logstash-filter-elasticsearch 3.19.0 → 4.0.0

data/lib/logstash/filters/elasticsearch/dsl_executor.rb

@@ -1,140 +0,0 @@
-# encoding: utf-8
-
-module LogStash
-  module Filters
-    class Elasticsearch
-      class DslExecutor
-        def initialize(plugin, logger)
-          @index = plugin.params["index"]
-          @query = plugin.params["query"]
-          @query_dsl = plugin.query_dsl
-          @fields = plugin.params["fields"]
-          @result_size = plugin.params["result_size"]
-          @docinfo_fields = plugin.params["docinfo_fields"]
-          @tag_on_failure = plugin.params["tag_on_failure"]
-          @enable_sort = plugin.params["enable_sort"]
-          @sort = plugin.params["sort"]
-          @aggregation_fields = plugin.params["aggregation_fields"]
-          @logger = logger
-          @event_decorator = plugin.method(:decorate)
-          @target_field = plugin.params["target"]
-          if @target_field
-            def self.apply_target(path); "[#{@target_field}][#{path}]"; end
-          else
-            def self.apply_target(path); path; end
-          end
-        end
-
-        def process(client, event)
-          matched = false
-          begin
-            params = { :index => event.sprintf(@index) }
-
-            if @query_dsl
-              query = LogStash::Json.load(event.sprintf(@query_dsl))
-              params[:body] = query
-            else
-              query = event.sprintf(@query)
-              params[:q] = query
-              params[:size] = @result_size
-              params[:sort] = @sort if @enable_sort
-            end
-
-            @logger.debug("Querying elasticsearch for lookup", :params => params)
-
-            results = client.search(params)
-            raise "Elasticsearch query error: #{results["_shards"]["failures"]}" if results["_shards"].include? "failures"
-
-            event.set("[@metadata][total_hits]", extract_total_from_hits(results['hits']))
-
-            result_hits = results["hits"]["hits"]
-            if !result_hits.nil? && !result_hits.empty?
-              matched = true
-              @fields.each do |old_key, new_key|
-                old_key_path = extract_path(old_key)
-                extracted_hit_values = result_hits.map do |doc|
-                  extract_value(doc["_source"], old_key_path)
-                end
-                value_to_set = extracted_hit_values.count > 1 ? extracted_hit_values : extracted_hit_values.first
-                set_to_event_target(event, new_key, value_to_set)
-              end
-              @docinfo_fields.each do |old_key, new_key|
-                old_key_path = extract_path(old_key)
-                extracted_docs_info = result_hits.map do |doc|
-                  extract_value(doc, old_key_path)
-                end
-                value_to_set = extracted_docs_info.count > 1 ? extracted_docs_info : extracted_docs_info.first
-                set_to_event_target(event, new_key, value_to_set)
-              end
-            end
-
-            result_aggregations = results["aggregations"]
-            if !result_aggregations.nil? && !result_aggregations.empty?
-              matched = true
-              @aggregation_fields.each do |agg_name, ls_field|
-                set_to_event_target(event, ls_field, result_aggregations[agg_name])
-              end
-            end
-
-          rescue => e
-            if @logger.trace?
-              @logger.warn("Failed to query elasticsearch for previous event", :index => @index, :query => @query, :event => event.to_hash, :error => e.message, :backtrace => e.backtrace)
-            elsif @logger.debug?
-              @logger.warn("Failed to query elasticsearch for previous event", :index => @index, :error => e.message, :backtrace => e.backtrace)
-            else
-              @logger.warn("Failed to query elasticsearch for previous event", :index => @index, :error => e.message)
-            end
-            @tag_on_failure.each { |tag| event.tag(tag) }
-          else
-            @event_decorator.call(event) if matched
-          end
-        end
-
-        private
-
-        # Given a "hits" object from an Elasticsearch response, return the total number of hits in
-        # the result set.
-        # @param hits [Hash{String=>Object}]
-        # @return [Integer]
-        def extract_total_from_hits(hits)
-          total = hits['total']
-
-          # Elasticsearch 7.x produces an object containing `value` and `relation` in order
-          # to enable unambiguous reporting when the total is only a lower bound; if we get
-          # an object back, return its `value`.
