logstash-lib 1.3.2

data/spec/filters/environment.rb

@@ -0,0 +1,43 @@
+require "test_utils"
+require "logstash/filters/environment"
+
+describe LogStash::Filters::Environment do
+  extend LogStash::RSpec
+
+  describe "add a field from the environment" do
+    # The logstash config goes here.
+    # At this time, only filters are supported.
+    config <<-CONFIG
+      filter {
+        environment {
+          add_field_from_env => [ "newfield", "MY_ENV_VAR" ]
+        }
+      }
+    CONFIG
+
+    ENV["MY_ENV_VAR"] = "hello world"
+
+    sample "example" do
+      insist { subject["newfield"] } == "hello world"
+    end
+  end
+
+  describe "does nothing on non-matching events" do
+    # The logstash config goes here.
+    # At this time, only filters are supported.
+    config <<-CONFIG
+      filter {
+        environment {
+          type => "foo"
+          add_field_from_env => [ "newfield", "MY_ENV_VAR" ]
+        }
+      }
+    CONFIG
+
+    ENV["MY_ENV_VAR"] = "hello world"
+
+    sample("type" => "bar", "message" => "fizz") do
+      insist { subject["newfield"] }.nil?
+    end
+  end
+end

data/spec/filters/geoip.rb

@@ -0,0 +1,62 @@
+require "test_utils"
+require "logstash/filters/geoip"
+
+describe LogStash::Filters::GeoIP do
+  extend LogStash::RSpec
+  describe "defaults" do
+    config <<-CONFIG
+      filter {
+        geoip { 
+          source => "ip"
+          #database => "vendor/geoip/GeoLiteCity.dat"
+        }
+      }
+    CONFIG
+
+    sample("ip" => "8.8.8.8") do
+      insist { subject }.include?("geoip")
+
+      expected_fields = %w(ip country_code2 country_code3 country_name
+                           continent_code region_name city_name postal_code
+                           latitude longitude dma_code area_code timezone
+                           location )
+      expected_fields.each do |f|
+        insist { subject["geoip"] }.include?(f)
+      end
+    end
+
+    sample("ip" => "127.0.0.1") do
+      # assume geoip fails on localhost lookups
+      reject { subject }.include?("geoip")
+    end
+  end
+
+  describe "Specify the target" do
+    config <<-CONFIG
+      filter {
+        geoip { 
+          source => "ip"
+          #database => "vendor/geoip/GeoLiteCity.dat"
+          target => src_ip
+        }
+      }
+    CONFIG
+
+    sample("ip" => "8.8.8.8") do
+      insist { subject }.include?("src_ip")
+
+      expected_fields = %w(ip country_code2 country_code3 country_name
+                           continent_code region_name city_name postal_code
+                           latitude longitude dma_code area_code timezone
+                           location )
+      expected_fields.each do |f|
+        insist { subject["src_ip"] }.include?(f)
+      end
+    end
+
+    sample("ip" => "127.0.0.1") do
+      # assume geoip fails on localhost lookups
+      reject { subject }.include?("src_ip")
+    end
+  end
+end

data/spec/filters/grep.rb

@@ -0,0 +1,342 @@
+require "test_utils"
+require "logstash/filters/grep"
+
+describe LogStash::Filters::Grep do
+  extend LogStash::RSpec
+
+  describe "single grep match" do
+    config <<-CONFIG
+      filter {
+        grep {
+          match => [ "str", "test" ]
+        }
+      }
+    CONFIG
+
+    sample("str" => "test: this should not be dropped") do
+      reject { subject }.nil?
+    end
+
+    sample("str" => "foo: this should be dropped") do
+      insist { subject }.nil?
+    end
+  end
+
+  describe "single match failure cancels the event" do
+    config <<-CONFIG
+    filter {
+      grep {
+        match => [ "str",  "test" ]
+      }
+    }
+    CONFIG
+
+    sample("str" => "foo: this should be dropped") do
+      insist { subject }.nil?
