logstash-input-beats 3.1.24-java → 5.1.9-java

data/lib/logstash/inputs/beats.rb

@@ -2,7 +2,6 @@
 require "logstash/inputs/base"
 require "logstash/namespace"
 require "logstash/timestamp"
-require "logstash/codecs/identity_map_codec"
 require "logstash/codecs/multiline"
 require "logstash/util"
 require "logstash-input-beats_jars"
@@ -40,8 +39,7 @@ require_relative "beats/patch"
 # IMPORTANT: If you are shipping events that span multiple lines, you need to
 # use the configuration options available in Filebeat to handle multiline events
 # before sending the event data to Logstash. You cannot use the
-# <<plugins-codecs-multiline>> codec to handle multiline events. Doing so may
-# result in the mixing of streams and corrupted event data. 
+# <<plugins-codecs-multiline>> codec to handle multiline events.
 #
 class LogStash::Inputs::Beats < LogStash::Inputs::Base
   require "logstash/inputs/beats/codec_callback_listener"
@@ -84,6 +82,10 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
   # 
   config :ssl_certificate_authorities, :validate => :array, :default => []
 
+  # Flag to determine whether to add host information (provided by the beat in the 'hostname' field) to the event
+  config :add_hostname, :validate => :boolean, :default => true, :deprecated => 'Host field will not be automatically populated by future version of the Beats input'
+
+
   # By default the server doesn't do any client verification.
   # 
   # `peer` will make the server ask the client to provide a certificate. 
@@ -95,6 +97,10 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
   # This option needs to be used with `ssl_certificate_authorities` and a defined list of CAs.
   config :ssl_verify_mode, :validate => ["none", "peer", "force_peer"], :default => "none"
 
+  # Enables storing client certificate information in event's metadata. You need 
+  # to configure the `ssl_verify_mode` to `peer` or `force_peer` to enable this.
+  config :ssl_peer_metadata, :validate => :boolean, :default => false
+
   config :include_codec_tag, :validate => :boolean, :default => true
 
   # Time in milliseconds for an incomplete ssl handshake to timeout
@@ -102,10 +108,10 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
 
   # The number of seconds before we raise a timeout. 
   # This option is useful to control how much time to wait if something is blocking the pipeline.
-  config :congestion_threshold, :validate => :number, :default => 5, :deprecated => "This option is now deprecated since congestion control is done automatically"
+  config :congestion_threshold, :validate => :number, :obsolete => "This option is obsolete since congestion control is done automatically"
 
   # This is the default field to which the specified codec will be applied.
-  config :target_field_for_codec, :validate => :string, :default => "message", :deprecated => "This option is now deprecated, the plugin is now compatible with Filebeat and Logstash-Forwarder"
+  config :target_field_for_codec, :validate => :string, :obsolete => "This option is obsolete"
 
   # The minimum TLS version allowed for the encrypted connections. The value must be one of the following:
   # 1.0 for TLS 1.0, 1.1 for TLS 1.1, 1.2 for TLS 1.2
@@ -121,6 +127,9 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
   # Close Idle clients after X seconds of inactivity.
   config :client_inactivity_timeout, :validate => :number, :default => 60
 
+  # Beats handler executor thread
+  config :executor_threads, :validate => :number, :default => LogStash::Config::CpuCoreStrategy.maximum
+
   def register
     # For Logstash 2.4 we need to make sure that the logger is correctly set for the
     # java classes before actually loading them.
@@ -147,26 +156,22 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
       raise LogStash::ConfigurationError, "Using `verify_mode` set to PEER or FORCE_PEER, requires the configuration of `certificate_authorities`"
     end
 
+    if client_authentication_metadata? && !require_certificate_authorities?
+      raise LogStash::ConfigurationError, "Enabling `peer_metadata` requires using `verify_mode` set to PEER or FORCE_PEER"
+    end
+
+    # Logstash 6.x breaking change (introduced with 4.0.0 of this gem)
     if @codec.kind_of? LogStash::Codecs::Multiline
-      @logger.warn("WARNING! - Multiline codec with beats input has been deprecated. Support for this configuration will be removed in a future version. Please refer to the beats documentation for how to best manage multiline data. See https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html")
+      raise LogStash::ConfigurationError, "Multiline codec with beats input is not supported. Please refer to the beats documentation for how to best manage multiline data. See https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html"
     end
 
