logstash-input-file 4.0.5 → 4.1.0

data/spec/filewatch/watched_file_spec.rb

@@ -0,0 +1,38 @@
+require 'stud/temporary'
+require_relative 'spec_helper'
+
+module FileWatch
+  describe WatchedFile do
+    let(:pathname) { Pathname.new(__FILE__) }
+
+    context 'Given two instances of the same file' do
+      it 'their sincedb_keys should equate' do
+        wf_key1 = WatchedFile.new(pathname, pathname.stat, Settings.new).sincedb_key
+        hash_db = { wf_key1 => 42 }
+        wf_key2 = WatchedFile.new(pathname, pathname.stat, Settings.new).sincedb_key
+        expect(wf_key1).to eq(wf_key2)
+        expect(wf_key1).to eql(wf_key2)
+        expect(wf_key1.hash).to eq(wf_key2.hash)
+        expect(hash_db[wf_key2]).to eq(42)
+      end
+    end
+
+    context 'Given a barrage of state changes' do
+      it 'only the previous N state changes are remembered' do
+        watched_file = WatchedFile.new(pathname, pathname.stat, Settings.new)
+        watched_file.ignore
+        watched_file.watch
+        watched_file.activate
+        watched_file.watch
+        watched_file.close
+        watched_file.watch
+        watched_file.activate
+        watched_file.unwatch
+        watched_file.activate
+        watched_file.close
+        expect(watched_file.closed?).to be_truthy
+        expect(watched_file.recent_states).to eq([:watched, :active, :watched, :closed, :watched, :active, :unwatched, :active])
+      end
+    end
+  end
+end

data/spec/filewatch/watched_files_collection_spec.rb

@@ -0,0 +1,73 @@
+require_relative 'spec_helper'
+
+module FileWatch
+  describe WatchedFilesCollection do
+    let(:time) { Time.now }
+    let(:stat1)  { double("stat1", :size => 98, :ctime => time - 30, :mtime => time - 30, :ino => 234567, :dev_major => 3, :dev_minor => 2) }
+    let(:stat2)  { double("stat2", :size => 99, :ctime => time - 20, :mtime => time - 20, :ino => 234568, :dev_major => 3, :dev_minor => 2) }
+    let(:stat3)  { double("stat3", :size => 100, :ctime => time, :mtime => time, :ino => 234569, :dev_major => 3, :dev_minor => 2) }
+    let(:wf1) { WatchedFile.new("/var/log/z.log", stat1, Settings.new) }
+    let(:wf2) { WatchedFile.new("/var/log/m.log", stat2, Settings.new) }
+    let(:wf3) { WatchedFile.new("/var/log/a.log", stat3, Settings.new) }
+
+    context "sort by last_modified in ascending order" do
+      let(:sort_by) { "last_modified" }
+      let(:sort_direction) { "asc" }
+
+      it "sorts earliest modified first" do
+        collection = described_class.new(Settings.from_options(:file_sort_by => sort_by, :file_sort_direction => sort_direction))
+        collection.add(wf2)
+        expect(collection.values).to eq([wf2])
+        collection.add(wf3)
+        expect(collection.values).to eq([wf2, wf3])
+        collection.add(wf1)
+        expect(collection.values).to eq([wf1, wf2, wf3])
+      end
+    end
+
+    context "sort by path in ascending order" do
+      let(:sort_by) { "path" }
+      let(:sort_direction) { "asc" }
+
+      it "sorts path A-Z" do
+        collection = described_class.new(Settings.from_options(:file_sort_by => sort_by, :file_sort_direction => sort_direction))
+        collection.add(wf2)
+        expect(collection.values).to eq([wf2])
+        collection.add(wf1)
+        expect(collection.values).to eq([wf2, wf1])
+        collection.add(wf3)
+        expect(collection.values).to eq([wf3, wf2, wf1])
+      end
+    end
+
+    context "sort by last_modified in descending order" do
+      let(:sort_by) { "last_modified" }
+      let(:sort_direction) { "desc" }
+
+      it "sorts latest modified first" do
+        collection = described_class.new(Settings.from_options(:file_sort_by => sort_by, :file_sort_direction => sort_direction))
+        collection.add(wf2)
+        expect(collection.values).to eq([wf2])
+        collection.add(wf1)
+        expect(collection.values).to eq([wf2, wf1])
+        collection.add(wf3)
+        expect(collection.values).to eq([wf3, wf2, wf1])
+      end
+    end
+
+    context "sort by path in descending order" do
+      let(:sort_by) { "path" }
+      let(:sort_direction) { "desc" }
+
+      it "sorts path Z-A" do
+        collection = described_class.new(Settings.from_options(:file_sort_by => sort_by, :file_sort_direction => sort_direction))
+        collection.add(wf2)
+        expect(collection.values).to eq([wf2])
+        collection.add(wf1)
+        expect(collection.values).to eq([wf1, wf2])
+        collection.add(wf3)
+        expect(collection.values).to eq([wf1, wf2, wf3])
+      end
+    end
+  end
+end