+    end
+  end
+
+  describe "single match failure does not cancel the event with drop set to false" do
+    config <<-CONFIG
+    filter {
+      grep {
+        match => [ "str", "test" ]
+        drop => false
+      }
+    }
+    CONFIG
+
+    sample("str" => "foo: this should not be dropped") do
+      reject { subject }.nil?
+    end
+  end
+
+  describe "multiple match conditions" do
+    config <<-CONFIG
+    filter {
+      grep {
+        match => [
+          "str", "test",
+          "bar", "baz"
+        ]
+      }
+    }
+    CONFIG
+
+    sample("str" => "test: this should not be dropped", "bar" => "foo baz foo") do
+      reject { subject }.nil?
+    end
+  end
+
+  describe "multiple match conditions should cancel on failure" do
+    config <<-CONFIG
+    filter {
+      grep {
+        match => [ 
+          "str", "test",
+          "bar", "baz"
+        ]
+      }
+    }
+    CONFIG
+
+    sample("str" => "test: this should be dropped", "bar" => "foo bAz foo") do
+      insist { subject }.nil?
+    end
+  end
+
+  describe "single condition with regexp syntax" do
+    config <<-CONFIG
+    filter {
+      grep {
+        match => [ "str", "(?i)test.*foo"]
+      }
+    }
+    CONFIG
+
+    sample("str" => "TeST regexp match FoO") do
+      reject { subject }.nil?
+    end
+  end
+
+  describe "single condition with regexp syntax cancels on failure" do
+    config <<-CONFIG
+    filter {
+      grep {
+        match => [ "str", "test.*foo" ]
+      }
+    }
+    CONFIG
+
+    sample("str" => "TeST regexp match FoO") do
+      insist { subject }.nil?
+    end
+  end
+
+  describe "adding one field on success" do
+    config <<-CONFIG
+    filter {
+      grep {
+        match => [ "str", "test" ]
+        add_field => ["new_field", "new_value"]
+      }
+    }
+    CONFIG
+
+    sample("str" => "test") do
+      reject { subject }.nil?
+      insist { subject["new_field"]} == "new_value"
+    end
+  end
+
+  describe "adding one field with a sprintf value" do
+    config <<-CONFIG
+    filter {
+      grep {
+        match => [ "str", "test" ]
+        add_field => ["new_field", "%{type}"]
+      }
+    }
+    CONFIG
+
+    sample("type" => "grepper", "str" => "test") do
+      reject { subject }.nil?
+      insist { subject["new_field"]} == subject["type"]
+    end
+  end
+
+  # following test was __DISABLED_FOR_NOW_, remember why ?
+  # Seems to be multi-match several time on the same field not allowed
+  # maybe a clearer test on multi-match on same field could be created
+  # Also add_field behaviour tested separately in new NOOP test for add_field
+
+  # describe "adding fields on successful multiple match" do
+  #   config <<-CONFIG
+  #   filter {
+  #     grep {
+  #       match => [ "str", "test" ]
+  #       add_field => ["new_field", "new_value"]
+  #       match => [ "str", ".*" ]
+  #       add_field => ["new_field", "new_value_2"]
+  #     }
+  #   }
+  #   CONFIG
+  #
+  #   sample("type" => "grepper", "str" => "test") do
+  #     reject { subject }.nil?
+  #     insist { subject["new_field"]} == ["new_value", "new_value_2"]
+  #   end
+  # end
+
+  describe "add tags" do
+    config <<-CONFIG
+    filter {
+      grep {
+        match => [ "str", "test" ]
+        add_tag => ["new_tag"]
+      }
+    }
+    CONFIG
+
+    sample("tags" => ["tag"], "str" => "test") do
+      reject { subject }.nil?
+      insist { subject["tags"]} == ["tag", "new_tag"]
+    end
+  end
+
+  describe "add tags with drop set to false tags matching events" do
+    config <<-CONFIG
+    filter {
+      grep {
+        match => [ "str", "test" ]
+        drop => false
+        add_tag => ["new_tag"]
+      }
+    }
+    CONFIG
+
+    sample("tags" => ["tag"], "str" => "test") do
+      reject { subject }.nil?