     @logger.info("Beats inputs: Starting input listener", :address => "#{@host}:#{@port}")
 
-    # wrap the configured codec to support identity stream
-    # from the producers if running with the multiline codec.
-    #
-    # If they dont need an identity map, codec are stateless and can be reused
-    # accross multiples connections.
-    if need_identity_map?
-      @codec = LogStash::Codecs::IdentityMapCodec.new(@codec)
-    end
-
     @server = create_server
   end # def register
 
   def create_server
-    server = org.logstash.beats.Server.new(@host, @port, @client_inactivity_timeout)
+    server = org.logstash.beats.Server.new(@host, @port, @client_inactivity_timeout, @executor_threads)
     if @ssl
 
       begin
@@ -182,13 +187,14 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
       if client_authentification?
         if @ssl_verify_mode.upcase == "FORCE_PEER"
             ssl_builder.setVerifyMode(org.logstash.netty.SslSimpleBuilder::SslClientVerifyMode::FORCE_PEER)
+        elsif @ssl_verify_mode.upcase == "PEER"
+            ssl_builder.setVerifyMode(org.logstash.netty.SslSimpleBuilder::SslClientVerifyMode::VERIFY_PEER)
         end
         ssl_builder.setCertificateAuthorities(@ssl_certificate_authorities)
       end
 
       server.enableSSL(ssl_builder)
     end
-
     server
   end
 
@@ -210,14 +216,18 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
     @server.stop unless @server.nil?
   end
 
-  def need_identity_map?
-    @codec.kind_of?(LogStash::Codecs::Multiline)
-  end
-
   def client_authentification?
     @ssl_certificate_authorities && @ssl_certificate_authorities.size > 0
   end
 
+  def client_authentication_metadata?
+    @ssl_peer_metadata && ssl_configured? && client_authentification? 
+  end
+
+  def client_authentication_required?
+    @ssl_verify_mode == "force_peer" 
+  end
+
   def require_certificate_authorities?
     @ssl_verify_mode == "force_peer" || @ssl_verify_mode == "peer"
   end

data/lib/logstash-input-beats_jars.rb

@@ -1,12 +1,12 @@
 # AUTOGENERATED BY THE GRADLE SCRIPT. DO NOT EDIT.
 
 require 'jar_dependencies'
-require_jar('io.netty', 'netty-all', '4.1.3.Final')
-require_jar('io.netty', 'netty-tcnative-boringssl-static', '1.1.33.Fork23')
-require_jar('org.javassist', 'javassist', '3.20.0-GA')
-require_jar('com.fasterxml.jackson.core', 'jackson-core', '2.7.5')
-require_jar('com.fasterxml.jackson.core', 'jackson-annotations', '2.7.5')
-require_jar('com.fasterxml.jackson.core', 'jackson-databind', '2.7.5')
-require_jar('com.fasterxml.jackson.module', 'jackson-module-afterburner', '2.7.5')
-require_jar('org.apache.logging.log4j', 'log4j-api', '2.6.2')
-require_jar('org.logstash.beats', 'logstash-input-beats', '3.1.24')
+require_jar('io.netty', 'netty-all', '4.1.30.Final')
+require_jar('io.netty', 'netty-tcnative-boringssl-static', '2.0.12.Final')
+require_jar('org.javassist', 'javassist', '3.24.0-GA')
+require_jar('com.fasterxml.jackson.core', 'jackson-core', '2.9.9')
+require_jar('com.fasterxml.jackson.core', 'jackson-annotations', '2.9.9')
+require_jar('com.fasterxml.jackson.core', 'jackson-databind', '2.9.9.3')
+require_jar('com.fasterxml.jackson.module', 'jackson-module-afterburner', '2.9.9')
+require_jar('org.apache.logging.log4j', 'log4j-api', '2.11.1')
+require_jar('org.logstash.beats', 'logstash-input-beats', '5.1.9')