-          return total['value'] if total.kind_of?(Hash)
-          total
-        end
-
-        # get an array of path elements from a path reference
-        def extract_path(path_reference)
-          return [path_reference] unless path_reference.start_with?('[') && path_reference.end_with?(']')
-
-          path_reference[1...-1].split('][')
-        end
-
-        # given a Hash and an array of path fragments, returns the value at the path
-        # @param source [Hash{String=>Object}]
-        # @param path [Array{String}]
-        # @return [Object]
-        def extract_value(source, path)
-          path.reduce(source) do |memo, old_key_fragment|
-            break unless memo.include?(old_key_fragment)
-            memo[old_key_fragment]
-          end
-        end
-
-        # if @target is defined, creates a nested structure to inject result into target field
-        # if not defined, directly sets to the top-level event field
-        # @param event [LogStash::Event]
-        # @param new_key [String] name of the field to set
-        # @param value_to_set [Array] values to set
-        # @return [void]
-        def set_to_event_target(event, new_key, value_to_set)
-          key_to_set = self.apply_target(new_key)
-          event.set(key_to_set, value_to_set)
-        end
-      end
-    end
-  end
-end

data/lib/logstash/filters/elasticsearch/esql_executor.rb

@@ -1,178 +0,0 @@
-# encoding: utf-8
-
-module LogStash
-  module Filters
-    class Elasticsearch
-      class EsqlExecutor
-
-        ESQL_PARSERS_BY_TYPE = Hash.new(lambda { |x| x }).merge(
-          'date' => ->(value) { value && LogStash::Timestamp.new(value) },
-          )
-
-        def initialize(plugin, logger)
-          @logger = logger
-
-          @event_decorator = plugin.method(:decorate)
-          @query = plugin.params["query"]
-
-          query_params = plugin.query_params || {}
-          reference_valued_params, static_valued_params = query_params.partition { |_, v| v.kind_of?(String) && v.match?(/^\[.*\]$/) }
-          @referenced_params = reference_valued_params&.to_h
-          # keep static params as an array of hashes to attach to the ES|QL api param easily
-          @static_params = static_valued_params.map { |k, v| { k => v } }
-          @tag_on_failure = plugin.params["tag_on_failure"]
-          @logger.debug("ES|QL query executor initialized with ", query: @query, query_params: query_params)
-
-          # if the target is specified, all result entries will be copied to the target field
-          # otherwise, the first value of the result will be copied to the event
-          @target_field = plugin.params["target"]
-          @logger.warn("Only first query result will be copied to the event. Please specify `target` in plugin config to include all") if @target_field.nil?
-        end
-
-        def process(client, event)
-          resolved_params = @referenced_params&.any? ? resolve_parameters(event) : []
-          resolved_params.concat(@static_params) if @static_params&.any?
-          response = execute_query(client, resolved_params)
-          inform_warning(response)
-          process_response(event, response)
-          @event_decorator.call(event)
-        rescue => e
-          @logger.error("Failed to process ES|QL filter", exception: e)
-          @tag_on_failure.each { |tag| event.tag(tag) }
-        end
-
-        private
-
-        def resolve_parameters(event)
-          @referenced_params.map do |key, value|
-            begin
-              resolved_value = event.get(value)
-              @logger.debug("Resolved value for #{key}: #{resolved_value}, its class: #{resolved_value.class}")
-              { key => resolved_value }
-            rescue => e
-              # catches invalid field reference
-              raise "Failed to resolve parameter `#{key}` with `#{value}`. Error: #{e.message}"
-            end
-          end
-        end
-
-        def execute_query(client, params)
-          # debug logs may help to check what query shape the plugin is sending to ES
-          @logger.debug("Executing ES|QL query", query: @query, params: params)
-          client.esql_query({ body: { query: @query, params: params }, format: 'json', drop_null_columns: true })
-        end
-
-        def process_response(event, response)
-          columns = response['columns']&.freeze || []
-          values = response['values']&.freeze || []
-          if values.nil? || values.size == 0
-            @logger.debug("Empty ES|QL query result", columns: columns, values: values)
-            return
-          end
-
-          # this shouldn't happen but just in case to avoid crashes the plugin
-          if columns.nil? || columns.size == 0
-            @logger.error("No columns exist but received values", columns: columns, values: values)
-            return
-          end
-
-          event.set("[@metadata][total_values]", values.size)
-          @logger.debug("ES|QL query result values size ", size: values.size)
-
-          column_specs = columns.map { |column| ColumnSpec.new(column) }
-          sub_element_mark_map = mark_sub_elements(column_specs)
-          multi_fields = sub_element_mark_map.filter_map { |key, val| key.name if val == true }
-
-          @logger.debug("Multi-fields found in ES|QL result and they will not be available in the event. Please use `RENAME` command if you want to include them.", { :detected_multi_fields => multi_fields }) if multi_fields.any?
