logstash-lib 1.3.2

data/spec/codecs/oldlogstashjson.rb

@@ -0,0 +1,55 @@
+require "logstash/codecs/oldlogstashjson"
+require "logstash/event"
+require "insist"
+
+describe LogStash::Codecs::OldLogStashJSON do
+  subject do
+    next LogStash::Codecs::OldLogStashJSON.new
+  end
+
+  context "#decode" do
+    it "should return a new (v1) event from old (v0) json data" do
+      data = {"@message" => "bar", "@source_host" => "localhost",
+              "@tags" => ["a","b","c"]}
+      subject.decode(data.to_json) do |event|
+        insist { event.is_a? LogStash::Event }
+        insist { event["@timestamp"] } != nil
+        insist { event["type"] } == data["@type"]
+        insist { event["message"] } == data["@message"]
+        insist { event["host"] } == data["@source_host"]
+        insist { event["tags"] } == data["@tags"]
+        insist { event["path"] } == nil # @source_path not in v0 test data
+      end
+    end
+
+    it "should accept invalid json" do
+      subject.decode("some plain text") do |event|
+        insist { event["message"] } == "some plain text"
+      end
+    end
+  end
+
+  context "#encode" do
+    it "should return old (v0) json data" do
+      data = {"type" => "t", "message" => "wat!?",
+              "host" => "localhost", "path" => "/foo",
+              "tags" => ["a","b","c"],
+              "bah" => "baz"}
+      event = LogStash::Event.new(data)
+      got_event = false
+      subject.on_event do |d|
+        insist { JSON.parse(d)["@timestamp"] } != nil
+        insist { JSON.parse(d)["@type"] } == data["type"]
+        insist { JSON.parse(d)["@message"] } == data["message"]
+        insist { JSON.parse(d)["@source_host"] } == data["host"]
+        insist { JSON.parse(d)["@source_path"] } == data["path"]
+        insist { JSON.parse(d)["@tags"] } == data["tags"]
+        insist { JSON.parse(d)["@fields"]["bah"] } == "baz"
+        insist { JSON.parse(d)["@fields"]["@version"] } == nil
+        got_event = true
+      end
+      subject.encode(event)
+      insist { got_event }
+    end
+  end
+end

data/spec/codecs/plain.rb

@@ -0,0 +1,35 @@
+require "logstash/codecs/plain"
+require "logstash/event"
+require "insist"
+
+describe LogStash::Codecs::Plain do
+  context "#decode" do
+    it "should return a valid event" do
+      subject.decode("Testing decoding.") do |event|
+        insist { event.is_a? LogStash::Event }
+      end
+    end
+  end
+
+  context "#encode" do
+    it "should return a plain text encoding" do
+      event = LogStash::Event.new
+      event["message"] = "Hello World."
+      subject.on_event do |data|
+        insist { data } == event.to_s
+      end
+      subject.encode(event)
+    end
+
+    it "should respect the format setting" do
+      format = "%{[hello]} %{[something][fancy]}"
+      codec = LogStash::Codecs::Plain.new("format" => format)
+      event = LogStash::Event.new("hello" => "world", "something" => { "fancy" => 123 })
+      codec.on_event do |data|
+        insist { data } == event.sprintf(format)
+      end
+      codec.encode(event)
+    end
+
+  end
+end

data/spec/codecs/spool.rb

@@ -0,0 +1,35 @@
+require "logstash/codecs/spool"
+require "logstash/event"
+require "insist"
+
+describe LogStash::Codecs::Spool do
+  subject do
+    next LogStash::Codecs::Spool.new
+  end
+
+  context "#decode" do
+    it "should return multiple spooled events" do
+      e1 = LogStash::Event.new
+      e2 = LogStash::Event.new
+      e3 = LogStash::Event.new
+      subject.decode([e1,e2,e3]) do |event|
+        insist { event.is_a? LogStash::Event }
+      end
+    end
+  end
+
+  context "#encode" do
+    it "should return a spooled event" do
+      spool_size = Random.rand(10)
+      subject.spool_size = spool_size
+      got_event = false
+      subject.on_event do |data|
+        got_event = true
+      end
+      spool_size.times do
+        subject.encode(LogStash::Event.new)
+      end
+      insist { got_event }
+    end
+  end
+end