data/spec/filewatch/winhelper_spec.rb

@@ -0,0 +1,22 @@
+require "stud/temporary"
+require "fileutils"
+
+if Gem.win_platform?
+  require "lib/filewatch/winhelper"
+
+  describe Winhelper do
+    let(:path) { Stud::Temporary.file.path }
+
+    after do
+      FileUtils.rm_rf(path)
+    end
+
+    it "return a unique file identifier" do
+      volume_serial, file_index_low, file_index_high = Winhelper.GetWindowsUniqueFileIdentifier(path).split("").map(&:to_i)
+
+      expect(volume_serial).not_to eq(0)
+      expect(file_index_low).not_to eq(0)
+      expect(file_index_high).not_to eq(0)
+    end
+  end
+end

data/spec/fixtures/invalid_utf8.gbk.log

@@ -0,0 +1,2 @@
+2015-01-01T02:52:45.866722Z no "GET http://www.logstash.com:80/utfmadness/��4od HTTP/1.1"
+

data/spec/fixtures/no-final-newline.log

@@ -0,0 +1,2 @@
+2010-03-12   23:51:20   SEA4   192.0.2.147   connect   2014   OK   bfd8a98bee0840d9b871b7f6ade9908f   rtmp://shqshne4jdp4b6.cloudfront.net/cfx/st​  key=value   http://player.longtailvideo.com/player.swf   http://www.longtailvideo.com/support/jw-player-setup-wizard?example=204   LNX%2010,0,32,18   -   -   -   -
+2010-03-12   23:51:21   SEA4   192.0.2.222   play   3914   OK   bfd8a98bee0840d9b871b7f6ade9908f   rtmp://shqshne4jdp4b6.cloudfront.net/cfx/st​  key=value   http://player.longtailvideo.com/player.swf   http://www.longtailvideo.com/support/jw-player-setup-wizard?example=204   LNX%2010,0,32,18   myvideo   p=2&q=4   flv   1

data/spec/fixtures/uncompressed.log

@@ -0,0 +1,2 @@
+2010-03-12   23:51:20   SEA4   192.0.2.147   connect   2014   OK   bfd8a98bee0840d9b871b7f6ade9908f   rtmp://shqshne4jdp4b6.cloudfront.net/cfx/st​  key=value   http://player.longtailvideo.com/player.swf   http://www.longtailvideo.com/support/jw-player-setup-wizard?example=204   LNX%2010,0,32,18   -   -   -   -
+2010-03-12   23:51:21   SEA4   192.0.2.222   play   3914   OK   bfd8a98bee0840d9b871b7f6ade9908f   rtmp://shqshne4jdp4b6.cloudfront.net/cfx/st​  key=value   http://player.longtailvideo.com/player.swf   http://www.longtailvideo.com/support/jw-player-setup-wizard?example=204   LNX%2010,0,32,18   myvideo   p=2&q=4   flv   1

data/spec/{spec_helper.rb → helpers/spec_helper.rb}

@@ -4,41 +4,33 @@ require "logstash/devutils/rspec/spec_helper"
 require "rspec_sequencing"
 
 module FileInput
+
+  FIXTURE_DIR = File.join('spec', 'fixtures')
+
   def self.make_file_older(path, seconds)
     time = Time.now.to_f - seconds
-    File.utime(time, time, path)
+    ::File.utime(time, time, path)
+  end
+
+  def self.make_fixture_current(path, time = Time.now)
+    ::File.utime(time, time, path)
   end
-  
+
   class TracerBase
-    def initialize() @tracer = []; end
+    def initialize
+      @tracer = []
+    end
 
     def trace_for(symbol)
       params = @tracer.map {|k,v| k == symbol ? v : nil}.compact
       params.empty? ? false : params
     end
 
