logstash/spec/event.rb

require "logstash/event"
require "insist"

describe LogStash::Event do
  subject do
    event = LogStash::Event.new
    event.timestamp = Time.at(1356998400) #"2013-01-01T00:00:00.000Z"
    event.type = "sprintf"
    event.message = "hello world"
    event.tags = [ "tag1" ]
    event.source = "/home/foo"
    event.to_hash.merge!(
      "a" => "b", 
      "c" => { "d" => "f", "e.f" => "g" }, 
      "c.d" => "e",
      "f.g" => { "h" => "i" },
      "j" => { 
        "k1" => "v", 
        "k2" => [ "w", "x" ],
        "k3.4" => "m",
        5 => 6,
        "5" => 7
      } 
    )
    next event
  end

  context "#sprintf" do
    it "should report a unix timestamp for %{+%s}" do
      insist { subject.sprintf("%{+%s}") } == "1356998400"
    end
    
    it "should report a time with %{+format} syntax" do
      insist { subject.sprintf("%{+YYYY}") } == "2013"
      insist { subject.sprintf("%{+MM}") } == "01"
      insist { subject.sprintf("%{+HH}") } == "00"
    end
  
    it "should report fields with %{field} syntax" do
      insist { subject.sprintf("%{@type}") } == "sprintf"
      insist { subject.sprintf("%{@message}") } == subject["@message"]
    end
    
    it "should print deep fields" do
      insist { subject.sprintf("%{j.k1}") } == "v"
      insist { subject.sprintf("%{j.k2.0}") } == "w"
    end
  end
  
  context "#[]" do
    it "should fetch data" do
      insist { subject["@type"] } == "sprintf"
    end
    it "should fetch fields" do
      insist { subject["a"] } == "b"
      insist { subject['c\.d'] } == "e"
    end
    it "should fetch deep fields" do
      insist { subject["j.k1"] } == "v"
      insist { subject["c.d"] } == "f"
      insist { subject['f\.g.h'] } == "i"
      insist { subject['j.k3\.4'] } == "m"
      insist { subject['j.5'] } == 7

    end
  end

  context "#append" do
    it "should concatenate tags" do
      subject.append(LogStash::Event.new("tags" => [ "tag2" ]))
      insist { subject["tags"] } == [ "tag1", "tag2" ]
    end
  
    context "when event field is nil" do
      it "should add single value as string" do
        subject.append(LogStash::Event.new("field1" => "append1"))
        insist { subject[ "field1" ] } == "append1"
      end
      it "should add multi values as array" do
        subject.append(LogStash::Event.new("field1" => [ "append1","append2" ]))
        insist { subject[ "field1" ] } == [ "append1","append2" ]
      end
    end
  
    context "when event field is a string" do
      before { subject[ "field1" ] = "original1" }
  
      it "should append string to values, if different from current" do
        subject.append(LogStash::Event.new("field1" => "append1"))
        insist { subject[ "field1" ] } == [ "original1", "append1" ]
      end
      it "should not change value, if appended value is equal current" do
        subject.append(LogStash::Event.new("field1" => "original1"))
        insist { subject[ "field1" ] } == "original1"
      end
      it "should concatenate values in an array" do
        subject.append(LogStash::Event.new("field1" => [ "append1" ]))
        insist { subject[ "field1" ] } == [ "original1", "append1" ]
      end
      it "should join array, removing duplicates" do
        subject.append(LogStash::Event.new("field1" => [ "append1","original1" ]))
        insist { subject[ "field1" ] } == [ "original1", "append1" ]
      end
    end
    context "when event field is an array" do
      before { subject[ "field1" ] = [ "original1", "original2" ] }
  
      it "should append string values to array, if not present in array" do
        subject.append(LogStash::Event.new("field1" => "append1"))
        insist { subject[ "field1" ] } == [ "original1", "original2", "append1" ]
      end
      it "should not append string values, if the array already contains it" do
        subject.append(LogStash::Event.new("field1" => "original1"))
        insist { subject[ "field1" ] } == [ "original1", "original2" ]
      end
      it "should join array, removing duplicates" do
        subject.append(LogStash::Event.new("field1" => [ "append1","original1" ]))
        insist { subject[ "field1" ] } == [ "original1", "original2", "append1" ]
      end
    end
  end
end