-
-          if @target_field
-            values_to_set = values.map do |row|
-              mapped_data = column_specs.each_with_index.with_object({}) do |(column, index), mapped_data|
-                # `unless value.nil?` is a part of `drop_null_columns` that if some of the columns' values are not `nil`, `nil` values appear,
-                # we should continuously filter them out to achieve full `drop_null_columns` on each individual row (ideal `LIMIT 1` result)
-                # we also exclude sub-elements of the base field
-                if row[index] && sub_element_mark_map[column] == false
-                  value_to_set = ESQL_PARSERS_BY_TYPE[column.type].call(row[index])
-                  mapped_data[column.name] = value_to_set
-                end
-              end
-              generate_nested_structure(mapped_data) unless mapped_data.empty?
-            end
-            event.set("[#{@target_field}]", values_to_set)
-          else
-            column_specs.zip(values.first).each do |(column, value) |
-              if value && sub_element_mark_map[column] == false
-                value_to_set = ESQL_PARSERS_BY_TYPE[column.type].call(value)
-                event.set(column.field_reference, value_to_set)
-              end
-            end
-          end
-        end
-
-        def inform_warning(response)
-          return unless (warning = response&.headers&.dig('warning'))
-          @logger.warn("ES|QL executor received warning", { message: warning })
-        end
-
-        # Transforms dotted keys to nested JSON shape
-        # @param dot_keyed_hash [Hash] whose keys are dotted (example 'a.b.c.d': 'val')
-        # @return [Hash] whose keys are nested with value mapped ({'a':{'b':{'c':{'d':'val'}}}})
-        def generate_nested_structure(dot_keyed_hash)
-          dot_keyed_hash.each_with_object({}) do |(key, value), result|
-            key_parts = key.to_s.split('.')
-            *path, leaf = key_parts
-            leaf_scope = path.inject(result) { |scope, part| scope[part] ||= {} }
-            leaf_scope[leaf] = value
-          end
-        end
-
-        # Determines whether each column in a collection is a nested sub-element (e.g "user.age")
-        # of another column in the same collection (e.g "user").
-        #
-        # @param columns [Array<ColumnSpec>] An array of objects with a `name` attribute representing field paths.
-        # @return [Hash<ColumnSpec, Boolean>] A hash mapping each column to `true` if it is a sub-element of another field, `false` otherwise.
-        # Time complexity: (O(NlogN+N*K)) where K is the number of conflict depth
-        #   without (`prefix_set`) memoization, it would be O(N^2)
-        def mark_sub_elements(columns)
-          # Sort columns by name length (ascending)
-          sorted_columns = columns.sort_by { |c| c.name.length }
-          prefix_set = Set.new # memoization set
-
-          sorted_columns.each_with_object({}) do |column, memo|
-            # Split the column name into parts (e.g., "user.profile.age" → ["user", "profile", "age"])
-            parts = column.name.split('.')
-
-            # Generate all possible parent prefixes (e.g., "user", "user.profile")
-            # and check if any parent prefix exists in the set
-            parent_prefixes = (0...parts.size - 1).map { |i| parts[0..i].join('.') }
-            memo[column] = parent_prefixes.any? { |prefix| prefix_set.include?(prefix) }
-            prefix_set.add(column.name)
-          end
-        end
-      end
-
-      # Class representing a column specification in the ESQL response['columns']
-      # The class's main purpose is to provide a structure for the event key