-    def clear()
-      @tracer.clear()
+    def clear
+      @tracer.clear
     end
   end
 
-  class FileLogTracer < TracerBase
-    def warn(*args) @tracer.push [:warn, args]; end
-    def error(*args) @tracer.push [:error, args]; end
-    def debug(*args) @tracer.push [:debug, args]; end
-    def info(*args) @tracer.push [:info, args]; end
-
-    def info?() true; end
-    def debug?() true; end
-    def warn?() true; end
-    def error?() true; end
-  end
-
-  class ComponentTracer < TracerBase
-    def accept(*args) @tracer.push [:accept, args]; end
-    def deliver(*args) @tracer.push [:deliver, args]; end
-  end
-
   class CodecTracer < TracerBase
     def decode_accept(ctx, data, listener)
       @tracer.push [:decode_accept, [ctx, data]]
@@ -62,25 +54,6 @@ module FileInput
   end
 end
 
-unless Kernel.method_defined?(:pause_until)
-  module Kernel
-    def pause_until(nap = 5, &block)
-      sq = SizedQueue.new(1)
-      th1 = Thread.new(sq) {|q| sleep nap; q.push(false) }
-      th2 = Thread.new(sq) do |q|
-        success = false
-        iters = nap * 5 + 1
-        iters.times do
-          break if !!(success = block.call)
-          sleep(0.2)
-        end
-        q.push(success)
-      end
-      sq.pop
-    end
-  end
-end
-
 unless RSpec::Matchers.method_defined?(:receive_call_and_args)
   RSpec::Matchers.define(:receive_call_and_args) do |m, args|
     match do |actual|

