Examples with Rule org.graylog.plugins.pipelineprocessor.ast.Rule used on opensource projects

Example 1 with Rule

use of org.graylog.plugins.pipelineprocessor.ast.Rule in project graylog2-server by Graylog2.

the class FunctionsSnippetsTest method stringLength.

@Test
public void stringLength() {
    final Rule rule = parser.parseRule(ruleForTest(), false);
    final Message message = evaluateRule(rule);
    assertThat(message).isNotNull();
    assertThat(message.getField("chars_utf8")).isEqualTo(5L);
    assertThat(message.getField("bytes_utf8")).isEqualTo(6L);
    assertThat(message.getField("chars_ascii")).isEqualTo(5L);
    assertThat(message.getField("bytes_ascii")).isEqualTo(5L);
}

Example 2 with Rule

use of org.graylog.plugins.pipelineprocessor.ast.Rule in project graylog2-server by Graylog2.

the class FunctionsSnippetsTest method dateArithmetic.

@Test
public void dateArithmetic() {
    final InstantMillisProvider clock = new InstantMillisProvider(GRAYLOG_EPOCH);
    DateTimeUtils.setCurrentMillisProvider(clock);
    try {
        final Rule rule = parser.parseRule(ruleForTest(), true);
        final Message message = evaluateRule(rule);
        assertThat(actionsTriggered.get()).isTrue();
        assertThat(message).isNotNull();
        assertThat(message.getField("interval")).isInstanceOf(Duration.class).matches(o -> ((Duration) o).isEqual(Duration.standardDays(1)), "Exactly one day difference");
        assertThat(message.getField("years")).isEqualTo(Period.years(2));
        assertThat(message.getField("months")).isEqualTo(Period.months(2));
        assertThat(message.getField("weeks")).isEqualTo(Period.weeks(2));
        assertThat(message.getField("days")).isEqualTo(Period.days(2));
        assertThat(message.getField("hours")).isEqualTo(Period.hours(2));
        assertThat(message.getField("minutes")).isEqualTo(Period.minutes(2));
        assertThat(message.getField("seconds")).isEqualTo(Period.seconds(2));
        assertThat(message.getField("millis")).isEqualTo(Period.millis(2));
        assertThat(message.getField("period")).isEqualTo(Period.parse("P1YT1M"));
        assertThat(message.getFieldAs(DateTime.class, "long_time_ago")).matches(date -> date.plus(Period.years(10000)).equals(GRAYLOG_EPOCH));
        assertThat(message.getTimestamp()).isEqualTo(GRAYLOG_EPOCH.plusHours(1));
    } finally {
        DateTimeUtils.setCurrentMillisSystem();
    }
}

Example 3 with Rule

use of org.graylog.plugins.pipelineprocessor.ast.Rule in project graylog2-server by Graylog2.

the class FunctionsSnippetsTest method int2ipv4.

@Test
public void int2ipv4() {
    final Rule rule = parser.parseRule(ruleForTest(), true);
    evaluateRule(rule);
    assertThat(actionsTriggered.get()).isTrue();
}

Example 4 with Rule

use of org.graylog.plugins.pipelineprocessor.ast.Rule in project graylog2-server by Graylog2.

the class FunctionsSnippetsTest method routeToStream.

@Test
public void routeToStream() {
    final Rule rule = parser.parseRule(ruleForTest(), true);
    final Message message = evaluateRule(rule);
    assertThat(message).isNotNull();
    assertThat(message.getStreams()).isNotEmpty();
    assertThat(message.getStreams().size()).isEqualTo(2);
    final Message message2 = evaluateRule(rule);
    assertThat(message2).isNotNull();
    assertThat(message2.getStreams().size()).isEqualTo(2);
}

Example 5 with Rule

use of org.graylog.plugins.pipelineprocessor.ast.Rule in project graylog2-server by Graylog2.

the class FunctionsSnippetsTest method clonedMessageWithInvalidTimestamp.

@Test
public void clonedMessageWithInvalidTimestamp() {
    final Message message = new Message("test", "test", Tools.nowUTC());
    message.addField("timestamp", "foobar");
    final Rule rule = parser.parseRule(ruleForTest(), false);
    final EvaluationContext context = contextForRuleEval(rule, message);
    final Message origMessage = context.currentMessage();
    final Message clonedMessage = Iterables.get(context.createdMessages(), 0);
    assertThat(origMessage).isNotEqualTo(clonedMessage);
    assertThat(origMessage.getField("timestamp")).isInstanceOf(DateTime.class);
    assertThat(clonedMessage).isNotNull();
    assertThat(clonedMessage.getMessage()).isEqualTo(origMessage.getMessage());
    assertThat(clonedMessage.getSource()).isEqualTo(origMessage.getSource());
    assertThat(clonedMessage.getStreams()).isEqualTo(origMessage.getStreams());
    assertThat(clonedMessage.getTimestamp()).isNotNull();
    assertThat(clonedMessage.getTimestamp()).isEqualTo(origMessage.getTimestamp());
}