data/spec/conditionals/test.rb

@@ -0,0 +1,323 @@
+require "test_utils"
+
+module ConditionalFancines
+  def description
+    return example.metadata[:example_group][:description_args][0]
+  end
+
+  def conditional(expression, &block)
+    describe(expression) do
+      config <<-CONFIG
+        filter {
+          if #{expression} {
+            mutate { add_tag => "success" }
+          } else {
+            mutate { add_tag => "failure" }
+          }
+        }
+      CONFIG
+      instance_eval(&block)
+    end
+  end
+end
+
+describe "conditionals" do
+  extend LogStash::RSpec
+  extend ConditionalFancines
+
+  describe "simple" do
+    config <<-CONFIG
+      filter {
+        mutate { add_field => { "always" => "awesome" } }
+        if [foo] == "bar" {
+          mutate { add_field => { "hello" => "world" } }
+        } else if [bar] == "baz" {
+          mutate { add_field => { "fancy" => "pants" } }
+        } else {
+          mutate { add_field => { "free" => "hugs" } }
+        }
+      }
+    CONFIG
+
+    sample({"foo" => "bar"}) do
+      insist { subject["always"] } == "awesome"
+      insist { subject["hello"] } == "world"
+      insist { subject["fancy"] }.nil?
+      insist { subject["free"] }.nil?
+    end
+
+    sample({"notfoo" => "bar"}) do
+      insist { subject["always"] } == "awesome"
+      insist { subject["hello"] }.nil?
+      insist { subject["fancy"] }.nil?
+      insist { subject["free"] } == "hugs"
+    end
+
+    sample({"bar" => "baz"}) do
+      insist { subject["always"] } == "awesome"
+      insist { subject["hello"] }.nil?
+      insist { subject["fancy"] } == "pants"
+      insist { subject["free"] }.nil?
+    end
+  end
+
+  describe "nested" do
+    config <<-CONFIG
+      filter {
+        if [nest] == 123 {
+          mutate { add_field => { "always" => "awesome" } }
+          if [foo] == "bar" {
+            mutate { add_field => { "hello" => "world" } }
+          } else if [bar] == "baz" {
+            mutate { add_field => { "fancy" => "pants" } }
+          } else {
+            mutate { add_field => { "free" => "hugs" } }
+          }
+        }
+      }
+    CONFIG
+
+    sample("foo" => "bar", "nest" => 124) do
+      insist { subject["always"] }.nil?
+      insist { subject["hello"] }.nil?
+      insist { subject["fancy"] }.nil?
+      insist { subject["free"] }.nil?
+    end
+
+    sample("foo" => "bar", "nest" => 123) do
+      insist { subject["always"] } == "awesome"
+      insist { subject["hello"] } == "world"
+      insist { subject["fancy"] }.nil?
+      insist { subject["free"] }.nil?
+    end
+
+    sample("notfoo" => "bar", "nest" => 123) do
+      insist { subject["always"] } == "awesome"
+      insist { subject["hello"] }.nil?
+      insist { subject["fancy"] }.nil?
+      insist { subject["free"] } == "hugs"
+    end
+
+    sample("bar" => "baz", "nest" => 123) do
+      insist { subject["always"] } == "awesome"
+      insist { subject["hello"] }.nil?
+      insist { subject["fancy"] } == "pants"
+      insist { subject["free"] }.nil?
+    end
+  end
+
+  describe "comparing two fields" do
+    config <<-CONFIG
+      filter {
+        if [foo] == [bar] {
+          mutate { add_tag => woot }
+        }
+      }
+    CONFIG
+
+    sample("foo" => 123, "bar" => 123) do
+      insist { subject["tags"] }.include?("woot")
+    end
+  end
+
+  describe "the 'in' operator" do
+    config <<-CONFIG
+      filter {
+        if [foo] in [foobar] {
+          mutate { add_tag => "field in field" }
+        }
+        if [foo] in "foo" {
+          mutate { add_tag => "field in string" }
+        }
+        if "hello" in [greeting] {
+          mutate { add_tag => "string in field" }
+        }
+        if [foo] in ["hello", "world", "foo"] {
+          mutate { add_tag => "field in list" }
+        }
+        if [missing] in [alsomissing] {