data/logstash-input-beats.gemspec

@@ -4,7 +4,7 @@ Gem::Specification.new do |s|
   s.name            = "logstash-input-beats"
   s.version         = BEATS_VERSION
   s.licenses        = ["Apache License (2.0)"]
-  s.summary         = "Receive events using the lumberjack protocol."
+  s.summary         = "Receives events from the Elastic Beats framework"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
   s.authors         = ["Elastic"]
   s.email           = "info@elastic.co"
@@ -26,7 +26,7 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency "concurrent-ruby", "~> 1.0"
   s.add_runtime_dependency "thread_safe", "~> 0.3.5"
   s.add_runtime_dependency "logstash-codec-multiline", ">= 2.0.5"
-  s.add_runtime_dependency 'jar-dependencies', '~> 0.3.4'
+  s.add_runtime_dependency 'jar-dependencies', '~> 0.3', '>= 0.3.4'
 
   s.add_development_dependency "flores", "~>0.0.6"
   s.add_development_dependency "rspec"

data/spec/inputs/beats/message_listener_spec.rb

@@ -6,7 +6,10 @@ require "logstash/inputs/beats/message_listener"
 require "logstash/instrument/namespaced_null_metric"
 require "thread"
 
+java_import java.util.HashMap
+
 class MockMessage
+
   def initialize(identity_stream, data = {})
     @identity_stream = identity_stream
     @data = data
@@ -21,6 +24,22 @@ class MockMessage
   end
 end
 
+# General purpose single method mock class. Will keep generating mocks until requested method name (no args) is found.
+class OngoingMethodMock
+  def initialize(method_name, return_value)
+    @method_name = method_name
+    @return_value = return_value
+  end
+
+  def method_missing(method)
+    if(method.to_s.eql? @method_name)
+      return @return_value
+    else
+      return OngoingMethodMock.new(@method_name, @return_value)
+    end
+  end
+end
+
 class DummyCodec < LogStash::Codecs::Base
   DUMMY_EVENT = LogStash::Event.new
 
@@ -37,7 +56,11 @@ describe LogStash::Inputs::Beats::MessageListener do
   let(:queue)  { Queue.new }
   let(:codec) { DummyCodec.new }
   let(:input) { LogStash::Inputs::Beats.new({ "port" => 5555, "codec" => codec }) }
-  let(:ctx) { double("ChannelHandlerContext") }
+
+  let(:ip_address) { "10.0.0.1" }
+  let(:remote_address) { OngoingMethodMock.new("getHostAddress", ip_address) }
+  let(:ctx) {OngoingMethodMock.new("remoteAddress", remote_address)}
+
   let(:message) { MockMessage.new("abc", { "message" => "hello world"}) }
 
   subject { described_class.new(queue, input) }
@@ -47,28 +70,54 @@ describe LogStash::Inputs::Beats::MessageListener do
   end
 
   context "onNewConnection" do
-    it "register the connection to the connection list" do
-      expect { subject.onNewConnection(double("ChannelHandlerContext")) }.to change { subject.connections_list.count }.by(1)
+    let(:second_ip_address) { "10.0.0.2" }
+    let(:second_ctx) {OngoingMethodMock.new("getHostAddress", second_ip_address)}
+
+    shared_examples 'a valid new connection' do
+      it "register the connection to the connection list" do
+        expect { subject.onNewConnection(second_ctx) }.to change { subject.connections_list.count }.by(1)
+      end
+    end
+
+    it_behaves_like 'a valid new connection'
+
+    context 'with a nil remote address' do
+      let(:second_ip_address) { nil}
+
+      it_behaves_like 'a valid new connection'
+    end
+
+    context 'when the channel throws retrieving remote address' do
+      before do
+        allow(second_ctx).to receive(:channel).and_raise('nope')
+      end
+
+      it_behaves_like 'a valid new connection'
     end
 
     describe "metrics" do
       it "new connection should increment connection count" do
         expect(subject).to receive(:increment_connection_count).once
-        subject.onNewConnection(double("ChannelHandlerContext"))
+        subject.onNewConnection(second_ctx)
       end
 
