Examples with Message org.graylog2.plugin.Message used on opensource projects

Example 46 with Message

use of org.graylog2.plugin.Message in project graylog2-server by Graylog2.

the class FunctionsSnippetsTest method accountingSize.

@Test
public void accountingSize() {
    final Rule rule = parser.parseRule(ruleForTest(), true);
    final Message message = evaluateRule(rule);
    // this can change if either the test message content changes or traffic accounting calculation is changed!
    assertThat(message.getField("accounting_size")).isEqualTo(54L);
}

Example 47 with Message

use of org.graylog2.plugin.Message in project graylog2-server by Graylog2.

the class BaseParserTest method evaluateRule.

@Nullable
protected Message evaluateRule(Rule rule, Consumer<Message> messageModifier) {
    final Message message = new Message("hello test", "source", DateTime.now(DateTimeZone.UTC));
    message.addStream(defaultStream);
    messageModifier.accept(message);
    return evaluateRule(rule, message);
}

Example 48 with Message

use of org.graylog2.plugin.Message in project graylog2-server by Graylog2.

the class FunctionsSnippetsTest method grok.

@Test
public void grok() {
    final Rule rule = parser.parseRule(ruleForTest(), false);
    final Message message = evaluateRule(rule);
    assertThat(message).isNotNull();
    assertThat(message.getFieldCount()).isEqualTo(6);
    assertThat(message.getTimestamp()).isEqualTo(DateTime.parse("2015-07-31T10:05:36.773Z"));
    // named captures only
    assertThat(message.hasField("num")).isTrue();
    assertThat(message.hasField("BASE10NUM")).isFalse();
    // Test for issue 5563 and 5794
    // ensure named groups with underscore work
    assertThat(message.hasField("test_field")).isTrue();
}

Example 49 with Message

use of org.graylog2.plugin.Message in project graylog2-server by Graylog2.

the class FunctionsSnippetsTest method firstNonNull.

@Test
public void firstNonNull() {
    final Rule rule = parser.parseRule(ruleForTest(), true);
    final Message message = evaluateRule(rule);
    assertThat(message.getField("not_found")).isNull();
    assertThat(message.getField("first_found")).isEqualTo("first");
    assertThat(message.getField("middle_found")).isEqualTo("middle");
    assertThat(message.getField("last_found")).isEqualTo("last");
    assertThat(message.getField("list_found")).isInstanceOf(List.class);
    assertThat(message.getField("int_found")).isInstanceOf(Long.class);
}

Example 50 with Message

use of org.graylog2.plugin.Message in project graylog2-server by Graylog2.

the class FunctionsSnippetsTest method json.

@Test
public void json() {
    final String flatJson = "{\"str\":\"foobar\",\"int\":42,\"float\":2.5,\"bool\":true,\"array\":[1,2,3]}";
    final String nestedJson = "{\n" + "    \"store\": {\n" + "        \"book\": {\n" + "            \"category\": \"reference\",\n" + "            \"author\": \"Nigel Rees\",\n" + "            \"title\": \"Sayings of the Century\",\n" + "            \"price\": 8.95\n" + "        },\n" + "        \"bicycle\": {\n" + "            \"color\": \"red\",\n" + "            \"price\": 19.95\n" + "        }\n" + "    },\n" + "    \"expensive\": 10\n" + "}";
    final Rule rule = parser.parseRule(ruleForTest(), false);
    final Message message = new Message("JSON", "test", Tools.nowUTC());
    message.addField("flat_json", flatJson);
    message.addField("nested_json", nestedJson);
    final Message evaluatedMessage = evaluateRule(rule, message);
    assertThat(evaluatedMessage.getField("message")).isEqualTo("JSON");
    assertThat(evaluatedMessage.getField("flat_json")).isEqualTo(flatJson);
    assertThat(evaluatedMessage.getField("nested_json")).isEqualTo(nestedJson);
    assertThat(evaluatedMessage.getField("str")).isEqualTo("foobar");
    assertThat(evaluatedMessage.getField("int")).isEqualTo(42);
    assertThat(evaluatedMessage.getField("float")).isEqualTo(2.5);
    assertThat(evaluatedMessage.getField("bool")).isEqualTo(true);
    assertThat(evaluatedMessage.getField("array")).isEqualTo(Arrays.asList(1, 2, 3));
    assertThat(evaluatedMessage.getField("store")).isInstanceOf(Map.class);
    assertThat(evaluatedMessage.getField("expensive")).isEqualTo(10);
}