logstash-lib 1.3.2

data/spec/filters/punct.rb

@@ -0,0 +1,18 @@
+require "test_utils"
+require "logstash/filters/punct"
+
+describe LogStash::Filters::Punct do
+  extend LogStash::RSpec
+
+  describe "all defaults" do
+    config <<-CONFIG
+      filter {
+        punct { }
+      }
+    CONFIG
+
+    sample "PHP Warning:  json_encode() [<a href='function.json-encode'>function.json-encode</a>]: Invalid UTF-8 sequence in argument in /var/www/htdocs/test.php on line 233" do
+      insist { subject["punct"] } == ":_()[<='.-'>.-</>]:-////."
+    end
+  end
+end

data/spec/filters/railsparallelrequest.rb

@@ -0,0 +1,112 @@
+require "test_utils"
+require "logstash/filters/railsparallelrequest"
+
+describe LogStash::Filters::Railsparallelrequest do
+
+  context :filter do
+
+    it "should not process same event twice" do
+      filter = LogStash::Filters::Railsparallelrequest.new
+      event = LogStash::Event.new({message: "hello world"})
+      event["tags"]=[]
+      filter.filter event
+      insist { event["tags"] } == ["railsparallelrequest"]
+      filter.filter event
+      insist { event["tags"] } == ["railsparallelrequest"]
+    end
+
+    it "should merge multiple events into single event based on unique UUID" do
+      filter = LogStash::Filters::Railsparallelrequest.new
+      filter.filter event({"message" => "[UUID]hello"})
+      filter.filter event({"message" => "[UUID]world"})
+      events = filter.flush
+      insist { events.first["message"]} == ["[UUID]hello","world"]
+    end
+
+    it "should cancel merged events until completed and completed event should have consolidated message" do
+      filter = LogStash::Filters::Railsparallelrequest.new
+      event1 = event({"message" => "[UUID]hello"})
+      filter.filter event1
+      insist { event1.cancelled? } == true
+      event2 = event({"message" => "[UUID]world"})
+      filter.filter event2
+      insist { event2.cancelled? } == true
+      event3 = event({"message" => "[UUID]Completed"})
+      filter.filter event3
+      insist { event3.cancelled? } == false
+      insist { event3["message"]} == ["[UUID]hello","world", "Completed"]
+    end
+
+    it "should not store the completed message" do
+      filter = LogStash::Filters::Railsparallelrequest.new
+      filter.filter event({"message" => "[UUID]hello"})
+      filter.filter event({"message" => "[UUID]Completed"})
+      insist { filter.flush.size } == 0
+    end
+
+    it "should handle interleaved messages and merge based on UUID" do
+      filter = LogStash::Filters::Railsparallelrequest.new
+      filter.filter event({"message" => "[UUID1]hello"})
+      filter.filter event({"message" => "[UUID2]new"})
+      filter.filter event({"message" => "[UUID1]world"})
+      filter.filter event({"message" => "[UUID2]world2"})
+
+      uuid1_completed = event({"message" => "[UUID1]Completed"})
+      filter.filter uuid1_completed
+      insist { uuid1_completed["message"] } == ["[UUID1]hello", "world", "Completed"]
+
+      uuid2_completed = event({"message" => "[UUID2]Completed"})
+      filter.filter uuid2_completed
+      insist { uuid2_completed["message"] } == ["[UUID2]new", "world2", "Completed"]
+    end
+
+    it "should merge message without UUID to previous message with UUID" do
+      filter = LogStash::Filters::Railsparallelrequest.new
+      filter.filter event({"message" => "[UUID1]hello"})
+      filter.filter event({"message" => "new"})
+      filter.filter event({"message" => "world"})
+      uuid1_completed = event({"message" => "[UUID1]Completed"})
+      filter.filter uuid1_completed
+      insist { uuid1_completed["message"] } == ["[UUID1]hello", "new", "world", "Completed"]
+    end
+
+    it "should not complete on error, wait until next UUID and complete" do
+      filter = LogStash::Filters::Railsparallelrequest.new
+      filter.filter event({"message" => "[UUID1]hello"})
+      filter.filter event({"message" => "new"})
+      filter.filter event({"message" => "world"})
+
+      uuid1_completed = event({"message" => "[UUID1]Error"})
+      filter.filter(uuid1_completed)
+      insist {uuid1_completed.cancelled?} == true
+
+      @error_event = nil
+      filter.filter(event({"message" => "[UUID2]Start"})) {|e| @error_event = e}
+
+      insist { @error_event["message"] } == ["[UUID1]hello", "new", "world", "Error"]
+      insist {@error_event.cancelled?} == false
+
+    end
+
+    it "should merge following messages even after error" do
+      filter = LogStash::Filters::Railsparallelrequest.new
+      filter.filter event({"message" => "[UUID1]hello"})
+      filter.filter event({"message" => "new"})
+      filter.filter event({"message" => "world"})
+      filter.filter(event({"message" => "[UUID1]Error"}))
+      filter.filter(event({"message" => "[UUID1]StackTrace"}))
+      @error_event = nil
+      filter.filter(event({"message" => "[UUID2]Start"})) {|e| @error_event = e}
+
+      insist { @error_event["message"] } == ["[UUID1]hello", "new", "world", "Error", "StackTrace"]
+    end
+
+  end
+
+end
+def event data
+  event = LogStash::Event.new(data)
+  event["tags"]=[]
+  event
+end
+

