logstash-output-opensearch 1.0.0-java → 1.3.0-java

data/spec/integration/outputs/retry_spec.rb

@@ -46,14 +46,14 @@ describe "failures in bulk class expected behavior", :integration => true do
       "template_overwrite" => true,
       "hosts" => get_host_port(),
       "retry_max_interval" => 64,
-      "retry_initial_interval" => 2
+      "retry_initial_interval" => 2,
+      "ecs_compatibility" => "disabled" # specs are tightly tied to non-ECS defaults
     }
     next LogStash::Outputs::OpenSearch.new(settings)
   end
 
   before :each do
     # Delete all templates first.
-    require "elasticsearch"
     allow(Stud).to receive(:stoppable_sleep)
 
     # Clean OpenSearch of data before we start.

data/spec/integration/outputs/sniffer_spec.rb

@@ -15,9 +15,9 @@ require "socket"
 describe "pool sniffer", :integration => true do
   let(:logger) { Cabin::Channel.get }
   let(:adapter) { LogStash::Outputs::OpenSearch::HttpClient::ManticoreAdapter.new(logger) }
-  let(:es_host) { get_host_port.split(":").first }
+  let(:opensearch_host) { get_host_port.split(":").first }
   let(:es_port) { get_host_port.split(":").last }
-  let(:es_ip) { IPSocket.getaddress(es_host) }
+  let(:opensearch_ip) { IPSocket.getaddress(opensearch_host) }
   let(:initial_urls) { [::LogStash::Util::SafeURI.new("http://#{get_host_port}")] }
   let(:options) do
     {

data/spec/integration/outputs/templates_spec.rb

@@ -10,8 +10,12 @@
 require_relative "../../../spec/opensearch_spec_helper"
 
 describe "index template expected behavior", :integration => true do
+  let(:ecs_compatibility) { fail('spec group does not define `ecs_compatibility`!') }
+
   subject! do
     require "logstash/outputs/opensearch"
+    allow_any_instance_of(LogStash::Outputs::OpenSearch).to receive(:ecs_compatibility).and_return(ecs_compatibility)
+
     settings = {
       "manage_template" => true,
       "template_overwrite" => true,
@@ -21,8 +25,6 @@ describe "index template expected behavior", :integration => true do
   end
 
   before :each do
-    # Delete all templates first.
-    require "elasticsearch"
 
     # Clean OpenSearch of data before we start.
     @client = get_client
@@ -31,75 +33,97 @@ describe "index template expected behavior", :integration => true do
     # This can fail if there are no indexes, ignore failure.
     @client.indices.delete(:index => "*") rescue nil
 
-    subject.register
-
-    subject.multi_receive([
-      LogStash::Event.new("message" => "sample message here"),
-      LogStash::Event.new("somemessage" => { "message" => "sample nested message here" }),
-      LogStash::Event.new("somevalue" => 100),
-      LogStash::Event.new("somevalue" => 10),
-      LogStash::Event.new("somevalue" => 1),
-      LogStash::Event.new("country" => "us"),
-      LogStash::Event.new("country" => "at"),
-      LogStash::Event.new("geoip" => { "location" => [ 0.0, 0.0 ] })
-    ])
-
-    @client.indices.refresh
-
-    # Wait or fail until everything's indexed.
-    Stud::try(20.times) do
-      r = @client.search(index: 'logstash-*')
-      expect(r).to have_hits(8)
-    end
   end
 