+      insist { subject["tags"]} == ["tag", "new_tag"]
+    end
+  end
+
+  describe "add tags with drop set to false allows non-matching events through" do
+    config <<-CONFIG
+    filter {
+      grep {
+        match => [ "str", "test" ]
+        drop => false
+        add_tag => ["new_tag"]
+      }
+    }
+    CONFIG
+
+    sample("tags" => ["tag"], "str" => "non-matching") do
+      reject { subject }.nil?
+      insist { subject["tags"]} == ["tag"]
+    end
+  end
+
+  describe "add tags with sprintf value" do
+    config <<-CONFIG
+    filter {
+      grep {
+        match => [ "str", "test" ]
+        add_tag => ["%{str}"]
+      }
+    }
+    CONFIG
+
+    sample("tags" => ["tag"], "str" => "test") do
+      reject { subject }.nil?
+      insist { subject["tags"]} == ["tag", subject["str"]]
+    end
+  end
+
+  describe "negate=true should not cause drops when field is nil" do
+    # Set negate to true; the pattern being searched doesn't actually matter
+    # here. We're testing to make sure "grep -v" behavior doesn't drop events
+    # that don't even have the field being filtered for.
+    config <<-CONFIG
+    filter {
+      grep {
+        match => [ "str", "doesn't matter lol" ]
+        negate => true
+      }
+    }
+    CONFIG
+
+    sample("tags" => ["tag"], "str" => nil) do
+      reject { subject }.nil?
+    end
+  end
+
+  #LOGSTASH-599
+  describe "drop line based on type and tags 'matching' only but otherwise pattern matching" do
+    config <<-CONFIG
+    filter {
+      grep {
+        type => "testing"
+        tags => ["_grokparsefailure"]
+        negate => true
+      }
+    }
+    CONFIG
+
+    sample("type" => "testing", "tags" => ["_grokparsefailure"], "str" => "test") do
+      insist { subject }.nil?
+    end
+  end
+
+  #LOGSTASH-894 and LOGSTASH-919
+  describe "repeat a field in match config, similar to piped grep command line" do
+    config <<-CONFIG
+    filter {
+      grep {
+        match => ["message", "hello", "message", "world"]
+      }
+    }
+    CONFIG
+
+    #both match
+    sample "hello world" do
+      reject { subject }.nil?
+    end
+    #one match
+    sample "bye world" do
+      insist { subject }.nil?
+    end
+    #one match
+    sample "hello Jordan" do
+      insist { subject }.nil?
+    end
+    #no match
+    sample "WTF" do
+      insist { subject }.nil?
+    end
+  end
+
+  describe "repeat a field in match config, similar to several -e in grep command line" do
+    config <<-CONFIG
+    filter {
+      grep {
+        match => ["message", "hello", "message", "world"]
+        negate => true
+      }
+    }
+    CONFIG
+
+    #both match
+    sample "hello world" do
+      insist { subject }.nil?
+    end
+    #one match
+    sample "bye world" do
+      insist { subject }.nil?
+    end
+    #one match
+    sample "hello Jordan" do
+      insist { subject }.nil?
+    end
+    #no match
+    sample "WTF" do
+      reject { subject }.nil?
+    end
+  end
+
+  describe "case-insensitive matching" do
+    config <<-CONFIG
+      filter {
+        grep {
+          ignore_case => true
+          match => [ "str", "test" ]
+        }
+      }
+    CONFIG
+
+    sample("str" => "tEsT: this should still be matched") do
+      reject { subject }.nil?
+    end
+  end
+end

data/spec/filters/grok.rb

@@ -0,0 +1,473 @@
+require "test_utils"
+require "logstash/filters/grok"
+
+describe LogStash::Filters::Grok do
+  extend LogStash::RSpec
+
+  describe "simple syslog line" do
+    # The logstash config goes here.
+    # At this time, only filters are supported.