       describe "peak connections" do
+        let (:ctxes) { [1, 2, 3, 4].inject([]) do |result, element|
+          result << OngoingMethodMock.new("getHostAddress", "10.0.0.#{element}")
+          result
+        end
+        }
         it "closing and open connections should keep highest count" do
           expect(subject.instance_eval("@peak_connection_count").value).to eq(1)
-          subject.onNewConnection(1)
+          subject.onNewConnection(ctxes[0])
           expect(subject.instance_eval("@peak_connection_count").value).to eq(2)
-          subject.onNewConnection(2)
+          subject.onNewConnection(ctxes[1])
           expect(subject.instance_eval("@peak_connection_count").value).to eq(3)
-          subject.onConnectionClose(2)
+          subject.onConnectionClose(ctxes[1])
           expect(subject.instance_eval("@peak_connection_count").value).to eq(3)
-          subject.onNewConnection(3)
+          subject.onNewConnection(ctxes[2])
           expect(subject.instance_eval("@peak_connection_count").value).to eq(3)
-          subject.onNewConnection(4)
+          subject.onNewConnection(ctxes[3])
           expect(subject.instance_eval("@peak_connection_count").value).to eq(4)
         end
       end
@@ -78,7 +127,7 @@ describe LogStash::Inputs::Beats::MessageListener do
 
   context "onNewMessage" do
     context "when the message is from filebeat" do
-      let(:message) { MockMessage.new("abc", { "message" => "hello world" } )}
+      let(:message) { MockMessage.new("abc", { "message" => "hello world", "@metadata" => {} } )}
 
       it "extract the event" do
         subject.onNewMessage(ctx, message)
@@ -88,7 +137,7 @@ describe LogStash::Inputs::Beats::MessageListener do
     end
 
     context "when the message is from LSF" do
-      let(:message) { MockMessage.new("abc", { "line" => "hello world" } )}
+      let(:message) { MockMessage.new("abc", { "line" => "hello world", '@metadata' => {} } )}
 
       it "extract the event" do
         subject.onNewMessage(ctx, message)
@@ -98,7 +147,16 @@ describe LogStash::Inputs::Beats::MessageListener do
     end
 
     context "when the message is from any libbeat" do
-      let(:message) { MockMessage.new("abc",  { "metric" => 1, "name" => "super-stats"} )}
+      #Requires data modeled as Java, not Ruby since the actual code pulls from Java backed (Netty) object
+      let(:data) do
+        d = HashMap.new
+        d.put('@metadata', HashMap.new)
+        d.put('metric',  1)
+        d.put('name', "super-stats")
+        d
+      end
+
+      let(:message) { MockMessage.new("abc",  data)}
 
       it "extract the event" do
         subject.onNewMessage(ctx, message)
@@ -106,7 +164,40 @@ describe LogStash::Inputs::Beats::MessageListener do
         expect(event.get("message")).to be_nil
         expect(event.get("metric")).to eq(1)
         expect(event.get("name")).to eq("super-stats")
+        expect(event.get("[@metadata][ip_address]")).to eq(ip_address)
       end
+
+      context 'when the remote address is nil' do
+        let(:ctx) { OngoingMethodMock.new("remoteAddress", nil)}
+
+        it 'extracts the event' do
+          subject.onNewMessage(ctx, message)
+          event = queue.pop
+          expect(event.get("message")).to be_nil
+          expect(event.get("metric")).to eq(1)
+          expect(event.get("name")).to eq("super-stats")
+          expect(event.get("[@metadata][ip_address]")).to eq(nil)
+        end
+      end
+
+      context 'when getting the remote address raises' do
+        let(:raising_ctx) { double("context")}
+
+        before  do
+          allow(raising_ctx).to receive(:channel).and_raise("nope")
+          subject.onNewConnection(raising_ctx)
+        end
+
+        it 'extracts the event' do
+          subject.onNewMessage(raising_ctx, message)
+          event = queue.pop
+          expect(event.get("message")).to be_nil
+          expect(event.get("metric")).to eq(1)
+          expect(event.get("name")).to eq("super-stats")
+          expect(event.get("[@metadata][ip_address]")).to eq(nil)
+        end
+      end
+
     end
   end
 

data/spec/inputs/beats_spec.rb

@@ -16,43 +16,20 @@ describe LogStash::Inputs::Beats do
 
   context "#register" do
     context "host related configuration" do
-      let(:config) { super.merge!({ "host" => host, "port" => port, "client_inactivity_timeout" => client_inactivity_timeout }) }
+      let(:config) { super.merge!({ "host" => host, "port" => port, "client_inactivity_timeout" => client_inactivity_timeout, "executor_threads" => threads }) }
       let(:host) { "192.168.1.20" }
       let(:port) { 9000 }
       let(:client_inactivity_timeout) { 400 }
+      let(:threads) { 10 }
 
       subject(:plugin) { LogStash::Inputs::Beats.new(config) }
 
       it "sends the required options to the server" do
-        expect(org.logstash.beats.Server).to receive(:new).with(host, port, client_inactivity_timeout)
+        expect(org.logstash.beats.Server).to receive(:new).with(host, port, client_inactivity_timeout, threads)
         subject.register
       end
     end
 
