Skip to content

Commit 6116ef4

Browse files
chernjiejsvd
chernjie
authored and
jsvd
committed
Fix #93, add test that checks for matched values
Fixes #102
1 parent 8e0191c commit 6116ef4

File tree

1 file changed

+93
-14
lines changed

1 file changed

+93
-14
lines changed

‎spec/patterns/httpd_spec.rb‎

Lines changed: 93 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,28 @@
22
require "spec_helper"
33
require "logstash/patterns/core"
44

5-
describe "HTTPD_COMMONLOG" do
5+
describe "HTTPD_COMBINEDLOG" do
66

7-
context "COMMONAPACHELOG", "Typical test case" do
7+
context "HTTPD_COMBINEDLOG", "Typical test case" do
88

9-
let(:value) { '83.149.9.216 - - [24/Feb/2015:23:13:42 +0000] "GET /presentations/logstash-monitorama-2013/images/kibana-search.png HTTP/1.1" 200 203023 "http://semicomplete.com/presentations/logstash-monitorama-2013/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36'}
9+
let(:value) { '83.149.9.216 - - [24/Feb/2015:23:13:42 +0000] "GET /presentations/logstash-monitorama-2013/images/kibana-search.png HTTP/1.1" 200 203023 "http://semicomplete.com/presentations/logstash-monitorama-2013/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36"'}
1010

1111
it "generates the clientip field" do
12-
expect(grok_match(subject, value)).to include("clientip" => "83.149.9.216")
12+
expect(grok_match(subject, value)).to include(
13+
'clientip' => '83.149.9.216',
14+
'verb' => 'GET',
15+
'request' => '/presentations/logstash-monitorama-2013/images/kibana-search.png',
16+
'httpversion' => '1.1',
17+
'response' => '200',
18+
'bytes' => '203023',
19+
'referrer' => '"http://semicomplete.com/presentations/logstash-monitorama-2013/"',
20+
'agent' => '"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36"'
21+
)
1322
end
1423

1524
end
1625

17-
context "COMMONAPACHELOG", "Email address in auth field" do
26+
context "HTTPD_COMBINEDLOG", "Email address in auth field" do
1827

1928
let(:value) { '10.0.0.1 - [email protected] [07/Apr/2016:18:42:24 +0000] "GET /bar/foo/users/1/username%40example.com/authenticate?token=blargh&client_id=15 HTTP/1.1" 400 75 "" "Mozilla/5.0 (iPad; CPU OS 9_3_1 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13E238 Safari/601.1"'}
2029

@@ -28,21 +37,91 @@
2837

2938
describe "HTTPD_ERRORLOG" do
3039

31-
it "matches a full httpd 2.4 message" do
32-
expect(subject).to match("[Mon Aug 31 09:30:48.958285 2015] [proxy_fcgi:error] [pid 28787:tid 140169587934976] (70008)Partial results are valid but processing is incomplete: [client 58.13.45.166:59307] AH01075: Error dispatching request to : (reading input brigade), referer: http://example.com/index.php?id_product=11&controller=product")
40+
context "HTTPD_ERRORLOG", "matches a full httpd 2.4 message" do
41+
let(:value) {
42+
"[Mon Aug 31 09:30:48.958285 2015] [proxy_fcgi:error] [pid 28787:tid 140169587934976] (70008)Partial results are valid but processing is incomplete: [client 58.13.45.166:59307] AH01075: Error dispatching request to : (reading input brigade), referer: http://example.com/index.php?id_product=11&controller=product"
43+
}
44+
it "generates the fields" do
45+
46+
expect(grok_match(subject, value)).to include(
47+
'timestamp' => 'Mon Aug 31 09:30:48.958285 2015',
48+
'module' => 'proxy_fcgi',
49+
'loglevel' => 'error',
50+
'pid' => '28787',
51+
'tid' => '140169587934976',
52+
'proxy_errorcode' => '70008',
53+
'proxy_message' => 'Partial results are valid but processing is incomplete',
54+
'clientip' => '58.13.45.166',
55+
'clientport' => '59307',
56+
'errorcode' => 'AH01075',
57+
'message' => [ value, 'Error dispatching request to : (reading input brigade), referer: http://example.com/index.php?id_product=11&controller=product' ],
58+
)
59+
end
3360
end
3461