+    config <<-CONFIG
+      filter {
+        grok {
+          match => [ "message", "%{SYSLOGLINE}" ]
+          singles => true
+          overwrite => [ "message" ]
+        }
+      }
+    CONFIG
+
+    sample "Mar 16 00:01:25 evita postfix/smtpd[1713]: connect from camomile.cloud9.net[168.100.1.3]" do
+      insist { subject["tags"] }.nil?
+      insist { subject["logsource"] } == "evita"
+      insist { subject["timestamp"] } == "Mar 16 00:01:25"
+      insist { subject["message"] } == "connect from camomile.cloud9.net[168.100.1.3]"
+      insist { subject["program"] } == "postfix/smtpd"
+      insist { subject["pid"] } == "1713"
+    end
+  end
+
+  describe "ietf 5424 syslog line" do
+    # The logstash config goes here.
+    # At this time, only filters are supported.
+    config <<-CONFIG
+      filter {
+        grok {
+          match => [ "message",  "%{SYSLOG5424LINE}" ]
+          singles => true
+        }
+      }
+    CONFIG
+
+    sample "<191>1 2009-06-30T18:30:00+02:00 paxton.local grokdebug 4123 - [id1 foo=\"bar\"][id2 baz=\"something\"] Hello, syslog." do
+      insist { subject["tags"] }.nil?
+      insist { subject["syslog5424_pri"] } == "191"
+      insist { subject["syslog5424_ver"] } == "1"
+      insist { subject["syslog5424_ts"] } == "2009-06-30T18:30:00+02:00"
+      insist { subject["syslog5424_host"] } == "paxton.local"
+      insist { subject["syslog5424_app"] } == "grokdebug"
+      insist { subject["syslog5424_proc"] } == "4123"
+      insist { subject["syslog5424_msgid"] } == nil
+      insist { subject["syslog5424_sd"] } == "[id1 foo=\"bar\"][id2 baz=\"something\"]"
+      insist { subject["syslog5424_msg"] } == "Hello, syslog."
+    end
+
+    sample "<191>1 2009-06-30T18:30:00+02:00 paxton.local grokdebug - - [id1 foo=\"bar\"] No process ID." do
+      insist { subject["tags"] }.nil?
+      insist { subject["syslog5424_pri"] } == "191"
+      insist { subject["syslog5424_ver"] } == "1"
+      insist { subject["syslog5424_ts"] } == "2009-06-30T18:30:00+02:00"
+      insist { subject["syslog5424_host"] } == "paxton.local"
+      insist { subject["syslog5424_app"] } == "grokdebug"
+      insist { subject["syslog5424_proc"] } == nil
+      insist { subject["syslog5424_msgid"] } == nil
+      insist { subject["syslog5424_sd"] } == "[id1 foo=\"bar\"]"
+      insist { subject["syslog5424_msg"] } == "No process ID."
+    end
+
+    sample "<191>1 2009-06-30T18:30:00+02:00 paxton.local grokdebug 4123 - - No structured data." do
+      insist { subject["tags"] }.nil?
+      insist { subject["syslog5424_pri"] } == "191"
+      insist { subject["syslog5424_ver"] } == "1"
+      insist { subject["syslog5424_ts"] } == "2009-06-30T18:30:00+02:00"
+      insist { subject["syslog5424_host"] } == "paxton.local"
+      insist { subject["syslog5424_app"] } == "grokdebug"
+      insist { subject["syslog5424_proc"] } == "4123"
+      insist { subject["syslog5424_msgid"] } == nil
+      insist { subject["syslog5424_sd"] } == nil
+      insist { subject["syslog5424_msg"] } == "No structured data."
+    end
+
+    sample "<191>1 2009-06-30T18:30:00+02:00 paxton.local grokdebug - - - No PID or SD." do
+      insist { subject["tags"] }.nil?