-    context "identity map" do
-      subject(:plugin) { LogStash::Inputs::Beats.new(config) }
-      before { plugin.register }
-
-      context "when using the multiline codec" do
-        let(:codec) { LogStash::Codecs::Multiline.new("pattern" => '^2015',
-                                                      "what" => "previous",
-                                                      "negate" => true) }
-        let(:config) { super.merge({ "codec" => codec }) }
-
-        it "wraps the codec with the identity_map" do
-          expect(plugin.codec).to be_kind_of(LogStash::Codecs::IdentityMapCodec)
-        end
-      end
-
-      context "when using non buffered codecs" do
-        let(:config) { super.merge({ "codec" => "json" }) }
-
-        it "doesnt wrap the codec with the identity map" do
-          expect(plugin.codec).to be_kind_of(LogStash::Codecs::JSON)
-        end
-      end
-    end
-
     it "raise no exception" do
       plugin = LogStash::Inputs::Beats.new(config)
       expect { plugin.register }.not_to raise_error
@@ -146,6 +123,18 @@ describe LogStash::Inputs::Beats do
         end
       end
     end
+
+    context "with multiline codec" do
+      let(:codec) { LogStash::Codecs::Multiline.new("pattern" => '^2015',
+                                                    "what" => "previous",
+                                                    "negate" => true) }
+      let(:config) { super.merge({ "codec" => codec }) }
+
+      it "raise a ConfigurationError when multiline codec is set" do
+        plugin = LogStash::Inputs::Beats.new(config)
+        expect {plugin.register}.to raise_error(LogStash::ConfigurationError, "Multiline codec with beats input is not supported. Please refer to the beats documentation for how to best manage multiline data. See https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html")
+      end
+    end
   end
 
   context "when interrupting the plugin" do

data/spec/integration/logstash_forwarder_spec.rb

@@ -55,7 +55,6 @@ describe "Logstash-Forwarder", :integration => true do
       f.write(events.join("\n") + "\n")
     end
     sleep(1) # give some time to the clients to pick up the changes
-    stop_client
   end
 
   after :each do

data/spec/support/client_process_helpers.rb

@@ -32,10 +32,12 @@ module ClientProcessHelpers
   end
 
   def stop_client
-    begin
-      @process.poll_for_exit(5)
-    rescue ChildProcess::TimeoutError
-      Process.kill("KILL", @process.pid)
+    unless @process.nil?
+      begin
+        @process.poll_for_exit(5)
+      rescue ChildProcess::TimeoutError
+        Process.kill("KILL", @process.pid)
+      end
     end
   end
 end

data/spec/support/helpers.rb

@@ -11,6 +11,13 @@ OPEN_SSL_TOPK8 = "openssl pkcs8 -nocrypt -topk8 -inform PEM -outform PEM"
 #
 def convert_to_pkcs8(key)
   out, e, s = Open3.capture3(OPEN_SSL_TOPK8, :stdin_data => key.to_s)
-  raise e if e != ""
+  # attempt to address random failures by trying again
+  unless s.success?
+    sleep 1
+    out, e, s = Open3.capture3(OPEN_SSL_TOPK8, :stdin_data => key.to_s)
+    raise e if e != ""
+    out
+  end
+
   out
 end

data/spec/support/shared_examples.rb

@@ -25,31 +25,126 @@ shared_examples "Common Event Transformation" do
     expect(subject.get("tags")).to include(tag)
   end
 
-  context "when the `beats.hostname` doesnt exist on the event" do
-    let(:already_exist) { "already_exist" }
-    let(:event_map) { super.merge({ "host" => already_exist }) }
+  context 'when add_hostname is true' do
+    let(:config) { super.merge({'add_hostname' => true})}
 
