["tags", "source", "a", "c", "f", "j"].each do |field|
+          expect(subject.get(field)).to be_nil
+        end
+      end
+    end
+
+    context "#append" do
+      it "should append strings to an array" do
+        subject.append(LogStash::Event.new("message" => "another thing"))
+        expect(subject.get("message")).to eq([ "hello world", "another thing" ])
+      end
+
+      it "should concatenate tags" do
+        subject.append(LogStash::Event.new("tags" => [ "tag2" ]))
+        # added to_a for when array is a Java Collection when produced from json input
+        # TODO: we have to find a better way to handle this in tests. maybe override
+        # rspec eq or == to do an explicit to_a when comparing arrays?
+        expect(subject.get("tags").to_a).to eq([ "tag1", "tag2" ])
+      end
+
+      context "when event field is nil" do
+        it "should add single value as string" do
+          subject.append(LogStash::Event.new({"field1" => "append1"}))
+          expect(subject.get("field1")).to eq("append1")
+        end
+        it "should add multi values as array" do
+          subject.append(LogStash::Event.new({"field1" => [ "append1","append2" ]}))
+          expect(subject.get("field1")).to eq([ "append1","append2" ])
+        end
+      end
+
+      context "when event field is a string" do
+        before { subject.set("field1", "original1") }
+
+        it "should append string to values, if different from current" do
+          subject.append(LogStash::Event.new({"field1" => "append1"}))
+          expect(subject.get("field1")).to eq([ "original1", "append1" ])
+        end
+        it "should not change value, if appended value is equal current" do
+          subject.append(LogStash::Event.new({"field1" => "original1"}))
+          expect(subject.get("field1")).to eq("original1")
+        end
+        it "should concatenate values in an array" do
+          subject.append(LogStash::Event.new({"field1" => [ "append1" ]}))
+          expect(subject.get("field1")).to eq([ "original1", "append1" ])
+        end
+        it "should join array, removing duplicates" do
+          subject.append(LogStash::Event.new({"field1" => [ "append1","original1" ]}))
+          expect(subject.get("field1")).to eq([ "original1", "append1" ])
+        end
+      end
+      context "when event field is an array" do
+        before { subject.set("field1", [ "original1", "original2" ] )}
+
+        it "should append string values to array, if not present in array" do
+          subject.append(LogStash::Event.new({"field1" => "append1"}))
+          expect(subject.get("field1")).to eq([ "original1", "original2", "append1" ])
+        end
+        it "should not append string values, if the array already contains it" do
+          subject.append(LogStash::Event.new({"field1" => "original1"}))
+          expect(subject.get("field1")).to eq([ "original1", "original2" ])
+        end
+        it "should join array, removing duplicates" do
+          subject.append(LogStash::Event.new({"field1" => [ "append1","original1" ]}))
+          expect(subject.get("field1")).to eq([ "original1", "original2", "append1" ])
+        end
+      end
+
+    end
+
+    it "timestamp parsing speed", :performance => true do
+      warmup = 10000
+      count = 1000000
+
+      data = { "@timestamp" => "2013-12-21T07:25:06.605Z" }
+      event = LogStash::Event.new(data)
+      expect(event.get("@timestamp")).to be_a(LogStash::Timestamp)
+
+      duration = 0
+      [warmup, count].each do |i|
+        start = Time.now
+        i.times do
+          data = { "@timestamp" => "2013-12-21T07:25:06.605Z" }
+          LogStash::Event.new(data.clone)
+        end
+        duration = Time.now - start
+      end
+      puts "event @timestamp parse rate: #{"%02.0f/sec" % (count / duration)}, elapsed: #{duration}s"
+    end
+
+    context "acceptable @timestamp formats" do
+      subject { LogStash::Event.new }
+
+      formats = [
+        "YYYY-MM-dd'T'HH:mm:ss.SSSZ",
+        "YYYY-MM-dd'T'HH:mm:ss.SSSSSSZ",
+        "YYYY-MM-dd'T'HH:mm:ss.SSS",
+        "YYYY-MM-dd'T'HH:mm:ss",
+        "YYYY-MM-dd'T'HH:mm:ssZ",
+      ]
+      formats.each do |format|
+        it "includes #{format}" do
+          time = subject.sprintf("%{+#{format}}")