+      insist { subject["syslog5424_pri"] } == "191"
+      insist { subject["syslog5424_ver"] } == "1"
+      insist { subject["syslog5424_ts"] } == "2009-06-30T18:30:00+02:00"
+      insist { subject["syslog5424_host"] } == "paxton.local"
+      insist { subject["syslog5424_app"] } == "grokdebug"
+      insist { subject["syslog5424_proc"] } == nil
+      insist { subject["syslog5424_msgid"] } == nil
+      insist { subject["syslog5424_sd"] } == nil
+      insist { subject["syslog5424_msg"] } == "No PID or SD."
+    end
+
+    sample "<191>1 2009-06-30T18:30:00+02:00 paxton.local grokdebug 4123 -  Missing structured data." do
+      insist { subject["tags"] }.nil?
+      insist { subject["syslog5424_pri"] } == "191"
+      insist { subject["syslog5424_ver"] } == "1"
+      insist { subject["syslog5424_ts"] } == "2009-06-30T18:30:00+02:00"
+      insist { subject["syslog5424_host"] } == "paxton.local"
+      insist { subject["syslog5424_app"] } == "grokdebug"
+      insist { subject["syslog5424_proc"] } == "4123"
+      insist { subject["syslog5424_msgid"] } == nil
+      insist { subject["syslog5424_sd"] } == nil
+      insist { subject["syslog5424_msg"] } == "Missing structured data."
+    end
+
+    sample "<191>1 2009-06-30T18:30:00+02:00 paxton.local grokdebug  4123 - - Additional spaces." do
+      insist { subject["tags"] }.nil?
+      insist { subject["syslog5424_pri"] } == "191"
+      insist { subject["syslog5424_ver"] } == "1"
+      insist { subject["syslog5424_ts"] } == "2009-06-30T18:30:00+02:00"
+      insist { subject["syslog5424_host"] } == "paxton.local"
+      insist { subject["syslog5424_app"] } == "grokdebug"
+      insist { subject["syslog5424_proc"] } == "4123"
+      insist { subject["syslog5424_msgid"] } == nil
+      insist { subject["syslog5424_sd"] } == nil
+      insist { subject["syslog5424_msg"] } == "Additional spaces."
+    end
+
+    sample "<191>1 2009-06-30T18:30:00+02:00 paxton.local grokdebug  4123 -  Additional spaces and missing SD." do
+      insist { subject["tags"] }.nil?
+      insist { subject["syslog5424_pri"] } == "191"
+      insist { subject["syslog5424_ver"] } == "1"
+      insist { subject["syslog5424_ts"] } == "2009-06-30T18:30:00+02:00"
+      insist { subject["syslog5424_host"] } == "paxton.local"
+      insist { subject["syslog5424_app"] } == "grokdebug"
+      insist { subject["syslog5424_proc"] } == "4123"
+      insist { subject["syslog5424_msgid"] } == nil
+      insist { subject["syslog5424_sd"] } == nil
+      insist { subject["syslog5424_msg"] } == "Additional spaces and missing SD."
+    end
+  end
+
+  describe "parsing an event with multiple messages (array of strings)", :if => false do
+    config <<-CONFIG
+      filter {
+        grok {
+          match => [ "message",  "(?:hello|world) %{NUMBER}" ]
+          named_captures_only => false
+        }
+      }
+    CONFIG
+
+    sample("message" => [ "hello 12345", "world 23456" ]) do
+      insist { subject["NUMBER"] } == [ "12345", "23456" ]
+    end
+  end
+
+  describe "coercing matched values" do
+    config <<-CONFIG
+      filter {
+        grok {
+          match => [ "message",  "%{NUMBER:foo:int} %{NUMBER:bar:float}" ]
+          singles => true
+        }
+      }
+    CONFIG
+
+    sample "400 454.33" do
+      insist { subject["foo"] } == 400
+      insist { subject["foo"] }.is_a?(Fixnum)
+      insist { subject["bar"] } == 454.33
+      insist { subject["bar"] }.is_a?(Float)
+    end
+  end
+
+  describe "in-line pattern definitions" do
+    config <<-CONFIG
+      filter {
+        grok {
+          match => [ "message",  "%{FIZZLE=\\d+}" ]
+          named_captures_only => false
+          singles => true
+        }
+      }
+    CONFIG
+
+    sample "hello 1234" do
+      insist { subject["FIZZLE"] } == "1234"
+    end
+  end
+
+  describe "processing selected fields" do
+    config <<-CONFIG
+      filter {
+        grok {
+          match => [ "message",  "%{WORD:word}" ]
+          match => [ "examplefield", "%{NUMBER:num}" ]
+          break_on_match => false
+          singles => true
+        }
+      }
+    CONFIG
+
+    sample("message" => "hello world", "examplefield" => "12345") do
+      insist { subject["examplefield"] } == "12345"
+      insist { subject["word"] } == "hello"
+    end
+  end
+
+  describe "adding fields on match" do
+    config <<-CONFIG
+      filter {
+        grok {
+          match => [ "message",  "matchme %{NUMBER:fancy}" ]
+          singles => true
+          add_field => [ "new_field", "%{fancy}" ]
+        }
+      }
+    CONFIG
+
+    sample "matchme 1234" do
+      insist { subject["tags"] }.nil?