data/spec/filters/range.rb

@@ -0,0 +1,169 @@
+require "test_utils"
+require "logstash/filters/range"
+
+describe LogStash::Filters::Range do
+  extend LogStash::RSpec
+
+  describe "range match integer field on tag action" do
+    config <<-CONFIG
+      filter {
+        range {
+          ranges => [ "duration", 10, 100, "tag:cool",
+                      "duration", 1, 1, "tag:boring" ]
+        }
+      }
+    CONFIG
+
+    sample("duration" => 50) do
+      insist { subject["tags"] }.include?("cool")
+      reject { subject["tags"] }.include?("boring")
+    end
+  end
+
+  describe "range match float field on tag action" do
+    config <<-CONFIG
+      filter {
+        range {
+          ranges => [ "duration", 0, 100, "tag:cool",
+                      "duration", 0, 1, "tag:boring" ]
+        }
+      }
+    CONFIG
+
+    sample("duration" => 50.0) do
+      insist { subject["tags"] }.include?("cool")
+      reject { subject["tags"] }.include?("boring")
+    end
+  end
+
+  describe "range match string field on tag action" do
+    config <<-CONFIG
+      filter {
+        range {
+          ranges => [ "length", 0, 10, "tag:cool",
+                      "length", 0, 1, "tag:boring" ]
+        }
+      }
+    CONFIG
+
+    sample("length" => "123456789") do
+      insist { subject["tags"] }.include?("cool")
+      reject { subject["tags"] }.include?("boring")
+    end
+  end
+
+  describe "range match with negation" do
+    config <<-CONFIG
+      filter {
+        range {
+          ranges => [ "length", 0, 10, "tag:cool",
+                      "length", 0, 1, "tag:boring" ]
+          negate => true
+        }
+      }
+    CONFIG
+
+    sample("length" => "123456789") do
+      reject { subject["tags"] }.include?("cool")
+      insist { subject["tags"] }.include?("boring")
+    end
+  end
+
+  describe "range match on drop action" do
+    config <<-CONFIG
+      filter {
+        range {
+          ranges => [ "length", 0, 10, "drop" ]
+        }
+      }
+    CONFIG
+
+    sample("length" => "123456789") do
+      insist { subject }.nil?
+    end
+  end
+
+  describe "range match on field action with string value" do
+    config <<-CONFIG
+      filter {
+        range {
+          ranges => [ "duration", 10, 100, "field:cool:foo",
+                      "duration", 1, 1, "field:boring:foo" ]
+        }
+      }
+    CONFIG
+
+    sample("duration" => 50) do
+      insist { subject }.include?("cool")
+      insist { subject["cool"] } == "foo"
+      reject { subject }.include?("boring")
+    end
+  end
+
+  describe "range match on field action with integer value" do
+    config <<-CONFIG
+      filter {
+        range {
+          ranges => [ "duration", 10, 100, "field:cool:666",
+                      "duration", 1, 1, "field:boring:666" ]
+        }
+      }
+    CONFIG
+
+    sample("duration" => 50) do
+      insist { subject }.include?("cool")
+      insist { subject["cool"] } == 666
+      reject { subject }.include?("boring")
+    end
+  end
+
+  describe "range match on field action with float value" do
+    config <<-CONFIG
+      filter {
+        range {
+          ranges => [ "duration", 10, 100, "field:cool:3.14",
+                      "duration", 1, 1, "field:boring:3.14" ]
+        }
+      }
+    CONFIG
+
+    sample("duration" => 50) do
+      insist { subject }.include?("cool")
+      insist { subject["cool"] } == 3.14
+      reject { subject }.include?("boring")
+    end
+  end
+
+  describe "range match on tag action with dynamic string value" do
+    config <<-CONFIG
+      filter {
+        range {
+          ranges => [ "duration", 10, 100, "tag:cool_%{dynamic}_dynamic",
+                      "duration", 1, 1, "tag:boring_%{dynamic}_dynamic" ]
+        }
+      }
+    CONFIG
+
+    sample("duration" => 50, "dynamic" => "and") do
+      insist { subject["tags"] }.include?("cool_and_dynamic")
+      reject { subject["tags"] }.include?("boring_and_dynamic")
+    end
+  end
+
+  describe "range match on field action with dynamic string field and value" do
+    config <<-CONFIG
+      filter {
+        range {
+          ranges => [ "duration", 10, 100, "field:cool_%{dynamic}_dynamic:foo_%{dynamic}_bar",
+                      "duration", 1, 1, "field:boring_%{dynamic}_dynamic:foo_%{dynamic}_bar" ]
+        }
+      }
+    CONFIG
+
+    sample("duration" => 50, "dynamic" => "and") do
+      insist { subject }.include?("cool_and_dynamic")
+      insist { subject["cool_and_dynamic"] } == "foo_and_bar"
+      reject { subject }.include?("boring_and_dynamic")
+    end
+  end
+end