-      # columns is an array with `name` and `type` pair (example: `{"name"=>"@timestamp", "type"=>"date"}`)
-      # @attr_reader :name [String] The name of the column
-      # @attr_reader :type [String] The type of the column
-      class ColumnSpec
-        attr_reader :name, :type
-
-        def initialize(spec)
-          @name = isolate(spec.fetch('name'))
-          @type = isolate(spec.fetch('type'))
-        end
-
-        def field_reference
-          @_field_reference ||= '[' + name.gsub('.', '][') + ']'
-        end
-
-        private
-        def isolate(value)
-          value.frozen? ? value : value.clone.freeze
-        end
-      end
-    end
-  end
-end

data/spec/filters/elasticsearch_dsl_spec.rb

@@ -1,372 +0,0 @@
-# encoding: utf-8
-require "logstash/devutils/rspec/spec_helper"
-require "logstash/filters/elasticsearch"
-
-describe LogStash::Filters::Elasticsearch::DslExecutor do
-  let(:client) { instance_double(LogStash::Filters::ElasticsearchClient) }
-  let(:logger) { double("logger") }
-  let(:plugin) { LogStash::Filters::Elasticsearch.new(plugin_config) }
-  let(:plugin_config) do
-    {
-      "index" => "test_index",
-      "query" => "test_query",
-      "fields" => { "field1" => "field1_mapped" },
-      "result_size" => 10,
-      "docinfo_fields" => { "_id" => "doc_id" },
-      "tag_on_failure" => ["_failure"],
-      "enable_sort" => true,
-      "sort" => "@timestamp:desc",
-      "aggregation_fields" => { "agg1" => "agg1_mapped" }
-    }
-  end
-  let(:dsl_executor) { described_class.new(plugin, logger) }
-  let(:event) { LogStash::Event.new({}) }
-
-  describe "#initialize" do
-    it "initializes instance variables correctly" do
-      expect(dsl_executor.instance_variable_get(:@index)).to eq("test_index")
-      expect(dsl_executor.instance_variable_get(:@query)).to eq("test_query")
-      expect(dsl_executor.instance_variable_get(:@query_dsl)).to eq(nil)
-      expect(dsl_executor.instance_variable_get(:@fields)).to eq({ "field1" => "field1_mapped" })
-      expect(dsl_executor.instance_variable_get(:@result_size)).to eq(10)
-      expect(dsl_executor.instance_variable_get(:@docinfo_fields)).to eq({ "_id" => "doc_id" })
-      expect(dsl_executor.instance_variable_get(:@tag_on_failure)).to eq(["_failure"])
-      expect(dsl_executor.instance_variable_get(:@enable_sort)).to eq(true)
-      expect(dsl_executor.instance_variable_get(:@sort)).to eq("@timestamp:desc")
-      expect(dsl_executor.instance_variable_get(:@aggregation_fields)).to eq({ "agg1" => "agg1_mapped" })
-      expect(dsl_executor.instance_variable_get(:@logger)).to eq(logger)
-      expect(dsl_executor.instance_variable_get(:@event_decorator)).not_to be_nil
-    end
-  end
-
-  describe "data fetch" do
-    let(:plugin_config) do
-      {
-        "hosts" => ["localhost:9200"],
-        "query" => "response: 404",
-        "fields" => { "response" => "code" },
-        "docinfo_fields" => { "_index" => "es_index" },
-        "aggregation_fields" => { "bytes_avg" => "bytes_avg_ls_field" }
-      }
-    end
-
-    let(:response) do
-      LogStash::Json.load(File.read(File.join(File.dirname(__FILE__), "fixtures", "request_x_1.json")))
-    end
-
-    let(:client) { double(:client) }
-
-    before(:each) do
-      allow(LogStash::Filters::ElasticsearchClient).to receive(:new).and_return(client)
-      if defined?(Elastic::Transport)
-        allow(client).to receive(:es_transport_client_type).and_return('elastic_transport')
-      else
-        allow(client).to receive(:es_transport_client_type).and_return('elasticsearch_transport')
-      end
-      allow(client).to receive(:search).and_return(response)
-      allow(plugin).to receive(:test_connection!)