-  it "permits phrase searching on string fields" do
-    results = @client.search(:q => "message:\"sample message\"")
-    expect(results).to have_hits(1)
-    expect(results["hits"]["hits"][0]["_source"]["message"]).to eq("sample message here")
-  end
+  context 'with ecs_compatibility => disabled' do
+    let(:ecs_compatibility) { :disabled }
+
+    before :each do
+      subject.register
+
+      subject.multi_receive([
+        LogStash::Event.new("message" => "sample message here"),
+        LogStash::Event.new("somemessage" => { "message" => "sample nested message here" }),
+        LogStash::Event.new("somevalue" => 100),
+        LogStash::Event.new("somevalue" => 10),
+        LogStash::Event.new("somevalue" => 1),
+        LogStash::Event.new("country" => "us"),
+        LogStash::Event.new("country" => "at"),
+        LogStash::Event.new("geoip" => { "location" => [ 0.0, 0.0 ] })
+      ])
+
+      @client.indices.refresh
+
+      # Wait or fail until everything's indexed.
+      Stud::try(20.times) do
+        r = @client.search(index: 'logstash-*')
+        expect(r).to have_hits(8)
+      end
+    end
 
-  it "numbers dynamically map to a numeric type and permit range queries" do
-    results = @client.search(:q => "somevalue:[5 TO 105]")
-    expect(results).to have_hits(2)
+    it "permits phrase searching on string fields" do
+      results = @client.search(:q => "message:\"sample message\"")
+      expect(results).to have_hits(1)
+      expect(results["hits"]["hits"][0]["_source"]["message"]).to eq("sample message here")
+    end
 
-    values = results["hits"]["hits"].collect { |r| r["_source"]["somevalue"] }
-    expect(values).to include(10)
-    expect(values).to include(100)
-    expect(values).to_not include(1)
-  end
+    it "numbers dynamically map to a numeric type and permit range queries" do
+      results = @client.search(:q => "somevalue:[5 TO 105]")
+      expect(results).to have_hits(2)
 
-  it "does not create .keyword field for top-level message field" do
-    results = @client.search(:q => "message.keyword:\"sample message here\"")
-    expect(results).to have_hits(0)
-  end
+      values = results["hits"]["hits"].collect { |r| r["_source"]["somevalue"] }
+      expect(values).to include(10)
+      expect(values).to include(100)
+      expect(values).to_not include(1)
+    end
 
-  it "creates .keyword field for nested message fields" do
-    results = @client.search(:q => "somemessage.message.keyword:\"sample nested message here\"")
-    expect(results).to have_hits(1)
-  end
+    it "does not create .keyword field for top-level message field" do
+      results = @client.search(:q => "message.keyword:\"sample message here\"")
+      expect(results).to have_hits(0)
+    end
 
-  it "creates .keyword field from any string field which is not_analyzed" do
-    results = @client.search(:q => "country.keyword:\"us\"")
-    expect(results).to have_hits(1)
-    expect(results["hits"]["hits"][0]["_source"]["country"]).to eq("us")
+    it "creates .keyword field for nested message fields" do
+      results = @client.search(:q => "somemessage.message.keyword:\"sample nested message here\"")
+      expect(results).to have_hits(1)
+    end
 
-    # partial or terms should not work.
-    results = @client.search(:q => "country.keyword:\"u\"")
-    expect(results).to have_hits(0)
-  end
+    it "creates .keyword field from any string field which is not_analyzed" do
+      results = @client.search(:q => "country.keyword:\"us\"")
+      expect(results).to have_hits(1)
+      expect(results["hits"]["hits"][0]["_source"]["country"]).to eq("us")
+
+      # partial or terms should not work.
+      results = @client.search(:q => "country.keyword:\"u\"")
+      expect(results).to have_hits(0)
+    end
+
+    it "make [geoip][location] a geo_point" do
+      expect(field_properties_from_template("logstash", "geoip")["location"]["type"]).to eq("geo_point")
+    end
 
-  it "make [geoip][location] a geo_point" do
-    expect(field_properties_from_template("logstash", "geoip")["location"]["type"]).to eq("geo_point")
+    it "aggregate .keyword results correctly " do
+      results = @client.search(:body => { "aggregations" => { "my_agg" => { "terms" => { "field" => "country.keyword" } } } })["aggregations"]["my_agg"]
+      terms = results["buckets"].collect { |b| b["key"] }
+
+      expect(terms).to include("us")
+
+      # 'at' is a stopword, make sure stopwords are not ignored.
+      expect(terms).to include("at")
+    end
   end
 
