logstash-logger-yajl 0.27.0

data/spec/formatter/base_spec.rb

@@ -0,0 +1,125 @@
+require 'logstash-logger'
+
+describe LogStashLogger::Formatter::Base do
+  include_context "formatter"
+
+  describe "#call" do
+    context "when event is not cancelled" do
+      it "returns a formatted message" do
+        expect(subject).to receive(:format_event).once.with(instance_of(LogStash::Event)).and_call_original
+        expect(subject.call(severity, time, progname, message)).to be_a(LogStash::Event)
+      end
+    end
+
+    context "when event is cancelled" do
+      before(:each) do
+        LogStashLogger.configure do |config|
+          config.customize_event(&:cancel)
+        end
+      end
+
+      it "returns `nil`" do
+        expect(subject).not_to receive(:format_event)
+        expect(subject.call(severity, time, progname, message)).to be_nil
+      end
+    end
+  end
+
+  describe "#build_event" do
+    let(:event) { formatted_message }
+
+    describe "message type" do
+      context "string" do
+        it "puts the message into the message field" do
+          expect(event['message']).to eq(message)
+        end
+      end
+
+      context "JSON string" do
+        let(:message) do
+          { message: 'test', foo: 'bar' }.to_json
+        end
+
+        it "parses the JSON and merges into the event" do
+          expect(event['message']).to eq('test')
+          expect(event['foo']).to eq('bar')
+        end
+      end
+
+      context "hash" do
+        let(:message) do
+          { 'message' => 'test', 'foo' => 'bar' }
+        end
+
+        it "merges into the event" do
+          expect(event['message']).to eq('test')
+          expect(event['foo']).to eq('bar')
+        end
+      end
+
+      context "LogStash::Event" do
+        let(:message) { LogStash::Event.new("message" => "foo") }
+
+        it "returns a clone of the original event" do
+          expect(event['message']).to eq("foo")
+          expect(event).to_not equal(message)
+        end
+      end
+
+      context "fallback" do
+        let(:message) { [1, 2, 3] }
+
+        it "calls inspect" do
+          expect(event['message']).to eq(message.inspect)
+        end
+      end
+    end
+
+    describe "extra fields on the event" do
+      it "adds severity" do
+        expect(event['severity']).to eq(severity)
+      end
+
+      it "adds host" do
+        expect(event['host']).to eq(hostname)
+      end
+    end
+
+    describe "timestamp" do
+      it "ensures time is in ISO8601 format" do
+        expect(event.timestamp).to eq(time.iso8601(3))
+      end
+    end
+
+    describe "long messages" do
+
+      context "message field is present" do
+        let(:message) { long_message }
+
+        it "truncates long messages when max_message_size is set" do
+          LogStashLogger.configure do |config|
+            config.max_message_size = 2000
+          end
+
+          expect(event['message'].size).to eq(2000)
+        end
+      end
+
+      context "event without message field" do
+        let(:message) do
+          { 'test_field' => 'test', 'foo' => 'bar' }
+        end
+
+        it "still works" do
+          LogStashLogger.configure do |config|
+            config.max_message_size = 2000
+          end
+
+          expect(event['message']).to eq(nil)
+          expect(event['test_field']).to eq('test')
+          expect(event['foo']).to eq('bar')
+        end
+      end
+    end
+  end
+end

data/spec/formatter/cee_spec.rb

@@ -0,0 +1,15 @@
+require 'logstash-logger'
+
+describe LogStashLogger::Formatter::Cee do
+  include_context "formatter"
+
+  it "outputs in CEE format" do
+    expect(formatted_message).to match(/\A@cee:/)
+  end
+
+  it "serializes the LogStash::Event data as JSON" do
+    json_data = formatted_message[/\A@cee:\s?(.*)\z/, 1]
+    json_message = JSON.parse(json_data)
+    expect(json_message["message"]).to eq(message)
+  end
+end

data/spec/formatter/cee_syslog_spec.rb

@@ -0,0 +1,43 @@
+require 'logstash-logger'
+
+describe LogStashLogger::Formatter::CeeSyslog do
+  include_context "formatter"
+
+  describe "#call" do
+    let(:facility) { "facility" }
+
+    before do
+      allow(subject).to receive(:build_facility).and_return(facility)
+    end
+
+    it "outputs a facility before the @cee" do
+      expect(formatted_message).to match(/\A#{facility}:@cee:/)
+    end
+
+    it "serializes the LogStash::Event data as JSON" do
+      json_data = formatted_message[/\A#{facility}:@cee:\s?(.*)\Z/, 1]
+      json_message = JSON.parse(json_data)
+      expect(json_message["message"]).to eq(message)
+    end
+  end
+
+  describe "#build_facility" do
+    let(:host) { Socket.gethostname }
+
+    before do
+      formatted_message
+    end
+
+    it "includes hostname and progname" do
+      expect(subject.send(:build_facility, host)).to match(/\A#{host}\s#{progname}\z/)
+    end
+
+    context "without progname" do
+      let(:progname) { nil }
+
+      it "only includes hostname" do
+        expect(subject.send(:build_facility, host)).to match(/\A#{host}\z/)
+      end
+    end
+  end
+end