data/spec/filters/split.rb

@@ -0,0 +1,58 @@
+require "test_utils"
+require "logstash/filters/split"
+
+describe LogStash::Filters::Split do
+  extend LogStash::RSpec
+
+  describe "all defaults" do
+    config <<-CONFIG
+      filter {
+        split { }
+      }
+    CONFIG
+
+    sample "big\nbird\nsesame street" do
+      insist { subject.length } == 3
+      insist { subject[0]["message"] } == "big"
+      insist { subject[1]["message"] } == "bird"
+      insist { subject[2]["message"] } == "sesame street"
+    end
+  end
+
+  describe "custome terminator" do
+    config <<-CONFIG
+      filter {
+        split { 
+          terminator => "\t"
+        }
+      }
+    CONFIG
+
+    sample "big\tbird\tsesame street" do
+      insist { subject.length } == 3
+      insist { subject[0]["message"] } == "big"
+      insist { subject[1]["message"] } == "bird"
+      insist { subject[2]["message"] } == "sesame street"
+    end
+  end
+
+  describe "custom field" do
+    config <<-CONFIG
+      filter {
+        split { 
+          field => "custom"
+        }
+      }
+    CONFIG
+
+    sample("custom" => "big\nbird\nsesame street", "do_not_touch" => "1\n2\n3") do
+      insist { subject.length } == 3
+      subject.each do |s|
+         insist { s["do_not_touch"] } == "1\n2\n3"
+      end
+      insist { subject[0]["custom"] } == "big"
+      insist { subject[1]["custom"] } == "bird"
+      insist { subject[2]["custom"] } == "sesame street"
+    end
+  end
+end

data/spec/filters/translate.rb

@@ -0,0 +1,70 @@
+require "test_utils"
+require "logstash/filters/translate"
+
+describe LogStash::Filters::Translate do
+  extend LogStash::RSpec
+
+  describe "exact translation" do
+    config <<-CONFIG
+      filter {
+        translate {
+          field       => "status"
+          destination => "translation"
+          dictionary  => [ "200", "OK",
+                           "300", "Redirect",
+                           "400", "Client Error",
+                           "500", "Server Error" ]
+          exact       => true
+          regex       => false
+        }
+      }
+    CONFIG
+
+    sample("status" => 200) do
+      insist { subject["translation"] } == "OK"
+    end
+  end
+
+  describe "multi translation" do
+    config <<-CONFIG
+      filter {
+        translate {
+          field       => "status"
+          destination => "translation"
+          dictionary  => [ "200", "OK",
+                           "300", "Redirect",
+                           "400", "Client Error",
+                          "500", "Server Error" ]
+          exact       => false
+          regex       => false
+        }
+      }
+    CONFIG
+
+    sample("status" => "200 & 500") do
+      insist { subject["translation"] } == "OK & Server Error"
+    end
+  end
+
+  describe "regex translation" do
+    config <<-CONFIG
+      filter {
+        translate {
+          field       => "status"
+          destination => "translation"
+          dictionary  => [ "^2[0-9][0-9]$", "OK",
+                           "^3[0-9][0-9]$", "Redirect",
+                           "^4[0-9][0-9]$", "Client Error",
+                           "^5[0-9][0-9]$", "Server Error" ]
+          exact       => true
+          regex       => true
+        }
+      }
+    CONFIG
+
+    sample("status" => "200") do
+      insist { subject["translation"] } == "OK"
+    end
+  end
+
+end

data/spec/filters/unique.rb

@@ -0,0 +1,25 @@
+require "test_utils"
+require "logstash/filters/unique"
+
+describe LogStash::Filters::Unique do
+  extend LogStash::RSpec
+
+  describe "unique when field is array" do
+    config <<-CONFIG
+    filter {
+      unique {
+        fields => ["noisy_field", "not_an_array"]
+      }
+    }
+    CONFIG
+
+    sample("noisy_field" => %w(cat dog cat cat)) do
+      insist { subject["noisy_field"] } == %w(cat dog)
+    end
+
+    sample("not_an_array" => "Hello, world!") do
+      insist { subject["not_an_array"] } == "Hello, world!"
+    end
+
+  end
+end