-      allow(plugin).to receive(:setup_serverless)
-      plugin.register
-    end
-
-    after(:each) do
-      Thread.current[:filter_elasticsearch_client] = nil
-    end
-
-    it "should enhance the current event with new data" do
-      plugin.filter(event)
-      expect(event.get("code")).to eq(404)
-      expect(event.get("es_index")).to eq("logstash-2014.08.26")
-      expect(event.get("bytes_avg_ls_field")["value"]).to eq(294)
-    end
-
-    it "should receive all necessary params to perform the search" do
-      expect(client).to receive(:search).with({:q=>"response: 404", :size=>1, :index=>"", :sort=>"@timestamp:desc"})
-      plugin.filter(event)
-    end
-
-    context "when asking to hit specific index" do
-
-      let(:plugin_config) do
-        {
-          "index" => "foo*",
-          "hosts" => ["localhost:9200"],
-          "query" => "response: 404",
-          "fields" => { "response" => "code" }
-        }
-      end
-
-      it "should receive all necessary params to perform the search" do
-        expect(client).to receive(:search).with({:q=>"response: 404", :size=>1, :index=>"foo*", :sort=>"@timestamp:desc"})
-        plugin.filter(event)
-      end
-    end
-
-    context "when asking for more than one result" do
-
-      let(:plugin_config) do
-        {
-          "hosts" => ["localhost:9200"],
-          "query" => "response: 404",
-          "fields" => { "response" => "code" },
-          "result_size" => 10
-        }
-      end
-
-      let(:response) do
-        LogStash::Json.load(File.read(File.join(File.dirname(__FILE__), "fixtures", "request_x_10.json")))
-      end
-
-      it "should enhance the current event with new data" do
-        plugin.filter(event)
-        expect(event.get("code")).to eq([404]*10)
-      end
-    end
-
-    context 'when Elasticsearch 7.x gives us a totals object instead of an integer' do
-      let(:plugin_config) do
-        {
-          "hosts" => ["localhost:9200"],
-          "query" => "response: 404",
-          "fields" => { "response" => "code" },
-          "result_size" => 10
-        }
-      end
-
-      let(:response) do
-        LogStash::Json.load(File.read(File.join(File.dirname(__FILE__), "fixtures", "elasticsearch_7.x_hits_total_as_object.json")))
-      end
-
-      it "should enhance the current event with new data" do
-        plugin.filter(event)
-        expect(event.get("[@metadata][total_hits]")).to eq(13476)
-      end
-    end
-
-    context "if something wrong happen during connection" do
-
-      before(:each) do
-        allow(LogStash::Filters::ElasticsearchClient).to receive(:new).and_return(client)
-        allow(client).to receive(:search).and_raise("connection exception")
-        plugin.register
-      end
-
-      it "tag the event as something happened, but still deliver it" do
-        expect(plugin.logger).to receive(:warn)
-        plugin.filter(event)
-        expect(event.to_hash["tags"]).to include("_elasticsearch_lookup_failure")
-      end
-    end
-
-    # Tagging test for positive results
-    context "Tagging should occur if query returns results" do
-      let(:plugin_config) do
-        {
-          "index" => "foo*",
-          "hosts" => ["localhost:9200"],
-          "query" => "response: 404",
-          "add_tag" => ["tagged"]
-        }
-      end
-
-      let(:response) do
-        LogStash::Json.load(File.read(File.join(File.dirname(__FILE__), "fixtures", "request_x_10.json")))
-      end
-
-      it "should tag the current event if results returned" do
-        plugin.filter(event)
-        expect(event.to_hash["tags"]).to include("tagged")
-      end
-    end
-
-    context "an aggregation search with size 0 that matches" do
-      let(:plugin_config) do
-        {
-          "index" => "foo*",
-          "hosts" => ["localhost:9200"],
-          "query" => "response: 404",
-          "add_tag" => ["tagged"],
-          "result_size" => 0,
-          "aggregation_fields" => { "bytes_avg" => "bytes_avg_ls_field" }
-        }
-      end
-
-      let(:response) do
-        LogStash::Json.load(File.read(File.join(File.dirname(__FILE__), "fixtures", "request_size0_agg.json")))
-      end
-
-      it "should tag the current event" do
-        plugin.filter(event)
-        expect(event.get("tags")).to include("tagged")
-        expect(event.get("bytes_avg_ls_field")["value"]).to eq(294)
-      end
-    end
-
-    # Tagging test for negative results
-    context "Tagging should not occur if query has no results" do
-      let(:plugin_config) do
-        {
-          "index" => "foo*",
-          "hosts" => ["localhost:9200"],
-          "query" => "response: 404",
-          "add_tag" => ["tagged"]
-        }
-      end
-
-      let(:response) do
-        LogStash::Json.load(File.read(File.join(File.dirname(__FILE__), "fixtures", "request_error.json")))
-      end
-
-      it "should not tag the current event" do
-        plugin.filter(event)
-        expect(event.to_hash["tags"]).to_not include("tagged")
-      end
-    end