data/spec/inputs/file_read_spec.rb

@@ -0,0 +1,155 @@
+# encoding: utf-8
+
+require "helpers/spec_helper"
+require "logstash/inputs/file"
+
+# LogStash::Logging::Logger::configure_logging("DEBUG")
+
+require "tempfile"
+require "stud/temporary"
+require "logstash/codecs/multiline"
+
+FILE_DELIMITER = LogStash::Environment.windows? ? "\r\n" : "\n"
+
+describe LogStash::Inputs::File do
+  describe "'read' mode testing with input(conf) do |pipeline, queue|" do
+    it "should start at the beginning of an existing file and delete the file when done" do
+      tmpfile_path = Stud::Temporary.pathname
+      sincedb_path = Stud::Temporary.pathname
+
+      conf = <<-CONFIG
+        input {
+          file {
+            type => "blah"
+            path => "#{tmpfile_path}"
+            sincedb_path => "#{sincedb_path}"
+            delimiter => "#{FILE_DELIMITER}"
+            mode => "read"
+            file_completed_action => "delete"
+          }
+        }
+      CONFIG
+
+      File.open(tmpfile_path, "a") do |fd|
+        fd.puts("hello")
+        fd.puts("world")
+        fd.fsync
+      end
+
+      events = input(conf) do |pipeline, queue|
+        2.times.collect { queue.pop }
+      end
+
+      expect(events.map{|e| e.get("message")}).to contain_exactly("hello", "world")
+      expect(File.exist?(tmpfile_path)).to be_falsey
+    end
+  end
+
+  describe "reading fixtures" do
+    let(:fixture_dir) { Pathname.new(FileInput::FIXTURE_DIR).expand_path }
+
+    context "for a file without a final newline character" do
+      let(:file_path) { fixture_dir.join('no-final-newline.log') }
+
+      it "the file is read and the path is logged to the `file_completed_log_path` file" do
+        tmpfile_path = fixture_dir.join("no-f*.log")
+        sincedb_path = Stud::Temporary.pathname
+        FileInput.make_fixture_current(file_path.to_path)
+        log_completed_path = Stud::Temporary.pathname
+
+        conf = <<-CONFIG
+        input {
+          file {
+            type => "blah"
+            path => "#{tmpfile_path}"
+            sincedb_path => "#{sincedb_path}"
+            delimiter => "#{FILE_DELIMITER}"
+            mode => "read"
+            file_completed_action => "log"
+            file_completed_log_path => "#{log_completed_path}"
+          }
+        }
+        CONFIG
+
+        events = input(conf) do |pipeline, queue|
+          2.times.collect { queue.pop }
+        end
+
+        expect(events[0].get("message")).to start_with("2010-03-12   23:51")
+        expect(events[1].get("message")).to start_with("2010-03-12   23:51")
+        expect(IO.read(log_completed_path)).to eq(file_path.to_s + "\n")
+      end
+
+    end
+
+    context "for an uncompressed file" do
+      let(:file_path) { fixture_dir.join('uncompressed.log') }
+
+      it "the file is read and the path is logged to the `file_completed_log_path` file" do
+        tmpfile_path = fixture_dir.join("unc*.log")
+        sincedb_path = Stud::Temporary.pathname
+        FileInput.make_fixture_current(file_path.to_path)
+        log_completed_path = Stud::Temporary.pathname
+
+        conf = <<-CONFIG
+        input {
+          file {
+            type => "blah"
+            path => "#{tmpfile_path}"
+            sincedb_path => "#{sincedb_path}"
+            delimiter => "#{FILE_DELIMITER}"
+            mode => "read"
+            file_completed_action => "log"
+            file_completed_log_path => "#{log_completed_path}"
+          }
+        }
+        CONFIG
+
+        events = input(conf) do |pipeline, queue|
+          2.times.collect { queue.pop }
+        end
+
+        expect(events[0].get("message")).to start_with("2010-03-12   23:51")
+        expect(events[1].get("message")).to start_with("2010-03-12   23:51")
+        expect(IO.read(log_completed_path)).to eq(file_path.to_s + "\n")
+      end
+    end
+
+    context "for a compressed file" do
+      it "the file is read" do
+        tmpfile_path = fixture_dir.join("compressed.*.*")
+        sincedb_path = Stud::Temporary.pathname
+        file_path = fixture_dir.join('compressed.log.gz')
+        file_path2 = fixture_dir.join('compressed.log.gzip')
+        FileInput.make_fixture_current(file_path.to_path)
+        log_completed_path = Stud::Temporary.pathname
+
+        conf = <<-CONFIG
+        input {
+          file {
+            type => "blah"
+            path => "#{tmpfile_path}"
+            sincedb_path => "#{sincedb_path}"
+            delimiter => "#{FILE_DELIMITER}"
+            mode => "read"
+            file_completed_action => "log"
+            file_completed_log_path => "#{log_completed_path}"
+          }
+        }
+        CONFIG
+
+        events = input(conf) do |pipeline, queue|
+          4.times.collect { queue.pop }
+        end
+
+        expect(events[0].get("message")).to start_with("2010-03-12   23:51")
+        expect(events[1].get("message")).to start_with("2010-03-12   23:51")
+        expect(events[2].get("message")).to start_with("2010-03-12   23:51")
+        expect(events[3].get("message")).to start_with("2010-03-12   23:51")
+        logged_completions = IO.read(log_completed_path).split
+        expect(logged_completions.first).to match(/compressed\.log\.(gzip|gz)$/)
+        expect(logged_completions.last).to match(/compressed\.log\.(gzip|gz)$/)
+      end
+    end
+  end
+end

data/spec/inputs/{file_spec.rb → file_tail_spec.rb}

@@ -1,14 +1,18 @@
 # encoding: utf-8
-require_relative "../spec_helper"
+
+require "helpers/spec_helper"
 require "logstash/inputs/file"
+
 require "tempfile"
 require "stud/temporary"
 require "logstash/codecs/multiline"
 