data/spec/formatter/json_lines_spec.rb

@@ -0,0 +1,14 @@
+require 'logstash-logger'
+
+describe LogStashLogger::Formatter::JsonLines do
+  include_context "formatter"
+
+  it "outputs in JSON format" do
+    json_message = JSON.parse(formatted_message)
+    expect(json_message["message"]).to eq(message)
+  end
+
+  it "terminates with a line break" do
+    expect(formatted_message[-1]).to eq("\n")
+  end
+end

data/spec/formatter/json_spec.rb

@@ -0,0 +1,10 @@
+require 'logstash-logger'
+
+describe LogStashLogger::Formatter::Json do
+  include_context "formatter"
+
+  it "outputs in JSON format" do
+    json_message = JSON.parse(formatted_message)
+    expect(json_message["message"]).to eq(message)
+  end
+end

data/spec/formatter/logstash_event_spec.rb

@@ -0,0 +1,10 @@
+require 'logstash-logger'
+
+describe LogStashLogger::Formatter::LogStashEvent do
+  include_context "formatter"
+
+  it "outputs a LogStash::Event" do
+    expect(formatted_message).to be_a LogStash::Event
+    expect(formatted_message["message"]).to eq(message)
+  end
+end

data/spec/formatter_spec.rb

@@ -0,0 +1,79 @@
+require 'logstash-logger'
+
+describe LogStashLogger::Formatter do
+  describe "#new" do
+    context "built in formatters" do
+      it "returns a new JsonLines formatter" do
+        expect(described_class.new(:json_lines)).to be_a LogStashLogger::Formatter::JsonLines
+      end
+
+      it "returns a new Json formatter" do
+        expect(described_class.new(:json)).to be_a LogStashLogger::Formatter::Json
+      end
+
+      it "returns a new Cee formatter" do
+        expect(described_class.new(:cee)).to be_a LogStashLogger::Formatter::Cee
+      end
+
+      it "returns a new CeeSyslog formatter" do
+        expect(described_class.new(:cee_syslog)).to be_a LogStashLogger::Formatter::CeeSyslog
+      end
+
+      it "returns a new LogStashEvent formatter" do
+        expect(described_class.new(:logstash_event)).to be_a LogStashLogger::Formatter::LogStashEvent
+      end
+    end
+
+    context "custom formatter" do
+      subject { described_class.new(formatter) }
+
+      context "formatter class" do
+        let(:formatter) { ::Logger::Formatter }
+
+        it "returns a new instance of the class" do
+          expect(subject).to be_a formatter
+        end
+      end
+
+      context "formatter instance" do
+        let(:formatter) { ::Logger::Formatter.new }
+
+        it "returns the same formatter instance" do
+          expect(subject).to eql(formatter)
+        end
+
+        it "supports tagged logging" do
+          expect(subject).to be_a ::LogStashLogger::TaggedLogging::Formatter
+        end
+      end
+
+      context "formatter proc" do
+        let(:formatter) do
+          proc { |severity, time, progname, msg| msg }
+        end
+
+        it "returns the same formatter proc" do
+          expect(subject).to eql(formatter)
+        end
+
+        it "supports tagged logging" do
+          expect(subject).to be_a ::LogStashLogger::TaggedLogging::Formatter
+        end
+      end
+
+      context "formatter lambda" do
+        let(:formatter) do
+          ->(severity, time, progname, msg) { msg }
+        end
+
+        it "returns the same formatter lambda" do
+          expect(subject).to eql(formatter)
+        end
+
+        it "supports tagged logging" do
+          expect(subject).to be_a ::LogStashLogger::TaggedLogging::Formatter
+        end
+      end
+    end
+  end
+end