+      insist { subject["new_field"] } == "1234"
+    end
+
+    sample "this will not be matched" do
+      insist { subject["tags"] }.include?("_grokparsefailure")
+      reject { subject }.include?("new_field")
+    end
+  end
+
+  context "empty fields" do
+    describe "drop by default" do
+      config <<-CONFIG
+        filter {
+          grok {
+            match => [ "message",  "1=%{WORD:foo1} *(2=%{WORD:foo2})?" ]
+          }
+        }
+      CONFIG
+
+      sample "1=test" do
+        insist { subject["tags"] }.nil?
+        insist { subject }.include?("foo1")
+
+        # Since 'foo2' was not captured, it must not be present in the event.
+        reject { subject }.include?("foo2")
+      end
+    end
+
+    describe "keep if keep_empty_captures is true" do
+      config <<-CONFIG
+        filter {
+          grok {
+            match => [ "message",  "1=%{WORD:foo1} *(2=%{WORD:foo2})?" ]
+            keep_empty_captures => true
+          }
+        }
+      CONFIG
+
+      sample "1=test" do
+        insist { subject["tags"] }.nil?
+        # use .to_hash for this test, for now, because right now
+        # the Event.include? returns false for missing fields as well
+        # as for fields with nil values.
+        insist { subject.to_hash }.include?("foo2")
+        insist { subject.to_hash }.include?("foo2")
+      end
+    end
+  end
+
+  describe "when named_captures_only == false" do
+    config <<-CONFIG
+      filter {
+        grok {
+          match => [ "message",  "Hello %{WORD}. %{WORD:foo}" ]
+          named_captures_only => false
+          singles => true
+        }
+      }
+    CONFIG
+
+    sample "Hello World, yo!" do
+      insist { subject }.include?("WORD")
+      insist { subject["WORD"] } == "World"
+      insist { subject }.include?("foo")
+      insist { subject["foo"] } == "yo"
+    end
+  end
+
+  describe "using oniguruma named captures (?<name>regex)" do
+    context "plain regexp" do
+      config <<-'CONFIG'
+        filter {
+          grok {
+            singles => true
+            match => [ "message",  "(?<foo>\w+)" ]
+          }
+        }
+      CONFIG
+      sample "hello world" do
+        insist { subject["tags"] }.nil?
+        insist { subject["foo"] } == "hello"
+      end
+    end
+
+    context "grok patterns" do
+      config <<-'CONFIG'
+        filter {
+          grok {
+            singles => true
+            match => [ "message",  "(?<timestamp>%{DATE_EU} %{TIME})" ]
+          }
+        }
+      CONFIG
+
+      sample "fancy 12-12-12 12:12:12" do
+        insist { subject["tags"] }.nil?