-FILE_DELIMITER = LogStash::Environment.windows? ? "\r\n" : "\n"
+# LogStash::Logging::Logger::configure_logging("DEBUG")
+
+TEST_FILE_DELIMITER = LogStash::Environment.windows? ? "\r\n" : "\n"
 
 describe LogStash::Inputs::File do
-  describe "testing with input(conf) do |pipeline, queue|" do
+  describe "'tail' mode testing with input(conf) do |pipeline, queue|" do
     it_behaves_like "an interruptible input plugin" do
       let(:config) do
         {
@@ -29,7 +33,7 @@ describe LogStash::Inputs::File do
             path => "#{tmpfile_path}"
             start_position => "beginning"
             sincedb_path => "#{sincedb_path}"
-            delimiter => "#{FILE_DELIMITER}"
+            delimiter => "#{TEST_FILE_DELIMITER}"
           }
         }
       CONFIG
@@ -43,12 +47,10 @@ describe LogStash::Inputs::File do
       events = input(conf) do |pipeline, queue|
         2.times.collect { queue.pop }
       end
-
-      insist { events[0].get("message") } == "hello"
-      insist { events[1].get("message") } == "world"
+      expect(events.map{|e| e.get("message")}).to contain_exactly("hello", "world")
     end
 
-    it "should restarts at the sincedb value" do
+    it "should restart at the sincedb value" do
       tmpfile_path = Stud::Temporary.pathname
       sincedb_path = Stud::Temporary.pathname
 
@@ -59,7 +61,7 @@ describe LogStash::Inputs::File do
             path => "#{tmpfile_path}"
             start_position => "beginning"
             sincedb_path => "#{sincedb_path}"
-            delimiter => "#{FILE_DELIMITER}"
+            delimiter => "#{TEST_FILE_DELIMITER}"
           }
         }
       CONFIG
@@ -73,8 +75,7 @@ describe LogStash::Inputs::File do
         2.times.collect { queue.pop }
       end
 
-      insist { events[0].get("message") } == "hello3"
-      insist { events[1].get("message") } == "world3"
+      expect(events.map{|e| e.get("message")}).to contain_exactly("hello3", "world3")
 
       File.open(tmpfile_path, "a") do |fd|
         fd.puts("foo")
@@ -86,10 +87,8 @@ describe LogStash::Inputs::File do
       events = input(conf) do |pipeline, queue|
         3.times.collect { queue.pop }
       end
-
-      insist { events[0].get("message") } == "foo"
-      insist { events[1].get("message") } == "bar"
-      insist { events[2].get("message") } == "baz"
+      messages = events.map{|e| e.get("message")}
+      expect(messages).to contain_exactly("foo", "bar", "baz")
     end
 
     it "should not overwrite existing path and host fields" do
@@ -103,7 +102,7 @@ describe LogStash::Inputs::File do
             path => "#{tmpfile_path}"
             start_position => "beginning"
             sincedb_path => "#{sincedb_path}"
-            delimiter => "#{FILE_DELIMITER}"
+            delimiter => "#{TEST_FILE_DELIMITER}"
             codec => "json"
           }
         }
@@ -119,13 +118,15 @@ describe LogStash::Inputs::File do
         2.times.collect { queue.pop }
       end
 
-      insist { events[0].get("path") } == "my_path"
-      insist { events[0].get("host") } == "my_host"
-      insist { events[0].get("[@metadata][host]") } == "#{Socket.gethostname.force_encoding(Encoding::UTF_8)}"
+      existing_path_index, added_path_index  = "my_val" == events[0].get("my_field") ? [1,0] : [0,1]
 
-      insist { events[1].get("path") } == "#{tmpfile_path}"
-      insist { events[1].get("host") } == "#{Socket.gethostname.force_encoding(Encoding::UTF_8)}"
-      insist { events[1].get("[@metadata][host]") } == "#{Socket.gethostname.force_encoding(Encoding::UTF_8)}"
+      expect(events[existing_path_index].get("path")).to eq "my_path"
+      expect(events[existing_path_index].get("host")).to eq "my_host"
+      expect(events[existing_path_index].get("[@metadata][host]")).to eq "#{Socket.gethostname.force_encoding(Encoding::UTF_8)}"
+
+      expect(events[added_path_index].get("path")).to eq "#{tmpfile_path}"
+      expect(events[added_path_index].get("host")).to eq "#{Socket.gethostname.force_encoding(Encoding::UTF_8)}"
+      expect(events[added_path_index].get("[@metadata][host]")).to eq "#{Socket.gethostname.force_encoding(Encoding::UTF_8)}"
     end
 
