diff --git a/lib/logstash/filters/alter.rb b/lib/logstash/filters/alter.rb index cdd61db6d..67862e629 100644 --- a/lib/logstash/filters/alter.rb +++ b/lib/logstash/filters/alter.rb @@ -61,7 +61,7 @@ class LogStash::Filters::Alter < LogStash::Filters::Base @condrewrite_parsed = [] @condrewrite.nil? or @condrewrite.each_slice(3) do |field, expected, replacement| if [field, expected, replacement].any? {|n| n.nil?} - @logger.error("Invalid condrewrte configuration. condrewrite has to define 3 elements per config entry", :file => file, :expected => expected, :replacement => replacement) + @logger.error("Invalid condrewrte configuration. condrewrite has to define 3 elements per config entry", :field => field, :expected => expected, :replacement => replacement) raise "Bad configuration, aborting." end @condrewrite_parsed << { @@ -74,7 +74,7 @@ class LogStash::Filters::Alter < LogStash::Filters::Base @condrewriteother_parsed = [] @condrewriteother.nil? or @condrewriteother.each_slice(4) do |field, expected, replacement_field, replacement_value| if [field, expected, replacement_field, replacement_value].any? {|n| n.nil?} - @logger.error("Invalid condrewrteother configuration. condrewriteother has to define 4 elements per config entry", :file => file, :expected => expected, :replacement_field => replacementfield, :replacement_value => replacementvalue) + @logger.error("Invalid condrewrteother configuration. condrewriteother has to define 4 elements per config entry", :field => field, :expected => expected, :replacement_field => replacement_field, :replacement_value => replacement_value) raise "Bad configuration, aborting." end @condrewriteother_parsed << { @@ -119,14 +119,14 @@ class LogStash::Filters::Alter < LogStash::Filters::Base if event[field].is_a?(Array) event[field] = event[field].map do |v| - if v == expected + if v == event.sprintf(expected) v = event.sprintf(replacement) else v end end else - if event[field] == expected + if event[field] == event.sprintf(expected) event[field] = event.sprintf(replacement) end end @@ -143,12 +143,12 @@ class LogStash::Filters::Alter < LogStash::Filters::Base if event[field].is_a?(Array) event[field].each do |v| - if v == expected + if v == event.sprintf(expected) event[replacement_field] = event.sprintf(replacement_value) end end else - if event[field] == expected + if event[field] == event.sprintf(expected) event[replacement_field] = event.sprintf(replacement_value) end end @@ -162,7 +162,7 @@ class LogStash::Filters::Alter < LogStash::Filters::Base subst_array = config[:subst_array] substitution_parsed = subst_array.map { |x| event.sprintf(x) } - not_nul_index = substitution_parsed.find_index { |x| not x.nil? and not x.eql?("nil") } + not_nul_index = substitution_parsed.find_index { |x| not x.nil? and not x.eql?("nil") and not (not x.index("%").nil? && x.match(/%\{[^}]\}/).nil?) } if not not_nul_index.nil? event[field] = substitution_parsed[not_nul_index] end diff --git a/spec/filters/alter.rb b/spec/filters/alter.rb new file mode 100644 index 000000000..20f6a08a8 --- /dev/null +++ b/spec/filters/alter.rb @@ -0,0 +1,127 @@ +require "test_utils" +require "logstash/filters/alter" + +describe LogStash::Filters::Alter do + extend LogStash::RSpec + + describe "condrewrite with static values" do + config <<-CONFIG + filter { + alter { + condrewrite => ["rewrite-me", "hello", "goodbye"] + } + } + CONFIG + + sample "@fields" => { + "rewrite-me" => "hello" + } do + insist { subject["rewrite-me"] } == "goodbye" + end + + sample "@fields" => { + "rewrite-me" => "greetings" + } do + insist { subject["rewrite-me"] } == "greetings" + end + end + + describe "condrewrite with dynamic values" do + config <<-CONFIG + filter { + alter { + condrewrite => ["rewrite-me", "%{test}", "%{rewrite-value}"] + } + } + CONFIG + + sample "@fields" => { + "rewrite-me" => "hello", + "test" => "hello", + "rewrite-value" => "goodbye" + } do + insist { subject["rewrite-me"] } == "goodbye" + end + + sample "@fields" => { + "rewrite-me" => "hello" + #Missing test and rewrite fields + } do + insist { subject["rewrite-me"] } == "hello" + end + + sample "@fields" => { + "rewrite-me" => "%{test}" + #Missing test and rewrite fields + } do + insist { subject["rewrite-me"] } == "%{rewrite-value}" + end + + sample "@fields" => { + "rewrite-me" => "hello", + "test" => "hello" + #Missing rewrite value + } do + insist { subject["rewrite-me"] } == "%{rewrite-value}" + end + + sample "@fields" => { + "rewrite-me" => "greetings", + "test" => "hello" + } do + insist { subject["rewrite-me"] } == "greetings" + end + end + + describe "condrewriteother" do + config <<-CONFIG + filter { + alter { + condrewriteother => ["test-me", "hello", "rewrite-me","goodbye"] + } + } + CONFIG + + sample "@fields" => { + "test-me" => "hello" + } do + insist { subject["rewrite-me"] } == "goodbye" + end + + sample "@fields" => { + "test-me" => "hello", + "rewrite-me" => "hello2" + } do + insist { subject["rewrite-me"] } == "goodbye" + end + + sample "@fields" => { + "test-me" => "greetings" + } do + insist { subject["rewrite-me"] }.nil? + end + + sample "@fields" => { + "test-me" => "greetings", + "rewrite-me" => "hello2" + } do + insist { subject["rewrite-me"] } == "hello2" + end + end + + describe "coalesce" do + config <<-CONFIG + filter { + alter { + coalesce => ["coalesce-me", "%{non-existing-field}", "mydefault"] + } + } + CONFIG + + sample "@fields" => { + "coalesce-me" => "Hello" + } do + insist { subject["coalesce-me"] } == "mydefault" + end + end +end