-  it "aggregate .keyword results correctly " do
-    results = @client.search(:body => { "aggregations" => { "my_agg" => { "terms" => { "field" => "country.keyword" } } } })["aggregations"]["my_agg"]
-    terms = results["buckets"].collect { |b| b["key"] }
+  context 'with ECS enabled' do
+    let(:ecs_compatibility) { :v1 }
 
-    expect(terms).to include("us")
+    before(:each) do
+      subject.register # should load template?
+      subject.multi_receive([LogStash::Event.new("message" => "sample message here")])
+    end
 
-    # 'at' is a stopword, make sure stopwords are not ignored.
-    expect(terms).to include("at")
+    it 'loads the templates' do
+      aggregate_failures do
+        expect(@client.indices.exists_template(name: 'ecs-logstash')).to be_truthy
+      end
+    end
   end
 end

data/spec/integration/outputs/update_spec.rb

@@ -12,7 +12,7 @@ require_relative "../../../spec/opensearch_spec_helper"
 describe "Update actions without scripts", :integration => true do
   require "logstash/outputs/opensearch"
 
-  def get_es_output( options={} )
+  def get_output( options={} )
     settings = {
       "manage_template" => true,
       "index" => "logstash-update",
@@ -40,20 +40,20 @@ describe "Update actions without scripts", :integration => true do
   end
 
   it "should fail without a document_id" do
-    subject = get_es_output
+    subject = get_output
     expect { subject.register }.to raise_error(LogStash::ConfigurationError)
   end
 
   context "when update only" do
     it "should not create new document" do
-      subject = get_es_output({ 'document_id' => "456" } )
+      subject = get_output({ 'document_id' => "456" } )
       subject.register
       subject.multi_receive([LogStash::Event.new("message" => "sample message here")])
-      expect {@client.get(:index => 'logstash-update', :type => doc_type, :id => "456", :refresh => true)}.to raise_error(Elasticsearch::Transport::Transport::Errors::NotFound)
+      expect {@client.get(:index => 'logstash-update', :type => doc_type, :id => "456", :refresh => true)}.to raise_error(OpenSearch::Transport::Transport::Errors::NotFound)
     end
 
     it "should update existing document" do
-      subject = get_es_output({ 'document_id' => "123" })
+      subject = get_output({ 'document_id' => "123" })
       subject.register
       subject.multi_receive([LogStash::Event.new("message" => "updated message here")])
       r = @client.get(:index => 'logstash-update', :type => doc_type, :id => "123", :refresh => true)
@@ -63,7 +63,7 @@ describe "Update actions without scripts", :integration => true do
     # The es ruby client treats the data field differently. Make sure this doesn't
     # raise an exception
     it "should update an existing document that has a 'data' field" do
-      subject = get_es_output({ 'document_id' => "123" })
+      subject = get_output({ 'document_id' => "123" })
       subject.register
       subject.multi_receive([LogStash::Event.new("data" => "updated message here", "message" => "foo")])
       r = @client.get(:index => 'logstash-update', :type => doc_type, :id => "123", :refresh => true)
@@ -72,27 +72,27 @@ describe "Update actions without scripts", :integration => true do
     end
 
     it "should allow default (internal) version" do
-      subject = get_es_output({ 'document_id' => "123", "version" => "99" })
+      subject = get_output({ 'document_id' => "123", "version" => "99" })
       subject.register
     end
 
     it "should allow internal version" do
-      subject = get_es_output({ 'document_id' => "123", "version" => "99", "version_type" => "internal" })
+      subject = get_output({ 'document_id' => "123", "version" => "99", "version_type" => "internal" })
       subject.register
     end
 