+        insist { subject["timestamp"] } == "12-12-12 12:12:12"
+      end
+    end
+  end
+
+  describe "grok on integer types" do
+    config <<-'CONFIG'
+      filter {
+        grok {
+          match => [ "status", "^403$" ]
+          add_tag => "four_oh_three"
+        }
+      }
+    CONFIG
+
+    sample("status" => 403) do
+      reject { subject["tags"] }.include?("_grokparsefailure")
+      insist { subject["tags"] }.include?("four_oh_three")
+    end
+  end
+
+  describe "grok on float types" do
+    config <<-'CONFIG'
+      filter {
+        grok {
+          match => [ "version", "^1.0$" ]
+          add_tag => "one_point_oh"
+        }
+      }
+    CONFIG
+
+    sample("version" => 1.0) do
+      insist { subject["tags"] }.include?("one_point_oh")
+      insist { subject["tags"] }.include?("one_point_oh")
+    end
+  end
+
+  describe "grok on %{LOGLEVEL}" do
+    config <<-'CONFIG'
+      filter {
+        grok {
+          pattern => "%{LOGLEVEL:level}: error!"
+        }
+      }
+    CONFIG
+
+    log_level_names = %w(
+      trace Trace TRACE
+      debug Debug DEBUG
+      notice Notice Notice
+      info Info INFO
+      warn warning Warn Warning WARN WARNING
+      err error Err Error ERR ERROR
+      crit critical Crit Critical CRIT CRITICAL
+      fatal Fatal FATAL
+      severe Severe SEVERE
+      emerg emergency Emerg Emergency EMERG EMERGENCY
+    )
+    log_level_names.each do |level_name|
+      sample "#{level_name}: error!" do
+        insist { subject['level'] } == level_name
+      end
+    end
+  end
+
+  describe "tagging on failure" do
+    config <<-CONFIG
+      filter {
+        grok {
+          match => [ "message",  "matchme %{NUMBER:fancy}" ]
+          tag_on_failure => false
+        }
+      }
+    CONFIG
+
+    sample "matchme 1234" do
+      insist { subject["tags"] }.nil?
+    end
+
+    sample "this will not be matched" do
+      insist { subject["tags"] }.include?("false")
+    end
+  end
+
+  describe "captures named fields even if the whole text matches" do
+    config <<-CONFIG
+      filter {
+        grok {
+          match => [ "message",  "%{DATE_EU:stimestamp}" ]
+          singles => true
+        }
+      }
+    CONFIG
+
+    sample "11/01/01" do
+      insist { subject["stimestamp"] } == "11/01/01"
+    end
+  end
+
+  describe "allow dashes in capture names" do
+    config <<-CONFIG
+      filter {
+        grok {
+          match => [ "message",  "%{WORD:foo-bar}" ]
+          singles => true
+        }
+      }
+    CONFIG
+
+    sample "hello world" do
+      insist { subject["foo-bar"] } == "hello"
+    end
+  end
+
+  describe "performance test", :if => ENV["SPEEDTEST"] do
+    event_count = 100000
+    min_rate = 4000
+
+    max_duration = event_count / min_rate
+    input = "Nov 24 01:29:01 -0800"
+    config <<-CONFIG
+      input {
+        generator {
+          count => #{event_count}
+          message => "Mar 16 00:01:25 evita postfix/smtpd[1713]: connect from camomile.cloud9.net[168.100.1.3]"
+        }
+      }
+      filter {
+        grok {
+          match => [ "message", "%{SYSLOGLINE}" ]
+          singles => true
+          overwrite => [ "message" ]
+        }
+      }
+      output { null { } }
+    CONFIG
+
+    2.times do
+      agent do
+        puts "grok parse rate: #{event_count / @duration}"
+        insist { @duration } < max_duration
+      end
+    end
+  end
+
+  describe "singles with duplicate-named fields" do
+    config <<-CONFIG
+      filter {
+        grok {
+          match => [ "message", "%{INT:foo}|%{WORD:foo}" ]
+          singles => true
+        }
+      }
+    CONFIG
+
+    sample "hello world" do
+      insist { subject["foo"] }.is_a?(String)
+    end
+
+    sample "123 world" do
+      insist { subject["foo"] }.is_a?(String)
+    end
+  end
+end