     it "should read old files" do
@@ -153,14 +154,14 @@ describe LogStash::Inputs::File do
       events = input(conf) do |pipeline, queue|
         2.times.collect { queue.pop }
       end
-
-      insist { events[0].get("path") } == "my_path"
-      insist { events[0].get("host") } == "my_host"
-      insist { events[0].get("[@metadata][host]") } == "#{Socket.gethostname.force_encoding(Encoding::UTF_8)}"
-
-      insist { events[1].get("path") } == "#{tmpfile_path}"
-      insist { events[1].get("host") } == "#{Socket.gethostname.force_encoding(Encoding::UTF_8)}"
-      insist { events[1].get("[@metadata][host]") } == "#{Socket.gethostname.force_encoding(Encoding::UTF_8)}"
+      existing_path_index, added_path_index  = "my_val" == events[0].get("my_field") ? [1,0] : [0,1]
+      expect(events[existing_path_index].get("path")).to eq "my_path"
+      expect(events[existing_path_index].get("host")).to eq "my_host"
+      expect(events[existing_path_index].get("[@metadata][host]")).to eq "#{Socket.gethostname.force_encoding(Encoding::UTF_8)}"
+
+      expect(events[added_path_index].get("path")).to eq "#{tmpfile_path}"
+      expect(events[added_path_index].get("host")).to eq "#{Socket.gethostname.force_encoding(Encoding::UTF_8)}"
+      expect(events[added_path_index].get("[@metadata][host]")).to eq "#{Socket.gethostname.force_encoding(Encoding::UTF_8)}"
     end
 
     context "when sincedb_path is an existing directory" do
@@ -207,17 +208,17 @@ describe LogStash::Inputs::File do
               "sincedb_path" => sincedb_path,
               "stat_interval" => 0.1,
               "codec" => mlcodec,
-              "delimiter" => FILE_DELIMITER)
-        subject.register
+              "delimiter" => TEST_FILE_DELIMITER)
       end
 
       it "reads the appended data only" do
+        subject.register
         RSpec::Sequencing
-          .run_after(0.1, "assert zero events then append two lines") do
+          .run_after(0.2, "assert zero events then append two lines") do
             expect(events.size).to eq(0)
             File.open(tmpfile_path, "a") { |fd| fd.puts("hello"); fd.puts("world") }
           end
-          .then_after(0.25, "quit") do
+          .then_after(0.4, "quit") do
             subject.stop
           end
 
@@ -250,7 +251,7 @@ describe LogStash::Inputs::File do
               "stat_interval" => 0.02,
               "codec" => codec,
               "close_older" => 0.5,
-              "delimiter" => FILE_DELIMITER)
+              "delimiter" => TEST_FILE_DELIMITER)
 
         subject.register
       end
@@ -294,7 +295,7 @@ describe LogStash::Inputs::File do
               "stat_interval" => 0.02,
               "codec" => codec,
               "ignore_older" => 1,
-              "delimiter" => FILE_DELIMITER)
+              "delimiter" => TEST_FILE_DELIMITER)
 
         subject.register
         Thread.new { subject.run(events) }
@@ -320,7 +321,7 @@ describe LogStash::Inputs::File do
               "sincedb_path" => sincedb_path,
               "stat_interval" => 0.05,
               "codec" => mlcodec,
-              "delimiter" => FILE_DELIMITER)
+              "delimiter" => TEST_FILE_DELIMITER)
 