     it "should not allow external version" do
-      subject = get_es_output({ 'document_id' => "123", "version" => "99", "version_type" => "external" })
+      subject = get_output({ 'document_id' => "123", "version" => "99", "version_type" => "external" })
       expect { subject.register }.to raise_error(LogStash::ConfigurationError)
     end
 
     it "should not allow external_gt version" do
-      subject = get_es_output({ 'document_id' => "123", "version" => "99", "version_type" => "external_gt" })
+      subject = get_output({ 'document_id' => "123", "version" => "99", "version_type" => "external_gt" })
       expect { subject.register }.to raise_error(LogStash::ConfigurationError)
     end
 
     it "should not allow external_gte version" do
-      subject = get_es_output({ 'document_id' => "123", "version" => "99", "version_type" => "external_gte" })
+      subject = get_output({ 'document_id' => "123", "version" => "99", "version_type" => "external_gte" })
       expect { subject.register }.to raise_error(LogStash::ConfigurationError)
     end
 
@@ -100,7 +100,7 @@ describe "Update actions without scripts", :integration => true do
 
   context "when update with upsert" do
     it "should create new documents with provided upsert" do
-      subject = get_es_output({ 'document_id' => "456", 'upsert' => '{"message": "upsert message"}' })
+      subject = get_output({ 'document_id' => "456", 'upsert' => '{"message": "upsert message"}' })
       subject.register
       subject.multi_receive([LogStash::Event.new("message" => "sample message here")])
       r = @client.get(:index => 'logstash-update', :type => doc_type, :id => "456", :refresh => true)
@@ -108,7 +108,7 @@ describe "Update actions without scripts", :integration => true do
     end
 
     it "should create new documents with event/doc as upsert" do
-      subject = get_es_output({ 'document_id' => "456", 'doc_as_upsert' => true })
+      subject = get_output({ 'document_id' => "456", 'doc_as_upsert' => true })
       subject.register
       subject.multi_receive([LogStash::Event.new("message" => "sample message here")])
       r = @client.get(:index => 'logstash-update', :type => doc_type, :id => "456", :refresh => true)
@@ -116,7 +116,7 @@ describe "Update actions without scripts", :integration => true do
     end
 
     it "should fail on documents with event/doc as upsert at external version" do
-      subject = get_es_output({ 'document_id' => "456", 'doc_as_upsert' => true, 'version' => 999, "version_type" => "external" })
+      subject = get_output({ 'document_id' => "456", 'doc_as_upsert' => true, 'version' => 999, "version_type" => "external" })
       expect { subject.register }.to raise_error(LogStash::ConfigurationError)
     end
   end

data/spec/opensearch_spec_helper.rb

@@ -9,7 +9,7 @@
 
 require_relative './spec_helper'
 
-require 'elasticsearch'
+require 'opensearch'
 
 require 'json'
 require 'cabin'
@@ -24,7 +24,7 @@ module OpenSearchHelper
   end
 
   def get_client
-    Elasticsearch::Client.new(:hosts => [get_host_port])
+    OpenSearch::Client.new(:hosts => [get_host_port])
   end
 
   def doc_type
@@ -49,6 +49,16 @@ module OpenSearchHelper
     RSpec.configuration.filter[:version]
   end
 
+  def self.check_version?(*requirement)
+    version = self.version
+    if version.nil? || version.empty?
+      puts "version tag isn't set. Returning false from 'check_version?`."
+      return false
+    end
+    release_version = Gem::Version.new(version).release
+    Gem::Requirement.new(requirement).satisfied_by?(release_version)
+  end
+
   RSpec::Matchers.define :have_hits do |expected|
     match do |actual|
       expected == actual['hits']['total']['value']