data/spec/logger_spec.rb

@@ -0,0 +1,128 @@
+require 'logstash-logger'
+
+describe LogStashLogger do
+  include_context 'logger'
+
+  let! :listener do
+    case connection_type
+    when :tcp
+      TCPServer.new(port)
+    when :udp
+      UDPSocket.new.tap {|socket| socket.bind(host, port)}
+    end
+  end
+
+  # The TCP socket written to by the TCP logstash listener server
+  let(:tcp_client) { listener.accept }
+
+  # The logstash event to log
+  let(:logstash_event) do
+    LogStash::Event.new.tap do |event|
+      event['message'] = 'test'
+      event['severity'] = 'INFO'
+    end
+  end
+
+  # The raw input received by the logstash listener
+  let :listener_input do
+    case connection_type
+    when :tcp then tcp_client.readline
+    when :udp then listener.recvfrom(8192)[0]
+    end
+  end
+
+  # The logstash event received by the listener
+  let(:listener_event) { LogStash::Event.new(JSON.parse listener_input) }
+
+  #before(:each) do
+    # Sync socket writes so we can receive them in the listener immediately
+    #@socket = logdev.instance_variable_get(:@dev).send(:connect)
+    #@socket.sync = true
+  #end
+
+  after(:each) do
+    listener.close
+  end
+
+  # The socket that the logger is writing to
+  #let(:socket) { @socket }
+
+  it 'uses a LogStashLogger::Device as the log device' do
+    expect(logdev).to be_a Logger::LogDevice
+    expect(logdev.instance_variable_get(:@dev)).to be_a LogStashLogger::Device::Base
+  end
+
+  it 'takes a string message as input and writes a logstash event' do
+    message = 'test'
+    logger.info(message)
+
+    expect(listener_event['severity']).to eql('INFO')
+    expect(listener_event['message']).to eq(message)
+    expect(listener_event['host']).to eq(hostname)
+  end
+
+  it 'takes a logstash-formatted json string as input and writes out a logstash event' do
+    logger.info(logstash_event.to_json)
+
+    expect(listener_event['message']).to eq(logstash_event['message'])
+    expect(listener_event['host']).to eq(hostname)
+  end
+
+  it 'takes a LogStash::Event as input and writes it out intact' do
+    logger.warn(logstash_event)
+
+    expect(listener_event['message']).to eq(logstash_event['message'])
+    expect(listener_event['severity']).to eq(logstash_event['severity'])
+    expect(listener_event['@timestamp'].iso8601).to eq(logstash_event.timestamp.iso8601)
+    expect(listener_event['host']).to eq(hostname)
+  end
+
+  it 'takes a data hash as input and writes out a logstash event' do
+    data = {
+      'message' => 'test',
+      'severity' => 'INFO',
+      'foo' => 'bar'
+    }
+
+    logger.info(data.dup)
+
+    expect(listener_event['message']).to eq(data["message"])
+    expect(listener_event['severity']).to eq(data['severity'])
+    expect(listener_event['foo']).to eq(data['foo'])
+    expect(listener_event['host']).to eq(hostname)
+    expect(listener_event['@timestamp']).to_not be_nil
+  end
+
+  it 'takes any object as input and writes a logstash event' do
+    message = Time.now
+
+    logger.info(message)
+
+    expect(listener_event['message']).to eq(message.inspect)
+    expect(listener_event['host']).to eq(hostname)
+    expect(listener_event['severity']).to eq('INFO')
+  end
+
+  it 'allows event to be customized via configuration' do
+    LogStashLogger.configure do |config|
+      config.customize_event do |event|
+        event["test1"] = "response1"
+      end
+    end
+
+    logger.info("test")
+
+    expect(listener_event["test1"]).to eq("response1")
+  end
+
+  describe 'customize_event on instance' do
+    let!(:customize_event) { ->(event){ event['custom'] = 'custom' } }
+    let!(:logger) { LogStashLogger.new(host: host, port: port, type: connection_type, sync: true, customize_event: customize_event)}
+
+    specify 'logger produce messages with custom field' do
+      logger.info('test')
+      expect(listener_event['custom']).to eq('custom')
+    end
+  end
+
+end

