Examples with BooleanExpression org.graylog.plugins.pipelineprocessor.ast.expressions.BooleanExpression used on opensource projects

Example 1 with BooleanExpression

use of org.graylog.plugins.pipelineprocessor.ast.expressions.BooleanExpression in project graylog2-server by Graylog2.

the class CEFParserFunctionTest method evaluate_returns_result_for_valid_CEF_string.

@Test
public void evaluate_returns_result_for_valid_CEF_string() throws Exception {
    final Map<String, Expression> arguments = ImmutableMap.of(CEFParserFunction.VALUE, new StringExpression(new CommonToken(0), "CEF:0|vendor|product|1.0|id|name|low|dvc=example.com msg=Foobar"), CEFParserFunction.USE_FULL_NAMES, new BooleanExpression(new CommonToken(0), false));
    final FunctionArgs functionArgs = new FunctionArgs(function, arguments);
    final Message message = new Message("__dummy", "__dummy", DateTime.parse("2010-07-30T16:03:25Z"));
    final EvaluationContext evaluationContext = new EvaluationContext(message);
    final CEFParserResult result = function.evaluate(functionArgs, evaluationContext);
    assertNotNull(result);
    assertEquals(0, result.get("cef_version"));
    assertEquals("vendor", result.get("device_vendor"));
    assertEquals("product", result.get("device_product"));
    assertEquals("1.0", result.get("device_version"));
    assertEquals("id", result.get("device_event_class_id"));
    assertEquals("low", result.get("severity"));
    assertEquals("example.com", result.get("dvc"));
    assertEquals("Foobar", result.get("msg"));
}

Example 2 with BooleanExpression

use of org.graylog.plugins.pipelineprocessor.ast.expressions.BooleanExpression in project graylog2-server by Graylog2.

the class PrecedenceTest method parenGroup.

@Test
public void parenGroup() {
    final Rule rule = parseRule("rule \"test\" when true == (false == false) then end");
    final LogicalExpression when = rule.when();
    assertThat(when).isInstanceOf(EqualityExpression.class);
    EqualityExpression topEqual = (EqualityExpression) when;
    assertThat(topEqual.left()).isInstanceOf(BooleanExpression.class);
    assertThat(topEqual.right()).isInstanceOf(EqualityExpression.class);
    final BooleanExpression trueExpr = (BooleanExpression) topEqual.left();
    assertThat(trueExpr.evaluateBool(null)).isTrue();
    final EqualityExpression falseFalse = (EqualityExpression) topEqual.right();
    assertThat(falseFalse.evaluateBool(null)).isTrue();
}

Example 3 with BooleanExpression

use of org.graylog.plugins.pipelineprocessor.ast.expressions.BooleanExpression in project graylog2-server by Graylog2.

the class CEFParserFunctionTest method evaluate_returns_null_for_invalid_CEF_string.

@Test
public void evaluate_returns_null_for_invalid_CEF_string() throws Exception {
    final Map<String, Expression> arguments = ImmutableMap.of(CEFParserFunction.VALUE, new StringExpression(new CommonToken(0), "CEF:0|Foobar"), CEFParserFunction.USE_FULL_NAMES, new BooleanExpression(new CommonToken(0), false));
    final FunctionArgs functionArgs = new FunctionArgs(function, arguments);
    final Message message = new Message("__dummy", "__dummy", DateTime.parse("2010-07-30T16:03:25Z"));
    final EvaluationContext evaluationContext = new EvaluationContext(message);
    final CEFParserResult result = function.evaluate(functionArgs, evaluationContext);
    assertNull(result);
}

Example 4 with BooleanExpression

use of org.graylog.plugins.pipelineprocessor.ast.expressions.BooleanExpression in project graylog2-server by Graylog2.

the class CEFParserFunctionTest method evaluate_returns_result_without_message_field.

@Test
public void evaluate_returns_result_without_message_field() throws Exception {
    final Map<String, Expression> arguments = ImmutableMap.of(CEFParserFunction.VALUE, new StringExpression(new CommonToken(0), "CEF:0|vendor|product|1.0|id|name|low|dvc=example.com"), CEFParserFunction.USE_FULL_NAMES, new BooleanExpression(new CommonToken(0), false));
    final FunctionArgs functionArgs = new FunctionArgs(function, arguments);
    final Message message = new Message("__dummy", "__dummy", DateTime.parse("2010-07-30T16:03:25Z"));
    final EvaluationContext evaluationContext = new EvaluationContext(message);
    final CEFParserResult result = function.evaluate(functionArgs, evaluationContext);
    assertNotNull(result);
    assertEquals(0, result.get("cef_version"));
    assertEquals("vendor", result.get("device_vendor"));
    assertEquals("product", result.get("device_product"));
    assertEquals("1.0", result.get("device_version"));
    assertEquals("id", result.get("device_event_class_id"));
    assertEquals("low", result.get("severity"));
    assertEquals("example.com", result.get("dvc"));
    assertFalse(result.containsKey("message"));
}

Example 5 with BooleanExpression

use of org.graylog.plugins.pipelineprocessor.ast.expressions.BooleanExpression in project graylog2-server by Graylog2.

the class CEFParserFunctionTest method evaluate_returns_result_for_valid_CEF_string_with_full_names.

@Test
public void evaluate_returns_result_for_valid_CEF_string_with_full_names() throws Exception {
    final CEFParserFunction function = new CEFParserFunction(new MetricRegistry());
    final Map<String, Expression> arguments = ImmutableMap.of(CEFParserFunction.VALUE, new StringExpression(new CommonToken(0), "CEF:0|vendor|product|1.0|id|name|low|dvc=example.com msg=Foobar"), CEFParserFunction.USE_FULL_NAMES, new BooleanExpression(new CommonToken(0), true));
    final FunctionArgs functionArgs = new FunctionArgs(function, arguments);
    final Message message = new Message("__dummy", "__dummy", DateTime.parse("2010-07-30T16:03:25Z"));
    final EvaluationContext evaluationContext = new EvaluationContext(message);
    final CEFParserResult result = function.evaluate(functionArgs, evaluationContext);
    assertNotNull(result);
    assertEquals(0, result.get("cef_version"));
    assertEquals("vendor", result.get("device_vendor"));
    assertEquals("product", result.get("device_product"));
    assertEquals("1.0", result.get("device_version"));
    assertEquals("id", result.get("device_event_class_id"));
    assertEquals("low", result.get("severity"));
    assertEquals("example.com", result.get("deviceAddress"));
    assertEquals("Foobar", result.get("message"));
}