data/spec/unit/outputs/opensearch/http_client/manticore_adapter_spec.rb

@@ -25,13 +25,13 @@ describe LogStash::Outputs::OpenSearch::HttpClient::ManticoreAdapter do
   it "should implement host unreachable exceptions" do
     expect(subject.host_unreachable_exceptions).to be_a(Array)
   end
-  
+
   describe "auth" do
     let(:user) { "myuser" }
     let(:password) { "mypassword" }
     let(:noauth_uri) { clone = uri.clone; clone.user=nil; clone.password=nil; clone }
     let(:uri) { ::LogStash::Util::SafeURI.new("http://#{user}:#{password}@localhost:9200") }
-    
+
     it "should convert the auth to params" do
       resp = double("response")
       allow(resp).to receive(:call)
@@ -39,10 +39,10 @@ describe LogStash::Outputs::OpenSearch::HttpClient::ManticoreAdapter do
       
       expected_uri = noauth_uri.clone
       expected_uri.path = "/"
-      
+
       expect(subject.manticore).to receive(:get).
         with(expected_uri.to_s, {
-          :headers => {"Content-Type" => "application/json"},
+          :headers => {"content-type" => "application/json"},
           :auth => {
             :user => user,
             :password => password,
@@ -54,6 +54,76 @@ describe LogStash::Outputs::OpenSearch::HttpClient::ManticoreAdapter do
     end
   end
 
+  describe "aws_iam" do
+    let(:options) { {
+      :auth_type => {
+        "type"=>"aws_iam",
+        "aws_access_key_id"=>"AAAAAAAAAAAAAAAAAAAA",
+        "aws_secret_access_key"=>"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
+    } }
+    subject { described_class.new(logger, options) }
+    let(:uri) { ::LogStash::Util::SafeURI.new("http://localhost:9200") }
+    let(:sign_aws_request) {  }
+
+    it "should validate AWS IAM credentials initialization" do
+      expect(subject.aws_iam_auth_initialization(options)).not_to be_nil
+    end
+
+    it "should validate signing aws request" do
+      resp = double("response")
+      allow(resp).to receive(:call)
+      allow(resp).to receive(:code).and_return(200)
+      allow(subject).to receive(:sign_aws_request).with(any_args).and_return(sign_aws_request)
+
+      expected_uri = uri.clone
+      expected_uri.path = "/"
+
+      expect(subject.manticore).to receive(:get).
+        with(expected_uri.to_s, {
+          :headers => {"content-type"=> "application/json"}
+        }
+        ).and_return resp
+
+      expect(subject).to receive(:sign_aws_request)
+      subject.perform_request(uri, :get, "/")
+    end
+  end
+
+  describe "basic_auth" do
+    let(:options) { {
+      :auth_type => {
+        "type"=>"basic",
+        "user" => "myuser",
+        "password" => "mypassword"}
+    } }
+    subject { described_class.new(logger, options) }
+    let(:user) {options[:auth_type]["user"]}
+    let(:password) {options[:auth_type]["password"]}
+    let(:noauth_uri) { clone = uri.clone; clone.user=nil; clone.password=nil; clone }
+    let(:uri) { ::LogStash::Util::SafeURI.new("http://localhost:9200") }
+
+    it "should validate master credentials with type as 'basic_auth'" do
+      resp = double("response")
+      allow(resp).to receive(:call)
+      allow(resp).to receive(:code).and_return(200)
+
+      expected_uri = noauth_uri.clone
+      expected_uri.path = "/"
+
+      expect(subject.manticore).to receive(:get).
+        with(expected_uri.to_s, {
+          :headers => {"content-type" => "application/json"},
+          :auth => {
+            :user => user,
+            :password => password,
+            :eager => true
+          }
+        }).and_return resp
+
+      subject.perform_request(uri, :get, "/")
+    end
+  end
+
   describe "bad response codes" do
     let(:uri) { ::LogStash::Util::SafeURI.new("http://localhost:9200") }
 