data/spec/logstash_event_spec.rb

@@ -0,0 +1,139 @@
+require "logstash/event"
+require "insist"
+
+describe LogStash::Event do
+  subject do
+    LogStash::Event.new(
+      "@timestamp" => Time.iso8601("2013-01-01T00:00:00.000Z"),
+      "type" => "sprintf",
+      "message" => "hello world",
+      "tags" => [ "tag1" ],
+      "source" => "/home/foo",
+      "a" => "b",
+      "c" => {
+        "d" => "f",
+        "e" => {"f" => "g"}
+      },
+      "f" => { "g" => { "h" => "i" } },
+      "j" => {
+          "k1" => "v",
+          "k2" => [ "w", "x" ],
+          "k3" => {"4" => "m"},
+          5 => 6,
+          "5" => 7
+      }
+    )
+  end
+
+  context "#sprintf" do
+    it "should report a unix timestamp for %{+%s}" do
+      insist { subject.sprintf("%{+%s}") } == "1356998400"
+    end
+
+    it "should report a time with %{+format} syntax", :if => RUBY_ENGINE == "jruby" do
+      insist { subject.sprintf("%{+YYYY}") } == "2013"
+      insist { subject.sprintf("%{+MM}") } == "01"
+      insist { subject.sprintf("%{+HH}") } == "00"
+    end
+
+    it "should report fields with %{field} syntax" do
+      insist { subject.sprintf("%{type}") } == "sprintf"
+      insist { subject.sprintf("%{message}") } == subject["message"]
+    end
+
+    it "should print deep fields" do
+      insist { subject.sprintf("%{[j][k1]}") } == "v"
+      insist { subject.sprintf("%{[j][k2][0]}") } == "w"
+    end
+
+    it "should be able to take a non-string for the format" do
+      insist { subject.sprintf(2) } == "2"
+    end
+  end
+
+  context "#[]" do
+    it "should fetch data" do
+      insist { subject["type"] } == "sprintf"
+    end
+    it "should fetch fields" do
+      insist { subject["a"] } == "b"
+      insist { subject['c']['d'] } == "f"
+    end
+    it "should fetch deep fields" do
+      insist { subject["[j][k1]"] } == "v"
+      insist { subject["[c][d]"] } == "f"
+      insist { subject['[f][g][h]'] } == "i"
+      insist { subject['[j][k3][4]'] } == "m"
+      insist { subject['[j][5]'] } == 7
+
+    end
+
+    it "should be fast?", :if => ENV["SPEEDTEST"] do
+      2.times do
+        start = Time.now
+        100000.times { subject["[j][k1]"] }
+        puts "Duration: #{Time.now - start}"
+      end
+    end
+  end
+
+  context "#append" do
+    it "should append strings to an array" do
+      subject.append(LogStash::Event.new("message" => "another thing"))
+      insist { subject["message"] } == [ "hello world", "another thing" ]
+    end
+
+    it "should concatenate tags" do
+      subject.append(LogStash::Event.new("tags" => [ "tag2" ]))
+      insist { subject["tags"] } == [ "tag1", "tag2" ]
+    end
+
+    context "when event field is nil" do
+      it "should add single value as string" do
+        subject.append(LogStash::Event.new({"field1" => "append1"}))
+        insist { subject[ "field1" ] } == "append1"
+      end
+      it "should add multi values as array" do
+        subject.append(LogStash::Event.new({"field1" => [ "append1","append2" ]}))
+        insist { subject[ "field1" ] } == [ "append1","append2" ]
+      end
+    end
+
+    context "when event field is a string" do
+      before { subject[ "field1" ] = "original1" }
+
+      it "should append string to values, if different from current" do
+        subject.append(LogStash::Event.new({"field1" => "append1"}))
+        insist { subject[ "field1" ] } == [ "original1", "append1" ]
+      end
+      it "should not change value, if appended value is equal current" do
+        subject.append(LogStash::Event.new({"field1" => "original1"}))
+        insist { subject[ "field1" ] } == "original1"
+      end
+      it "should concatenate values in an array" do
+        subject.append(LogStash::Event.new({"field1" => [ "append1" ]}))
+        insist { subject[ "field1" ] } == [ "original1", "append1" ]
+      end
+      it "should join array, removing duplicates" do
+        subject.append(LogStash::Event.new({"field1" => [ "append1","original1" ]}))
+        insist { subject[ "field1" ] } == [ "original1", "append1" ]
+      end
+    end
+    context "when event field is an array" do
+      before { subject[ "field1" ] = [ "original1", "original2" ] }
+
+      it "should append string values to array, if not present in array" do
+        subject.append(LogStash::Event.new({"field1" => "append1"}))
+        insist { subject[ "field1" ] } == [ "original1", "original2", "append1" ]
+      end
+      it "should not append string values, if the array already contains it" do
+        subject.append(LogStash::Event.new({"field1" => "original1"}))
+        insist { subject[ "field1" ] } == [ "original1", "original2" ]
+      end
+      it "should join array, removing duplicates" do
+        subject.append(LogStash::Event.new({"field1" => [ "append1","original1" ]}))
+        insist { subject[ "field1" ] } == [ "original1", "original2", "append1" ]
+      end
+    end
+  end
+end