+          mutate { add_tag => "shouldnotexist" }
+        }
+        if !("foo" in ["hello", "world"]) {
+          mutate { add_tag => "shouldexist" }
+        }
+      }
+    CONFIG
+
+    sample("foo" => "foo", "foobar" => "foobar", "greeting" => "hello world") do
+      insist { subject["tags"] }.include?("field in field")
+      insist { subject["tags"] }.include?("field in string")
+      insist { subject["tags"] }.include?("string in field")
+      insist { subject["tags"] }.include?("field in list")
+      reject { subject["tags"] }.include?("shouldnotexist")
+      insist { subject["tags"] }.include?("shouldexist")
+    end
+  end
+
+  describe "the 'not in' operator" do
+    config <<-CONFIG
+      filter {
+        if "foo" not in "baz" { mutate { add_tag => "baz" } }
+        if "foo" not in "foo" { mutate { add_tag => "foo" } }
+        if !("foo" not in "foo") { mutate { add_tag => "notfoo" } }
+        if "foo" not in [somelist] { mutate { add_tag => "notsomelist" } } 
+        if "one" not in [somelist] { mutate { add_tag => "somelist" } }
+        if "foo" not in [alsomissing] { mutate { add_tag => "no string in missing field" } }
+      }
+    CONFIG
+
+    sample("foo" => "foo", "somelist" => [ "one", "two" ], "foobar" => "foobar", "greeting" => "hello world", "tags" => [ "fancypantsy" ]) do
+      # verify the original exists
+      insist { subject["tags"] }.include?("fancypantsy")
+
+      insist { subject["tags"] }.include?("baz")
+      reject { subject["tags"] }.include?("foo")
+      insist { subject["tags"] }.include?("notfoo")
+      insist { subject["tags"] }.include?("notsomelist")
+      reject { subject["tags"] }.include?("somelist")
+      insist { subject["tags"] }.include?("no string in missing field")
+    end
+  end
+
+  describe "operators" do
+    conditional "[message] == 'sample'" do
+      sample("sample") { insist { subject["tags"] }.include?("success") }
+      sample("different") { insist { subject["tags"] }.include?("failure") }
+    end 
+
+    conditional "[message] != 'sample'" do
+      sample("sample") { insist { subject["tags"] }.include?("failure") }
+      sample("different") { insist { subject["tags"] }.include?("success") }
+    end 
+
+    conditional "[message] < 'sample'" do
+      sample("apple") { insist { subject["tags"] }.include?("success") }
+      sample("zebra") { insist { subject["tags"] }.include?("failure") }
+    end
+
+    conditional "[message] > 'sample'" do
+      sample("zebra") { insist { subject["tags"] }.include?("success") }
+      sample("apple") { insist { subject["tags"] }.include?("failure") }
+    end
+
+    conditional "[message] <= 'sample'" do
+      sample("apple") { insist { subject["tags"] }.include?("success") }
+      sample("zebra") { insist { subject["tags"] }.include?("failure") }
+      sample("sample") { insist { subject["tags"] }.include?("success") }
+    end
+
+    conditional "[message] >= 'sample'" do
+      sample("zebra") { insist { subject["tags"] }.include?("success") }
+      sample("sample") { insist { subject["tags"] }.include?("success") }
+      sample("apple") { insist { subject["tags"] }.include?("failure") }
+    end
+
+    conditional "[message] =~ /sample/" do
+      sample("apple") { insist { subject["tags"] }.include?("failure") }
+      sample("sample") { insist { subject["tags"] }.include?("success") }
+      sample("some sample") { insist { subject["tags"] }.include?("success") }
+    end
+
+    conditional "[message] !~ /sample/" do
+      sample("apple") { insist { subject["tags"] }.include?("success") }
+      sample("sample") { insist { subject["tags"] }.include?("failure") }
+      sample("some sample") { insist { subject["tags"] }.include?("failure") }
+    end
+
+  end
+
+  describe "negated expressions" do
+    conditional "!([message] == 'sample')" do
