# encoding: utf-8 require "logstash/devutils/rspec/spec_helper" require "logstash/plugin" require "logstash/filters/elasticsearch" require "logstash/json" describe LogStash::Filters::Elasticsearch do context "registration" do let(:plugin) { LogStash::Plugin.lookup("filter", "elasticsearch").new({}) } it "should not raise an exception" do expect {plugin.register}.to_not raise_error end end describe "data fetch" do let(:config) do { "hosts" => ["localhost:9200"], "query" => "response: 404", "fields" => [ ["response", "code"] ], } end let(:plugin) { described_class.new(config) } let(:event) { LogStash::Event.new({}) } let(:response) do LogStash::Json.load(File.read(File.join(File.dirname(__FILE__), "fixtures", "request_x_1.json"))) end let(:client) { double(:client) } before(:each) do allow(LogStash::Filters::ElasticsearchClient).to receive(:new).and_return(client) allow(client).to receive(:search).and_return(response) plugin.register end it "should enhance the current event with new data" do plugin.filter(event) expect(event.get("code")).to eq(404) end context "when asking for more than one result" do let(:config) do { "hosts" => ["localhost:9200"], "query" => "response: 404", "fields" => [ ["response", "code"] ], "result_size" => 10 } end let(:response) do LogStash::Json.load(File.read(File.join(File.dirname(__FILE__), "fixtures", "request_x_10.json"))) end it "should enhance the current event with new data" do plugin.filter(event) expect(event.get("code")).to eq([404]*10) end end context "if something wrong happen during connection" do before(:each) do allow(LogStash::Filters::ElasticsearchClient).to receive(:new).and_return(client) allow(client).to receive(:search).and_raise("connection exception") plugin.register end it "tag the event as something happened, but still deliver it" do expect(plugin.logger).to receive(:warn) plugin.filter(event) expect(event.to_hash["tags"]).to include("_elasticsearch_lookup_failure") end end end end