data/spec/unit/outputs/opensearch/http_client/pool_spec.rb

@@ -16,8 +16,7 @@ describe LogStash::Outputs::OpenSearch::HttpClient::Pool do
   let(:adapter) { LogStash::Outputs::OpenSearch::HttpClient::ManticoreAdapter.new(logger) }
   let(:initial_urls) { [::LogStash::Util::SafeURI.new("http://localhost:9200")] }
   let(:options) { {:resurrect_delay => 2, :url_normalizer => proc {|u| u}} } # Shorten the delay a bit to speed up tests
-  let(:node_versions) { [ "7.0.0" ] }
-  let(:get_distribution) { "oss" }
+  let(:node_versions) { [ "0.0.0" ] }
 
   subject { described_class.new(logger, adapter, initial_urls, options) }
 
@@ -32,7 +31,6 @@ describe LogStash::Outputs::OpenSearch::HttpClient::Pool do
     allow(::Manticore::Client).to receive(:new).and_return(manticore_double)
 
     allow(subject).to receive(:get_version).with(any_args).and_return(*node_versions)
-    allow(subject.distribution_checker).to receive(:get_distribution).and_return(get_distribution)
   end
 
   after do
@@ -212,94 +210,13 @@ describe LogStash::Outputs::OpenSearch::HttpClient::Pool do
     end
 
     it "picks the largest major version" do
-      expect(subject.maximum_seen_major_version).to eq(7)
+      expect(subject.maximum_seen_major_version).to eq(0)
     end
 
     context "if there are nodes with multiple major versions" do
-      let(:node_versions) { [ "0.0.0", "7.0.0" ] }
+      let(:node_versions) { [ "0.0.0", "6.0.0" ] }
       it "picks the largest major version" do
-        expect(subject.maximum_seen_major_version).to eq(7)
-      end
-    end
-  end
-  describe "distribution checking" do
-    before(:each) do
-      allow(subject).to receive(:health_check_request)
-    end
-
-    let(:options) do
-      super().merge(:distribution_checker => distribution_checker)
-    end
-
-    context 'when DistributionChecker#is_supported? returns false' do
-      let(:distribution_checker) { double('DistributionChecker', :is_supported? => false) }
-
-      it 'does not mark the URL as active' do
-        subject.update_initial_urls
-        expect(subject.alive_urls_count).to eq(0)
-      end
-    end
-
-    context 'when DistributionChecker#is_supported? returns true' do
-      let(:distribution_checker) { double('DistributionChecker', :is_supported? => true) }
-
-      it 'marks the URL as active' do
-        subject.update_initial_urls
-        expect(subject.alive_urls_count).to eq(1)
-      end
-    end
-  end
-  describe 'distribution checking with cluster output' do
-    let(:options) do
-      super().merge(:distribution_checker => LogStash::Outputs::OpenSearch::DistributionChecker.new(logger))
-    end
-
-    before(:each) do
-      allow(subject).to receive(:health_check_request)
-    end
-
-    context 'when using opensearch' do
-
-      context "if cluster doesn't return a valid distribution" do
-        let(:get_distribution) { nil }
-
-        it 'marks the url as dead' do
-          subject.update_initial_urls
-          expect(subject.alive_urls_count).to eq(0)
-        end
-
-        it 'logs message' do
-          expect(subject.distribution_checker).to receive(:log_not_supported).once.and_call_original
-          subject.update_initial_urls
-        end
-      end
-
-      context 'if cluster returns opensearch' do
-        let(:get_distribution) { 'opensearch' }
-
-        it "marks the url as active" do
-          subject.update_initial_urls
-          expect(subject.alive_urls_count).to eq(1)
-        end
-
-        it 'does not log message' do
-          expect(subject.distribution_checker).to_not receive(:log_not_supported)
-          subject.update_initial_urls
-        end
-      end
-
-      context 'if cluster returns oss' do
-        let(:get_distribution) { 'oss' }
-
-        it 'marks the url as active' do
-          subject.update_initial_urls
-          expect(subject.alive_urls_count).to eq(1)
-        end
-
-        it 'does not log message' do
-          expect(subject.distribution_checker).to_not receive(:log_not_supported)
-          subject.update_initial_urls
-        end
+        expect(subject.maximum_seen_major_version).to eq(6)
       end
     end
   end