-    context "testing a simple query template" do
-      let(:plugin_config) do
-        {
-          "hosts" => ["localhost:9200"],
-          "query_template" => File.join(File.dirname(__FILE__), "fixtures", "query_template.json"),
-          "fields" => { "response" => "code" },
-          "result_size" => 1
-        }
-      end
-
-      let(:response) do
-        LogStash::Json.load(File.read(File.join(File.dirname(__FILE__), "fixtures", "request_x_1.json")))
-      end
-
-      it "should enhance the current event with new data" do
-        plugin.filter(event)
-        expect(event.get("code")).to eq(404)
-      end
-
-    end
-
-    context "testing a simple index substitution" do
-      let(:event) {
-        LogStash::Event.new(
-          {
-            "subst_field" => "subst_value"
-          }
-        )
-      }
-      let(:plugin_config) do
-        {
-          "index" => "foo_%{subst_field}*",
-          "hosts" => ["localhost:9200"],
-          "query" => "response: 404",
-          "fields" => { "response" => "code" }
-        }
-      end
-
-      it "should receive substituted index name" do
-        expect(client).to receive(:search).with({:q => "response: 404", :size => 1, :index => "foo_subst_value*", :sort => "@timestamp:desc"})
-        plugin.filter(event)
-      end
-    end
-
-    context "if query result errored but no exception is thrown" do
-      let(:response) do
-        LogStash::Json.load(File.read(File.join(File.dirname(__FILE__), "fixtures", "request_error.json")))
-      end
-
-      before(:each) do
-        allow(LogStash::Filters::ElasticsearchClient).to receive(:new).and_return(client)
-        allow(client).to receive(:search).and_return(response)
-        plugin.register
-      end
-
-      it "tag the event as something happened, but still deliver it" do
-        expect(plugin.logger).to receive(:warn)
-        plugin.filter(event)
-        expect(event.to_hash["tags"]).to include("_elasticsearch_lookup_failure")
-      end
-    end
-
-    context 'with client-level retries' do
-      let(:plugin_config) do
-        super().merge(
-          "retry_on_failure" => 3,
-          "retry_on_status" => [500]
-        )
-      end
-    end
-
-    context "with custom headers" do
-      let(:plugin_config) do
-        {
-          "query" => "*",
-          "custom_headers" => { "Custom-Header-1" => "Custom Value 1", "Custom-Header-2" => "Custom Value 2" }
-        }
-      end
-
-      let(:plugin) { LogStash::Filters::Elasticsearch.new(plugin_config) }
-      let(:client_double) { double("client") }
-      let(:transport_double) { double("transport", options: { transport_options: { headers: plugin_config["custom_headers"] } }) }
-
-      before do
-        allow(plugin).to receive(:get_client).and_return(client_double)
-        if defined?(Elastic::Transport)
-          allow(client_double).to receive(:es_transport_client_type).and_return('elastic_transport')
-        else
-          allow(client_double).to receive(:es_transport_client_type).and_return('elasticsearch_transport')
-        end
-        allow(client_double).to receive(:client).and_return(transport_double)
-      end
-
-      it "sets custom headers" do
-        plugin.register
-        client = plugin.send(:get_client).client
-        expect(client.options[:transport_options][:headers]).to match(hash_including(plugin_config["custom_headers"]))
-      end
-    end
-
-    context "if query is on nested field" do
-      let(:plugin_config) do
-        {
-          "hosts" => ["localhost:9200"],
-          "query" => "response: 404",
-          "fields" => [ ["[geoip][ip]", "ip_address"] ]
-        }
-      end
-
-      it "should enhance the current event with new data" do
-        plugin.filter(event)
-        expect(event.get("ip_address")).to eq("66.249.73.185")
-      end
-
-    end
-  end
-
-  describe "#set_to_event_target" do
-    it 'is ready to set to `target`' do
-      expect(dsl_executor.apply_target("path")).to eq("path")
-    end
-
-    context "when `@target` is nil, default behavior" do
-      it "sets the value directly to the top-level event field" do
-        dsl_executor.send(:set_to_event_target, event, "new_field", %w[value1 value2])
-        expect(event.get("new_field")).to eq(%w[value1 value2])
-      end
-    end
-
-    context "when @target is defined" do
-      let(:plugin_config) {
-        super().merge({ "target" => "nested" })
-      }
-
-      it "creates a nested structure under the target field" do
-        dsl_executor.send(:set_to_event_target, event, "new_field", %w[value1 value2])
-        expect(event.get("nested")).to eq({ "new_field" => %w[value1 value2] })
-      end
-
-      it "overwrites existing target field with new data" do
-        event.set("nested", { "existing_field" => "existing_value", "new_field" => "value0" })
-        dsl_executor.send(:set_to_event_target, event, "new_field", ["value1"])
-        expect(event.get("nested")).to eq({ "existing_field" => "existing_value", "new_field" => ["value1"] })
-      end
-    end
-  end
-
-end