-    it "doesnt change the value" do
-      expect(subject.get("host")).to eq(already_exist)
+    context 'when a host is provided in beat.host.name' do
+      let(:already_exist) { "already_exist" }
+      let(:producer_host) { "newhost01" }
+      let(:event_map) { super.merge({ "beat" => { "host" => {"name" => producer_host }}}) }
+
+      context "when no `host` key already exists on the event" do
+        it "does not set the host value" do
+          expect(subject.get("host")).to be_nil
+        end
+      end
+
+      context "when `host` key exists on the event" do
+        let(:already_exist) { "already_exist" }
+        let(:event_map) { super.merge({ "host" => already_exist }) }
+
+        it "doesn't override it" do
+          expect(subject.get("host")).to eq(already_exist)
+        end
+      end
     end
-  end
 
-  context "when the `beat.hostname` exist in the event" do
-    let(:producer_host) { "newhost01" }
-    let(:event_map) { super.merge({ "beat" => { "hostname" => producer_host }}) }
+    context "when a host is set in `beat.hostname`" do
+      let(:producer_host) { "newhost01" }
+      let(:event_map) { super.merge({ "beat" => { "hostname" => producer_host }}) }
 
-    context "when `host` key doesn't exist on the event" do
-      it "copy the `beat.hostname` to `host` or backward compatibility" do
-        expect(subject.get("host")).to eq(producer_host)
+      context "when no `host` key already exists on the event" do
+        it "copies the value in `beat.hostname` to `host`" do
+          expect(subject.get("host")).to eq(producer_host)
+        end
+      end
+
+      context "when `host` key exists on the event" do
+        let(:already_exist) { "already_exist" }
+        let(:event_map) { super.merge({ "host" => already_exist }) }
+
+        it "doesn't override it" do
+          expect(subject.get("host")).to eq(already_exist)
+        end
+      end
+    end
+
+    context "when no host is provided in beat" do
+      context "when no `host` key already exists on the event" do
+        it "does not set the host" do
+          expect(subject.get("host")).to be_nil
+        end
+      end
+
+      context "when `host` key already exists on the event" do
+        let(:already_exist) { "already_exist" }
+        let(:event_map) { super.merge({ "host" => already_exist }) }
+
+        it "doesn't override it" do
+          expect(subject.get("host")).to eq(already_exist)
+        end
       end
     end
+  end
 
-    context "when `host` key exists on the event" do
+  context 'when add hostname is false' do
+    let(:config) { super.merge({'add_hostname' => false})}
+
+    context 'when a host is provided in beat.host.name' do
       let(:already_exist) { "already_exist" }
-      let(:event_map) { super.merge({ "host" => already_exist }) }
+      let(:producer_host) { "newhost01" }
+      let(:event_map) { super.merge({ "beat" => { "host" => {"name" => producer_host }}}) }
+
+      context "when no `host` key already exists on the event" do
+        it "does not set the host" do
+          expect(subject.get("host")).to be_nil
+        end
+      end
+
+      context "when `host` key already exists on the event" do
+        let(:already_exist) { "already_exist" }
+        let(:event_map) { super.merge({ "host" => already_exist }) }
+
+        it "doesn't override it" do
+          expect(subject.get("host")).to eq(already_exist)
+        end
+      end
+    end
+
+    context "when a host is provided in `beat.hostname`" do
+      let(:producer_host) { "newhost01" }
+      let(:event_map) { super.merge({ "beat" => { "hostname" => producer_host }}) }
+
+      context "when no `host` key already exists on the event" do
+        it "does not set the host" do
+          expect(subject.get("host")).to be_nil
+        end
+      end
+
+      context "when `host` key already exists on the event" do
+        let(:already_exist) { "already_exist" }
+        let(:event_map) { super.merge({ "host" => already_exist }) }
+
+        it "doesn't override it" do
+          expect(subject.get("host")).to eq(already_exist)
+        end
+      end
+    end
+
+    context "when no host is provided in beat" do
+      context "when no `host` key already exists on the event" do
+        it "does not set the host" do
+          expect(subject.get("host")).to be_nil
+        end
+      end
+
+      context "when `host` key already exists on the event" do
+        let(:already_exist) { "already_exist" }
+        let(:event_map) { super.merge({ "host" => already_exist }) }
 
-      it "doesn't override it" do
-        expect(subject.get("host")).to eq(already_exist)
+        it "doesn't override it" do
+          expect(subject.get("host")).to eq(already_exist)
+        end
       end
     end
   end