github-mirrors/logstash
1
0
Fork 0
mirror of https://github.com/elastic/logstash.git synced 2025-04-24 06:37:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

- fix syslog example spec

Browse source
This commit is contained in:
Jordan Sissel 2013-06-19 10:07:15 -07:00
parent e48f05e607
commit 6dc538e23f
1 changed files with 7 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

16
spec/examples/syslog.rb
View file

@ -10,7 +10,7 @@ describe "parse syslog" do
singles => true
pattern => [ "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{PROG:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" ]
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{@source_host}" ]
add_field => [ "received_from", "%{source_host}" ]
}
syslog_pri {
type => "syslog"
@ -22,8 +22,8 @@ describe "parse syslog" do
mutate {
type => "syslog"
exclude_tags => "_grokparsefailure"
replace => [ "@source_host", "%{syslog_hostname}" ]
replace => [ "@message", "%{syslog_message}" ]
replace => [ "source_host", "%{syslog_hostname}" ]
replace => [ "message", "%{syslog_message}" ]
}
mutate {
type => "syslog"
@ -32,18 +32,16 @@ describe "parse syslog" do
}
CONFIG
sample("@message" => "<164>Oct 26 15:19:25 1.2.3.4 %ASA-4-106023: Deny udp src DRAC:10.1.2.3/43434 dst outside:192.168.0.1/53 by access-group \"acl_drac\" [0x0, 0x0]", "@type" => "syslog") do
sample("message" => "<164>Oct 26 15:19:25 1.2.3.4 %ASA-4-106023: Deny udp src DRAC:10.1.2.3/43434 dst outside:192.168.0.1/53 by access-group \"acl_drac\" [0x0, 0x0]", "type" => "syslog") do
insist { subject.type } == "syslog"
reject { subject.tags }.include?("_grokparsefailure")
insist { subject.tags }.nil?
insist { subject["syslog_pri"] } == "164"
#insist { subject.timestamp } == "2012-10-26T15:19:25.000Z"
puts subject.to_hash
end
# Single digit day
sample("@message" => "<164>Oct 6 15:19:25 1.2.3.4 %ASA-4-106023: Deny udp src DRAC:10.1.2.3/43434 dst outside:192.168.0.1/53 by access-group \"acl_drac\" [0x0, 0x0]", "@type" => "syslog") do
sample("message" => "<164>Oct 6 15:19:25 1.2.3.4 %ASA-4-106023: Deny udp src DRAC:10.1.2.3/43434 dst outside:192.168.0.1/53 by access-group \"acl_drac\" [0x0, 0x0]", "type" => "syslog") do
insist { subject.type } == "syslog"
reject { subject.tags }.include?("_grokparsefailure")
insist { subject.tags }.nil?
insist { subject["syslog_pri"] } == "164"
#insist { subject.timestamp } == "2012-10-26T15:19:25.000Z"
puts subject.to_hash