35-
it "matches a httpd 2.2 log message" do
36-
expect(subject).to match("[Mon Aug 31 16:27:04 2015] [error] [client 10.17.42.3] Premature end of script headers: example.com")
62+
context "HTTPD_ERRORLOG", "matches a httpd 2.2 log message" do
63+
let(:value) {
64+
"[Mon Aug 31 16:27:04 2015] [error] [client 10.17.42.3] Premature end of script headers: example.com"
65+
}
66+
it "generates the fields" do
67+
expect(grok_match(subject, value)).to include(
68+
'timestamp' => 'Mon Aug 31 16:27:04 2015',
69+
'loglevel' => 'error',
70+
'clientip' => '10.17.42.3',
71+
'message' => [ value, 'Premature end of script headers: example.com' ]
72+
)
73+
end
3774
end
3875

39-
it "matches a short httpd 2.4 message" do
40-
expect(subject).to match("[Mon Aug 31 07:15:38.664897 2015] [proxy_fcgi:error] [pid 28786:tid 140169629898496] [client 81.139.1.34:52042] AH01071: Got error 'Primary script unknown\n'")
76+
context "HTTPD_ERRORLOG", "matches a short httpd 2.4 message" do
77+
let(:value) {
78+
"[Mon Aug 31 07:15:38.664897 2015] [proxy_fcgi:error] [pid 28786:tid 140169629898496] [client 81.139.1.34:52042] AH01071: Got error 'Primary script unknown\n'"
79+
}
80+
it "generates the fields" do
81+
expect(grok_match(subject, value)).to include(
82+
'timestamp' => 'Mon Aug 31 07:15:38.664897 2015',
83+
'module' => 'proxy_fcgi',
84+
'loglevel' => 'error',
85+
'pid' => '28786',
86+
'tid' => '140169629898496',
87+
'clientip' => '81.139.1.34',
88+
'clientport' => '52042',
89+
'errorcode' => 'AH01071',
90+
'message' => [ value, "Got error 'Primary script unknown\n'" ]
91+
)
92+
end
4193
end
4294

43-
it "matches an httpd 2.4 restart" do
44-
expect(subject).to match("[Mon Aug 31 06:29:47.406518 2015] [mpm_event:notice] [pid 24968:tid 140169861986176] AH00489: Apache/2.4.16 (Ubuntu) configured -- resuming normal operations")
45-
expect(subject).to match("[Mon Aug 31 06:29:47.406530 2015] [core:notice] [pid 24968:tid 140169861986176] AH00094: Command line: '/usr/sbin/apache2'")
95+
context "HTTPD_ERRORLOG", "matches an httpd 2.4 restart" do
96+
let(:value1) {
97+
"[Mon Aug 31 06:29:47.406518 2015] [mpm_event:notice] [pid 24968:tid 140169861986176] AH00489: Apache/2.4.16 (Ubuntu) configured -- resuming normal operations"
98+
}
99+
it "generates the fields" do
100+
expect(grok_match(subject, value1)).to include(
101+
'timestamp' => 'Mon Aug 31 06:29:47.406518 2015',
102+
'module' => 'mpm_event',
103+
'loglevel' => 'notice',
104+
'pid' => '24968',
105+
'tid' => '140169861986176',
106+
'errorcode' => 'AH00489',
107+
'message' => [ value1, 'Apache/2.4.16 (Ubuntu) configured -- resuming normal operations' ]
108+
)
109+
end
110+
111+
let(:value2) {
112+
"[Mon Aug 31 06:29:47.406530 2015] [core:notice] [pid 24968:tid 140169861986176] AH00094: Command line: '/usr/sbin/apache2'"
113+
}
114+
it "generates the fields" do
115+
expect(grok_match(subject, value2)).to include(
116+
'timestamp' => 'Mon Aug 31 06:29:47.406530 2015',
117+
'module' => 'core',
118+
'loglevel' => 'notice',
119+
'pid' => '24968',
120+
'tid' => '140169861986176',
121+
'errorcode' => 'AH00094',
122+
'message' => [ value2, 'Command line: \'/usr/sbin/apache2\'' ]
123+
)
124+
end
46125
end
47126

48127
end

0 commit comments

Comments
 (0)