+          begin
+            LogStash::Event.new("@timestamp" => time)
+          rescue => e
+            raise StandardError, "Time '#{time}' was rejected. #{e.class}: #{e.to_s}"
+          end
+        end
+      end
+
+      context "from LOGSTASH-1738" do
+        it "does not error" do
+          LogStash::Event.new("@timestamp" => "2013-12-29T23:12:52.371240+02:00")
+        end
+      end
+
+      context "from LOGSTASH-1732" do
+        it "does not error" do
+          LogStash::Event.new("@timestamp" => "2013-12-27T11:07:25+00:00")
+        end
+      end
+    end
+
+    context "timestamp initialization" do
+      it "should coerce timestamp" do
+        t = Time.iso8601("2014-06-12T00:12:17.114Z")
+        expect(LogStash::Event.new("@timestamp" => t).timestamp.to_i).to eq(t.to_i)
+        expect(LogStash::Event.new("@timestamp" => LogStash::Timestamp.new(t)).timestamp.to_i).to eq(t.to_i)
+        expect(LogStash::Event.new("@timestamp" => "2014-06-12T00:12:17.114Z").timestamp.to_i).to eq(t.to_i)
+      end
+
+      it "should assign current time when no timestamp" do
+        expect(LogStash::Event.new({}).timestamp.to_i).to be_within(1).of (Time.now.to_i)
+      end
+
+      it "should tag for invalid value" do
+        event = LogStash::Event.new("@timestamp" => "foo")
+        expect(event.timestamp.to_i).to be_within(1).of Time.now.to_i
+        expect(event.get("tags")).to eq([LogStash::Event::TIMESTAMP_FAILURE_TAG])
+        expect(event.get(LogStash::Event::TIMESTAMP_FAILURE_FIELD)).to eq("foo")
+
+        event = LogStash::Event.new("@timestamp" => 666)
+        expect(event.timestamp.to_i).to be_within(1).of Time.now.to_i
+        expect(event.get("tags")).to eq([LogStash::Event::TIMESTAMP_FAILURE_TAG])
+        expect(event.get(LogStash::Event::TIMESTAMP_FAILURE_FIELD)).to eq(666)
+      end
+
+      it "should warn for invalid value" do
+        LogStash::Event.new("@timestamp" => :foo)
+        LogStash::Event.new("@timestamp" => 666)
+      end
+
+      it "should tag for invalid string format" do
+        event = LogStash::Event.new("@timestamp" => "foo")
+        expect(event.timestamp.to_i).to be_within(1).of Time.now.to_i
+        expect(event.get("tags")).to eq([LogStash::Event::TIMESTAMP_FAILURE_TAG])
+        expect(event.get(LogStash::Event::TIMESTAMP_FAILURE_FIELD)).to eq("foo")
+      end
+
+      it "should warn for invalid string format" do
+        LogStash::Event.new("@timestamp" => "foo")
+      end
+    end
+
+    context "to_json" do
+      it "should support to_json" do
+        new_event = LogStash::Event.new(
+          "@timestamp" => Time.iso8601("2014-09-23T19:26:15.832Z"),
+          "message" => "foo bar",
+        )
+        json = new_event.to_json
+
+        expect(JSON.parse(json)).to eq( JSON.parse("{\"@timestamp\":\"2014-09-23T19:26:15.832Z\",\"message\":\"foo bar\",\"@version\":\"1\"}"))
+      end
+
+      it "should support to_json and ignore arguments" do
+        new_event = LogStash::Event.new(
+          "@timestamp" => Time.iso8601("2014-09-23T19:26:15.832Z"),
+          "message" => "foo bar",
+        )
+        json = new_event.to_json(:foo => 1, :bar => "baz")
+
+        expect(JSON.parse(json)).to eq( JSON.parse("{\"@timestamp\":\"2014-09-23T19:26:15.832Z\",\"message\":\"foo bar\",\"@version\":\"1\"}"))
+      end
+    end
+
+    context "metadata" do
+      context "with existing metadata" do
+        subject { LogStash::Event.new("hello" => "world", "@metadata" => { "fancy" => "pants" }) }
+
+        it "should not include metadata in to_hash" do
+          expect(subject.to_hash.keys).not_to include("@metadata")
+
+          # 'hello', '@timestamp', and '@version'
+          expect(subject.to_hash.keys.count).to eq(3)
+        end
+
+        it "should still allow normal field access" do
+          expect(subject.get("hello")).to eq("world")
+        end
+      end
+
+      context "with set metadata" do
+        let(:fieldref) { "[@metadata][foo][bar]" }
+        let(:value) { "bar" }
+        subject { LogStash::Event.new("normal" => "normal") }
+        before do
+          # Verify the test is configured correctly.
+          expect(fieldref).to start_with("[@metadata]")
+
+          # Set it.