+      sample("sample") { reject { subject["tags"] }.include?("success") }
+      sample("different") { reject { subject["tags"] }.include?("failure") }
+    end 
+
+    conditional "!([message] != 'sample')" do
+      sample("sample") { reject { subject["tags"] }.include?("failure") }
+      sample("different") { reject { subject["tags"] }.include?("success") }
+    end 
+
+    conditional "!([message] < 'sample')" do
+      sample("apple") { reject { subject["tags"] }.include?("success") }
+      sample("zebra") { reject { subject["tags"] }.include?("failure") }
+    end
+
+    conditional "!([message] > 'sample')" do
+      sample("zebra") { reject { subject["tags"] }.include?("success") }
+      sample("apple") { reject { subject["tags"] }.include?("failure") }
+    end
+
+    conditional "!([message] <= 'sample')" do
+      sample("apple") { reject { subject["tags"] }.include?("success") }
+      sample("zebra") { reject { subject["tags"] }.include?("failure") }
+      sample("sample") { reject { subject["tags"] }.include?("success") }
+    end
+
+    conditional "!([message] >= 'sample')" do
+      sample("zebra") { reject { subject["tags"] }.include?("success") }
+      sample("sample") { reject { subject["tags"] }.include?("success") }
+      sample("apple") { reject { subject["tags"] }.include?("failure") }
+    end
+
+    conditional "!([message] =~ /sample/)" do
+      sample("apple") { reject { subject["tags"] }.include?("failure") }
+      sample("sample") { reject { subject["tags"] }.include?("success") }
+      sample("some sample") { reject { subject["tags"] }.include?("success") }
+    end
+
+    conditional "!([message] !~ /sample/)" do
+      sample("apple") { reject { subject["tags"] }.include?("success") }
+      sample("sample") { reject { subject["tags"] }.include?("failure") }
+      sample("some sample") { reject { subject["tags"] }.include?("failure") }
+    end
+
+  end
+
+  describe "value as an expression" do
+    # testing that a field has a value should be true.
+    conditional "[message]" do
+      sample("apple") { insist { subject["tags"] }.include?("success") }
+      sample("sample") { insist { subject["tags"] }.include?("success") }
+      sample("some sample") { insist { subject["tags"] }.include?("success") }
+    end
+
+    # testing that a missing field has a value should be false.
+    conditional "[missing]" do
+      sample("apple") { insist { subject["tags"] }.include?("failure") }
+      sample("sample") { insist { subject["tags"] }.include?("failure") }
+      sample("some sample") { insist { subject["tags"] }.include?("failure") }
+    end
+  end
+
+  describe "logic operators" do
+    describe "and" do
+      conditional "[message] and [message]" do
+        sample("whatever") { insist { subject["tags"] }.include?("success") }
+      end
+      conditional "[message] and ![message]" do
+        sample("whatever") { insist { subject["tags"] }.include?("failure") }
+      end
+      conditional "![message] and [message]" do
+        sample("whatever") { insist { subject["tags"] }.include?("failure") }
+      end
+      conditional "![message] and ![message]" do
+        sample("whatever") { insist { subject["tags"] }.include?("failure") }
+      end
+    end
+
+    describe "or" do
+      conditional "[message] or [message]" do
+        sample("whatever") { insist { subject["tags"] }.include?("success") }
+      end
+      conditional "[message] or ![message]" do
+        sample("whatever") { insist { subject["tags"] }.include?("success") }
+      end
+      conditional "![message] or [message]" do
+        sample("whatever") { insist { subject["tags"] }.include?("success") }
+      end
+      conditional "![message] or ![message]" do
+        sample("whatever") { insist { subject["tags"] }.include?("failure") }
+      end
+    end
+  end
+end