         subject.register
       end
@@ -355,13 +356,13 @@ describe LogStash::Inputs::File do
             if e1_message.start_with?('line1.1-of-z')
               expect(e1.get("path")).to match(/z.log/)
               expect(e2.get("path")).to match(/A.log/)
-              expect(e1_message).to eq("line1.1-of-z#{FILE_DELIMITER}  line1.2-of-z#{FILE_DELIMITER}  line1.3-of-z")
-              expect(e2_message).to eq("line1.1-of-a#{FILE_DELIMITER}  line1.2-of-a#{FILE_DELIMITER}  line1.3-of-a")
+              expect(e1_message).to eq("line1.1-of-z#{TEST_FILE_DELIMITER}  line1.2-of-z#{TEST_FILE_DELIMITER}  line1.3-of-z")
+              expect(e2_message).to eq("line1.1-of-a#{TEST_FILE_DELIMITER}  line1.2-of-a#{TEST_FILE_DELIMITER}  line1.3-of-a")
             else
               expect(e1.get("path")).to match(/A.log/)
               expect(e2.get("path")).to match(/z.log/)
-              expect(e1_message).to eq("line1.1-of-a#{FILE_DELIMITER}  line1.2-of-a#{FILE_DELIMITER}  line1.3-of-a")
-              expect(e2_message).to eq("line1.1-of-z#{FILE_DELIMITER}  line1.2-of-z#{FILE_DELIMITER}  line1.3-of-z")
+              expect(e1_message).to eq("line1.1-of-a#{TEST_FILE_DELIMITER}  line1.2-of-a#{TEST_FILE_DELIMITER}  line1.3-of-a")
+              expect(e2_message).to eq("line1.1-of-z#{TEST_FILE_DELIMITER}  line1.2-of-z#{TEST_FILE_DELIMITER}  line1.3-of-z")
             end
           end
         subject.run(events)
@@ -385,7 +386,7 @@ describe LogStash::Inputs::File do
               e1 = events.first
               e1_message = e1.get("message")
               expect(e1["path"]).to match(/a.log/)
-              expect(e1_message).to eq("line1.1-of-a#{FILE_DELIMITER}  line1.2-of-a#{FILE_DELIMITER}  line1.3-of-a")
+              expect(e1_message).to eq("line1.1-of-a#{TEST_FILE_DELIMITER}  line1.2-of-a#{TEST_FILE_DELIMITER}  line1.3-of-a")
             end
             .then("stop") do
               subject.stop
@@ -400,7 +401,6 @@ describe LogStash::Inputs::File do
     context "when #run is called multiple times", :unix => true do
       let(:file_path)    { "#{tmpdir_path}/a.log" }
       let(:buffer)       { [] }
-      let(:lsof)         { [] }
       let(:run_thread_proc) do
         lambda { Thread.new { subject.run(buffer) } }
       end
@@ -424,17 +424,20 @@ describe LogStash::Inputs::File do
         end
       end
 
-      it "should only have one set of files open" do
+      it "should only actually open files when content changes are detected" do
         subject.register
         expect(lsof_proc.call).to eq("")
+        # first run processes the file and records sincedb progress
         run_thread_proc.call
-        sleep 0.25
-        first_lsof = lsof_proc.call
-        expect(first_lsof.scan(file_path).size).to eq(1)
+        wait(1).for{lsof_proc.call.scan(file_path).size}.to eq(1)
+        # second run quits the first run
+        # sees the file has not changed size and does not open it
         run_thread_proc.call
-        sleep 0.25
-        second_lsof = lsof_proc.call
-        expect(second_lsof.scan(file_path).size).to eq(1)
+        wait(1).for{lsof_proc.call.scan(file_path).size}.to eq(0)
+        # truncate and write less than before
+        File.open(file_path, "w"){ |fd| fd.puts('baz'); fd.fsync }
+        # sees the file has changed size and does open it
+        wait(1).for{lsof_proc.call.scan(file_path).size}.to eq(1)
       end
     end
 
@@ -463,7 +466,7 @@ describe LogStash::Inputs::File do
                 "stat_interval" => 0.1,
                 "max_open_files" => 1,
                 "start_position" => "beginning",
-                "delimiter" => FILE_DELIMITER)
+                "delimiter" => TEST_FILE_DELIMITER)
           subject.register
         end
         it "collects line events from only one file" do
@@ -502,7 +505,7 @@ describe LogStash::Inputs::File do
                 "max_open_files" => 1,
                 "close_older" => 0.5,
                 "start_position" => "beginning",
-                "delimiter" => FILE_DELIMITER)
+                "delimiter" => TEST_FILE_DELIMITER)
           subject.register
         end