Skip to content

Commit 587f941

Browse files
cosmo0920cosmo0920
committed
Add testcase for ecs-v1 compatible grok pattern series
Signed-off-by: Hiroshi Hatake <[email protected]>
1 parent a6cba17 commit 587f941

File tree

1 file changed

+91
-41
lines changed

1 file changed

+91
-41
lines changed

‎test/test_grok_parser.rb‎

Lines changed: 91 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -53,24 +53,46 @@ class GrokParserTest < ::Test::Unit::TestCase
5353
{"mac_address" => "DEAD.BEEF.1234", "ip_address" => "127.0.0.1"})
5454
end
5555

56-
test "complex pattern" do
57-
internal_test_grok_pattern("%{COMBINEDAPACHELOG}", '127.0.0.1 192.168.0.1 - [28/Feb/2013:12:00:00 +0900] "GET / HTTP/1.1" 200 777 "-" "Opera/12.0"',
58-
str2time("28/Feb/2013:12:00:00 +0900", "%d/%b/%Y:%H:%M:%S %z"),
59-
{
60-
"clientip" => "127.0.0.1",
61-
"ident" => "192.168.0.1",
62-
"auth" => "-",
63-
"verb" => "GET",
64-
"request" => "/",
65-
"httpversion" => "1.1",
66-
"response" => "200",
67-
"bytes" => "777",
68-
"referrer" => "\"-\"",
69-
"agent" => "\"Opera/12.0\""
70-
},
71-
"time_key" => "timestamp",
72-
"time_format" => "%d/%b/%Y:%H:%M:%S %z"
73-
)
56+
sub_test_case "complex pattern w/ grok_pattern_series" do
57+
test "legacy" do
58+
internal_test_grok_pattern("%{COMBINEDAPACHELOG}", '127.0.0.1 192.168.0.1 - [28/Feb/2013:12:00:00 +0900] "GET / HTTP/1.1" 200 777 "-" "Opera/12.0"',
59+
str2time("28/Feb/2013:12:00:00 +0900", "%d/%b/%Y:%H:%M:%S %z"),
60+
{
61+
"clientip" => "127.0.0.1",
62+
"ident" => "192.168.0.1",
63+
"auth" => "-",
64+
"verb" => "GET",
65+
"request" => "/",
66+
"httpversion" => "1.1",
67+
"response" => "200",
68+
"bytes" => "777",
69+
"referrer" => "\"-\"",
70+
"agent" => "\"Opera/12.0\""
71+
},
72+
"time_key" => "timestamp",
73+
"time_format" => "%d/%b/%Y:%H:%M:%S %z",
74+
"grok_pattern_series" => "legacy"
75+
)
76+
end
77+
78+
test "ecs-v1" do
79+
internal_test_grok_pattern("%{COMBINEDAPACHELOG}", '127.0.0.1 192.168.0.1 - [28/Feb/2013:12:00:00 +0900] "GET / HTTP/1.1" 200 777 "-" "Opera/12.0"',
80+
str2time("28/Feb/2013:12:00:00 +0900", "%d/%b/%Y:%H:%M:%S %z"),
81+
{
82+
"[apache][access][user][identity]" => "192.168.0.1",
83+
"[http][request][method]" => "GET",
84+
"[http][response][body][bytes]" => 777,
85+
"[http][response][status_code]" => 200,
86+
"[http][version]" => "1.1",
87+
"[source][address]" => "127.0.0.1",
88+
"[url][original]" => "/",
89+
"[user_agent][original]" => "Opera/12.0",
90+
},
91+
"time_key" => "timestamp",
92+
"time_format" => "%d/%b/%Y:%H:%M:%S %z",
93+
"grok_pattern_series" => "ecs-v1"
94+
)
95+
end
7496
end
7597

7698
test "custom pattern" do
@@ -334,29 +356,57 @@ class GrokParserTest < ::Test::Unit::TestCase
334356
end
335357

336358
sub_test_case "grok section" do
337-
test "complex pattern" do
338-
d = create_driver(%[
339-
<grok>
340-
pattern %{COMBINEDAPACHELOG}
341-
time_key timestamp
342-
time_format %d/%b/%Y:%H:%M:%S %z
343-
</grok>
344-
])
345-
expected_record = {
346-
"clientip" => "127.0.0.1",
347-
"ident" => "192.168.0.1",
348-
"auth" => "-",
349-
"verb" => "GET",
350-
"request" => "/",
351-
"httpversion" => "1.1",
352-
"response" => "200",
353-
"bytes" => "777",
354-
"referrer" => "\"-\"",
355-
"agent" => "\"Opera/12.0\""
356-
}
357-
d.instance.parse('127.0.0.1 192.168.0.1 - [28/Feb/2013:12:00:00 +0900] "GET / HTTP/1.1" 200 777 "-" "Opera/12.0"') do |time, record|
358-
assert_equal(expected_record, record)
359-
assert_equal(event_time("28/Feb/2013:12:00:00 +0900", format: "%d/%b/%Y:%H:%M:%S %z"), time)
359+
sub_test_case "complex pattern w/ grok_pattern_series" do
360+
test "legacy" do
361+
d = create_driver(%[
362+
grok_pattern_series legacy
363+
<grok>
364+
pattern %{COMBINEDAPACHELOG}
365+
time_key timestamp
366+
time_format %d/%b/%Y:%H:%M:%S %z
367+
</grok>
368+
])
369+
expected_record = {
370+
"clientip" => "127.0.0.1",
371+
"ident" => "192.168.0.1",
372+
"auth" => "-",
373+
"verb" => "GET",
374+
"request" => "/",
375+
"httpversion" => "1.1",
376+
"response" => "200",
377+
"bytes" => "777",
378+
"referrer" => "\"-\"",
379+
"agent" => "\"Opera/12.0\""
380+
}
381+
d.instance.parse('127.0.0.1 192.168.0.1 - [28/Feb/2013:12:00:00 +0900] "GET / HTTP/1.1" 200 777 "-" "Opera/12.0"') do |time, record|
382+
assert_equal(expected_record, record)
383+
assert_equal(event_time("28/Feb/2013:12:00:00 +0900", format: "%d/%b/%Y:%H:%M:%S %z"), time)
384+
end
385+
end
386+
387+
test "ecs-v1" do
388+
d = create_driver(%[
389+
grok_pattern_series ecs-v1
390+
<grok>
391+
pattern %{HTTPD_COMBINEDLOG}
392+
time_key timestamp
393+
time_format %d/%b/%Y:%H:%M:%S %z
394+
</grok>
395+
])
396+
expected_record = {
397+
"[apache][access][user][identity]" => "192.168.0.1",
398+
"[http][request][method]" => "GET",
399+
"[http][response][body][bytes]" => 777,
400+
"[http][response][status_code]" => 200,
401+
"[http][version]" => "1.1",
402+
"[source][address]" => "127.0.0.1",
403+
"[url][original]" => "/",
404+
"[user_agent][original]" => "Opera/12.0"
405+
}
406+
d.instance.parse('127.0.0.1 192.168.0.1 - [28/Feb/2013:12:00:00 +0900] "GET / HTTP/1.1" 200 777 "-" "Opera/12.0"') do |time, record|
407+
assert_equal(expected_record, record)
408+
assert_equal(event_time("28/Feb/2013:12:00:00 +0900", format: "%d/%b/%Y:%H:%M:%S %z"), time)
409+
end
360410
end
361411
end
362412

0 commit comments

Comments
 (0)