+          subject.set(fieldref, value)
+        end
+
+        it "should still allow normal field access" do
+          expect(subject.get("normal")).to eq("normal")
+        end
+
+        it "should allow getting" do
+          expect(subject.get(fieldref)).to eq(value)
+        end
+
+        it "should be hidden from .to_json" do
+          require "json"
+          obj = JSON.parse(subject.to_json)
+          expect(obj).not_to include("@metadata")
+        end
+
+        it "should be hidden from .to_hash" do
+          expect(subject.to_hash).not_to include("@metadata")
+        end
+
+        it "should be accessible through #to_hash_with_metadata" do
+          obj = subject.to_hash_with_metadata
+          expect(obj).to include("@metadata")
+          expect(obj["@metadata"]["foo"]["bar"]).to eq(value)
+        end
+      end
+
+      context "with no metadata" do
+        subject { LogStash::Event.new("foo" => "bar") }
+        it "should have no metadata" do
+          expect(subject.get("@metadata")).to be_empty
+        end
+        it "should still allow normal field access" do
+          expect(subject.get("foo")).to eq("bar")
+        end
+
+        it "should not include the @metadata key" do
+          expect(subject.to_hash_with_metadata).not_to include("@metadata")
+        end
+      end
+    end
+
+    context "signal events" do
+      it "should define the shutdown and flush event constants" do
+        # the SHUTDOWN and FLUSH constants are part of the plugin API contract
+        # if they are changed, all plugins must be updated
+        expect(LogStash::SHUTDOWN).to be_a(LogStash::ShutdownEvent)
+        expect(LogStash::FLUSH).to be_a(LogStash::FlushEvent)
+      end
+
+      it "should define the shutdown event with SignalEvent as parent class" do
+        expect(LogStash::SHUTDOWN).to be_a(LogStash::SignalEvent)
+        expect(LogStash::FLUSH).to be_a(LogStash::SignalEvent)
+      end
+
+      it "should define the flush? method" do
+        expect(LogStash::SHUTDOWN.flush?).to be_falsey
+        expect(LogStash::FLUSH.flush?).to be_truthy
+      end
+
+      it "should define the shutdown? method" do
+        expect(LogStash::SHUTDOWN.shutdown?).to be_truthy
+        expect(LogStash::FLUSH.shutdown?).to be_falsey
+      end
+    end
+  end
+
+  let(:event_hash) do
+    {
+      "@timestamp" => "2013-01-01T00:00:00.000Z",
+      "type" => "sprintf",
+      "message" => "hello world",
+      "tags" => [ "tag1" ],
+      "source" => "/home/foo",
+      "a" => "b",
+      "c" => {
+        "d" => "f",
+        "e" => {"f" => "g"}
+      },
+      "f" => { "g" => { "h" => "i" } },
+      "j" => {
+          "k1" => "v",
+          "k2" => [ "w", "x" ],
+          "k3" => {"4" => "m"},
+          "k4" => [ {"nested" => "cool"} ],
+          5 => 6,
+          "5" => 7
+      },
+      "nilfield" => nil,
+      "@metadata" => { "fancy" => "pants", "have-to-go" => { "deeper" => "inception" } }
+    }
+  end
+
+  describe "using normal hash input" do
+    it_behaves_like "all event tests" do
+      subject{LogStash::Event.new(event_hash)}
+    end
+  end
+
+  describe "using hash input from deserialized json" do
+    # this is to test the case when JrJackson deserializes Json and produces
+    # native Java Collections objects for efficiency
+    it_behaves_like "all event tests" do
+      subject{LogStash::Event.new(LogStash::Json.load(LogStash::Json.dump(event_hash)))}
+    end
+  end
+
+
+  describe "#to_s" do
+    let(:timestamp) { LogStash::Timestamp.new }
+    let(:event1) { LogStash::Event.new({ "@timestamp" => timestamp, "host" => "foo", "message" => "bar"}) }
+    let(:event2) { LogStash::Event.new({ "host" => "bar", "message" => "foo"}) }
+
+    it "should cache only one template" do
+      LogStash::StringInterpolation.clear_cache
+      expect {
+        event1.to_s
+        event2.to_s
+      }.to change { LogStash::StringInterpolation.cache_size }.by(1)
+    end
+
+    it "return the string containing the timestamp, the host and the message" do
+      expect(event1.to_s).to eq("#{timestamp.to_iso8601} #{event1.get("host")} #{event1.get("message")}")
+    end
+  end
+
+  describe "Event accessors" do
+    let(:event) { LogStash::Event.new({ "message" => "foo" }) }
+
+    it "should invalidate target caching" do
+      expect(event.get("[a][0]")).to be_nil
+
+      expect(event.set("[a][0]", 42)).to eq(42)
+      expect(event.get("[a][0]")).to eq(42)
+      expect(event.get("[a]")).to eq({"0" => 42})
+
+      expect(event.set("[a]", [42, 24])).to eq([42, 24])
+      expect(event.get("[a]")).to eq([42, 24])
+
+      expect(event.get("[a][0]")).to eq(42)
+
+      expect(event.set("[a]", [24, 42])).to eq([24, 42])
+      expect(event.get("[a][0]")).to eq(24)
+
+      expect(event.set("[a][0]", {"a "=> 99, "b" => 98})).to eq({"a "=> 99, "b" => 98})
+      expect(event.get("[a][0]")).to eq({"a "=> 99, "b" => 98})
+
+      expect(event.get("[a]")).to eq([{"a "=> 99, "b" => 98}, 42])
+      expect(event.get("[a][0]")).to eq({"a "=> 99, "b" => 98})
+      expect(event.get("[a][1]")).to eq(42)
+      expect(event.get("[a][0][b]")).to eq(98)
+    end
+  end
+end
+