Examples with EvaluationContext org.graylog.plugins.pipelineprocessor.EvaluationContext used on opensource projects

Example 11 with EvaluationContext

use of org.graylog.plugins.pipelineprocessor.EvaluationContext in project graylog2-server by Graylog2.

the class CEFParserFunctionTest method evaluate_returns_null_for_empty_CEF_string.

@Test
public void evaluate_returns_null_for_empty_CEF_string() throws Exception {
    final Map<String, Expression> arguments = Collections.singletonMap(CEFParserFunction.VALUE, new StringExpression(new CommonToken(0), ""));
    final FunctionArgs functionArgs = new FunctionArgs(function, arguments);
    final Message message = new Message("__dummy", "__dummy", DateTime.parse("2010-07-30T16:03:25Z"));
    final EvaluationContext evaluationContext = new EvaluationContext(message);
    final CEFParserResult result = function.evaluate(functionArgs, evaluationContext);
    assertNull(result);
}

Example 12 with EvaluationContext

use of org.graylog.plugins.pipelineprocessor.EvaluationContext in project graylog2-server by Graylog2.

the class CEFParserFunctionTest method evaluate_returns_null_for_missing_CEF_string.

@Test
public void evaluate_returns_null_for_missing_CEF_string() throws Exception {
    final FunctionArgs functionArgs = new FunctionArgs(function, Collections.emptyMap());
    final Message message = new Message("__dummy", "__dummy", DateTime.parse("2010-07-30T16:03:25Z"));
    final EvaluationContext evaluationContext = new EvaluationContext(message);
    final CEFParserResult result = function.evaluate(functionArgs, evaluationContext);
    assertNull(result);
}

Example 13 with EvaluationContext

use of org.graylog.plugins.pipelineprocessor.EvaluationContext in project graylog2-server by Graylog2.

the class FunctionsSnippetsTest method keyValue.

@Test
public void keyValue() {
    final Rule rule = parser.parseRule(ruleForTest(), true);
    final EvaluationContext context = contextForRuleEval(rule, new Message("", "", Tools.nowUTC()));
    assertThat(context).isNotNull();
    assertThat(context.evaluationErrors()).isEmpty();
    final Message message = context.currentMessage();
    assertThat(message).isNotNull();
    assertThat(message.getField("a")).isEqualTo("1,4");
    assertThat(message.getField("b")).isEqualTo("2");
    assertThat(message.getField("c")).isEqualTo("3");
    assertThat(message.getField("d")).isEqualTo("44");
    assertThat(message.getField("e")).isEqualTo("4");
    assertThat(message.getField("f")).isEqualTo("1");
    assertThat(message.getField("g")).isEqualTo("3");
    assertThat(message.getField("h")).isEqualTo("3=:3");
    assertThat(message.hasField("i")).isFalse();
    assertThat(message.getField("dup_first")).isEqualTo("1");
    assertThat(message.getField("dup_last")).isEqualTo("2");
    assertThat(message.getField("spacequote1")).isEqualTo("\"a space quote\"");
    assertThat(message.getField("spacequote2")).isEqualTo("a space quote");
    assertThat(message.getField("spacequote3")).isEqualTo("'a space quote'");
    assertThat(message.getField("spacequote4")).isEqualTo("a space quote");
    assertThat(message.getField("spacequote5")).isEqualTo("a space 'quote'");
    assertThat(message.getField("spacequote6")).isEqualTo("a space \"quote\"");
    assertThat(message.getField("spacequote7")).isEqualTo("it's a space 'quote'");
    assertThat(message.getField("sq1")).isEqualTo("a");
    assertThat(message.getField("sq2")).isEqualTo("b");
    assertThat(message.getField("sq3")).isEqualTo("c");
    assertThat(message.getField("sq4")).isEqualTo("' d '");
    assertThat(message.getField("sq5")).isEqualTo("\" e\"");
    assertThat(message.getField("sq6")).isEqualTo("it\"s a space");
    assertThat(message.getField("sq7")).isEqualTo("a, b");
    assertThat(message.getField("sq8")).isEqualTo("c|d");
    assertThat(message.getField("sq9")).isEqualTo("e| \"f, g\" | h");
    assertThat(message.getField("sq10")).isEqualTo("' i,j '");
    assertThat(message.getField("sq11")).isEqualTo("\" k|\"");
    assertThat(message.getField("sq12")).isEqualTo("l\"m n, o");
    assertThat(message.getField("dup-spacequote")).isEqualTo("it's a space 'quote'|another");
    assertThat(message.getField("sq@1")).isEqualTo("space quote");
    assertThat(message.getField("sq@2")).isEqualTo("hello");
}

Example 14 with EvaluationContext

use of org.graylog.plugins.pipelineprocessor.EvaluationContext in project graylog2-server by Graylog2.

the class FunctionsSnippetsTest method clonedMessage.

@Test
public void clonedMessage() {
    final Message message = new Message("test", "test", Tools.nowUTC());
    message.addField("foo", "bar");
    message.addStream(mock(Stream.class));
    final Rule rule = parser.parseRule(ruleForTest(), false);
    final EvaluationContext context = contextForRuleEval(rule, message);
    final Message origMessage = context.currentMessage();
    final Message clonedMessage = Iterables.get(context.createdMessages(), 0);
    final Message otherMessage = Iterables.get(context.createdMessages(), 1);
    assertThat(origMessage).isNotSameAs(clonedMessage);
    assertThat(clonedMessage).isNotNull();
    assertThat(clonedMessage.getMessage()).isEqualTo(origMessage.getMessage());
    assertThat(clonedMessage.getSource()).isEqualTo(origMessage.getSource());
    assertThat(clonedMessage.getTimestamp()).isEqualTo(origMessage.getTimestamp());
    assertThat(clonedMessage.getStreams()).isEqualTo(origMessage.getStreams());
    assertThat(clonedMessage.hasField("removed_again")).isFalse();
    assertThat(clonedMessage.getFieldAs(Boolean.class, "has_source")).isTrue();
    assertThat(clonedMessage.getFieldAs(String.class, "only_in")).isEqualTo("new message");
    assertThat(clonedMessage.getFieldAs(String.class, "multi")).isEqualTo("new message");
    assertThat(clonedMessage.getFieldAs(String.class, "foo")).isEqualTo("bar");
    assertThat(otherMessage).isNotNull();
    assertThat(otherMessage.getMessage()).isEqualTo("foo");
    assertThat(otherMessage.getSource()).isEqualTo("source");
}

Example 15 with EvaluationContext

use of org.graylog.plugins.pipelineprocessor.EvaluationContext in project graylog2-server by Graylog2.

the class FunctionsSnippetsTest method evalErrorSuppressed.

@Test
public void evalErrorSuppressed() {
    final Rule rule = parser.parseRule(ruleForTest(), false);
    final Message message = new Message("test", "test", Tools.nowUTC());
    message.addField("this_field_was_set", true);
    final EvaluationContext context = contextForRuleEval(rule, message);
    assertThat(context).isNotNull();
    assertThat(context.hasEvaluationErrors()).isFalse();
    assertThat(actionsTriggered.get()).isTrue();
}