data/spec/unit/outputs/opensearch/http_client_spec.rb

@@ -17,6 +17,7 @@ describe LogStash::Outputs::OpenSearch::HttpClient do
     opts = {
       :hosts => [::LogStash::Util::SafeURI.new("127.0.0.1")],
       :logger => Cabin::Channel.get,
+      :target_bulk_bytes => 9_000_000,
       :metric => ::LogStash::Instrument::NullMetric.new(:dummy).namespace(:alsodummy)
     }
 
@@ -156,7 +157,7 @@ describe LogStash::Outputs::OpenSearch::HttpClient do
     }
 
     it "should call index template" do
-      expect(subject.pool).to receive(:put).with("_template/#{template_name}", nil, anything).and_return(get_response)
+      expect(subject.pool).to receive(:put).with("/_template/#{template_name}", nil, anything).and_return(get_response)
       subject.template_put(template_name, template)
     end
   end
@@ -226,8 +227,8 @@ describe LogStash::Outputs::OpenSearch::HttpClient do
           end
         end
 
-        context "if a message is over TARGET_BULK_BYTES" do
-          let(:target_bulk_bytes) { LogStash::Outputs::OpenSearch::TARGET_BULK_BYTES }
+        context "if a message is over target_bulk_bytes" do
+          let(:target_bulk_bytes) { subject.target_bulk_bytes }
           let(:message) { "a" * (target_bulk_bytes + 1) }
 
           it "should be handled properly" do
@@ -256,8 +257,8 @@ describe LogStash::Outputs::OpenSearch::HttpClient do
             s = subject.send(:bulk, actions)
           end
 
-          context "if one exceeds TARGET_BULK_BYTES" do
-            let(:target_bulk_bytes) { LogStash::Outputs::OpenSearch::TARGET_BULK_BYTES }
+          context "if one exceeds target_bulk_bytes" do
+            let(:target_bulk_bytes) { subject.target_bulk_bytes }
             let(:message1) { "a" * (target_bulk_bytes + 1) }
             it "executes two bulk_send operations" do
               allow(subject).to receive(:join_bulk_responses)

data/spec/unit/outputs/opensearch/template_manager_spec.rb

@@ -13,9 +13,28 @@ require "logstash/outputs/opensearch/template_manager"
 describe LogStash::Outputs::OpenSearch::TemplateManager do
 
   describe ".default_template_path" do
-    context 'when ECS v1 is requested' do
-      it 'resolves' do
-        expect(described_class.default_template_path(7, :v1)).to end_with("/templates/ecs-v1/7x.json")
+    [1, 2].each do |major_version|
+      context "when ECS is disabled with OpenSearch #{major_version}.x" do
+        it 'resolves' do
+          expect(described_class.default_template_path(major_version)).to end_with("/templates/ecs-disabled/#{major_version}x.json")
+        end
+        it 'resolves' do
+          expect(described_class.default_template_path(major_version, :disabled)).to end_with("/templates/ecs-disabled/#{major_version}x.json")
+        end
+      end
+    end
+    [7, 1, 2].each do |major_version|
+      context "when ECS v1 is requested with OpenSearch #{major_version}.x" do
+        it 'resolves' do
+          expect(described_class.default_template_path(major_version, :v1)).to end_with("/templates/ecs-v1/#{major_version}x.json")
+        end
+      end
+    end
+    [1, 2].each do |major_version|
+      context "when ECS v8 is requested with OpenSearch #{major_version}.x" do
+        it 'resolves' do
+          expect(described_class.default_template_path(major_version, :v8)).to end_with("/templates/ecs-v8/#{major_version}x.json")
+        end
       end
     end
   end
@@ -33,4 +52,4 @@ describe LogStash::Outputs::OpenSearch::TemplateManager do
       end
     end
   end
-end
+end