From 1ceeed8628b87f9a3445a36369fd8aebeacafee5 Mon Sep 17 00:00:00 2001
From: Jordan Sissel <jls@semicomplete.com>
Date: Fri, 6 Sep 2013 18:04:28 -0700
Subject: [PATCH] - add tests to cover grok singles with duplicate field names

---
 spec/filters/grok.rb | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/spec/filters/grok.rb b/spec/filters/grok.rb
index b3a2ab62b..c4eee03af 100644
--- a/spec/filters/grok.rb
+++ b/spec/filters/grok.rb
@@ -409,4 +409,23 @@ describe LogStash::Filters::Grok do
       end
     end
   end
+
+  describe "singles with duplicate-named fields" do
+    config <<-CONFIG
+      filter {
+        grok {
+          match => [ "message", "%{INT:foo}|%{WORD:foo}" ]
+          singles => true
+        }
+      }
+    CONFIG
+
+    sample "hello world" do
+      insist { subject["foo"] }.is_a?(String)
+    end
+
+    sample "123 world" do
+      insist { subject["foo"] }.is_a?(String)
+    end
+  end
 end