Examples with Message org.graylog2.plugin.Message used on opensource projects

Example 61 with Message

use of org.graylog2.plugin.Message in project graylog2-server by Graylog2.

the class PipelineInterpreterTest method testMatchPassContinuesIfNoRuleMatched.

@Test
public void testMatchPassContinuesIfNoRuleMatched() {
    final RuleService ruleService = mock(MongoDbRuleService.class);
    when(ruleService.loadAll()).thenReturn(ImmutableList.of(RULE_TRUE, RULE_FALSE, RULE_ADD_FOOBAR));
    final PipelineService pipelineService = mock(MongoDbPipelineService.class);
    when(pipelineService.loadAll()).thenReturn(Collections.singleton(PipelineDao.create("p1", "title", "description", "pipeline \"pipeline\"\n" + "stage 0 match pass\n" + "    rule \"false\";\n" + "stage 1 match pass\n" + "    rule \"add_foobar\";\n" + "end\n", Tools.nowUTC(), null)));
    final Map<String, Function<?>> functions = ImmutableMap.of(SetField.NAME, new SetField());
    final PipelineInterpreter interpreter = createPipelineInterpreter(ruleService, pipelineService, functions);
    final Messages processed = interpreter.process(messageInDefaultStream("message", "test"));
    final List<Message> messages = ImmutableList.copyOf(processed);
    assertThat(messages).hasSize(1);
    final Message actualMessage = messages.get(0);
    assertThat(actualMessage.getFieldAs(String.class, "foobar")).isEqualTo("covfefe");
}

Example 62 with Message

use of org.graylog2.plugin.Message in project graylog2-server by Graylog2.

the class PipelineInterpreterTest method testCreateMessage.

@Test
public void testCreateMessage() {
    final RuleService ruleService = mock(MongoDbRuleService.class);
    when(ruleService.loadAll()).thenReturn(Collections.singleton(RuleDao.create("abc", "title", "description", "rule \"creates message\"\n" + "when to_string($message.message) == \"original message\"\n" + "then\n" + "  create_message(\"derived message\");\n" + "end", Tools.nowUTC(), null)));
    final PipelineService pipelineService = mock(MongoDbPipelineService.class);
    when(pipelineService.loadAll()).thenReturn(Collections.singleton(PipelineDao.create("p1", "title", "description", "pipeline \"pipeline\"\n" + "stage 0 match all\n" + "    rule \"creates message\";\n" + "end\n", Tools.nowUTC(), null)));
    final Map<String, Function<?>> functions = ImmutableMap.of(CreateMessage.NAME, new CreateMessage(), StringConversion.NAME, new StringConversion());
    final PipelineInterpreter interpreter = createPipelineInterpreter(ruleService, pipelineService, functions);
    Message msg = messageInDefaultStream("original message", "test");
    final Messages processed = interpreter.process(msg);
    final Message[] messages = Iterables.toArray(processed, Message.class);
    assertEquals(2, messages.length);
}

Example 63 with Message

use of org.graylog2.plugin.Message in project graylog2-server by Graylog2.

the class PrecedenceTest method quotedLiteralInFieldRef.

@Test
public void quotedLiteralInFieldRef() {
    final Rule rule = parseRule("rule \"test\" when to_string($message.`true`) == \"true\" then end");
    final Message message = new Message("hallo", "test", Tools.nowUTC());
    message.addField("true", "true");
    final Message result = evaluateRule(rule, message);
    assertThat(result).isNotNull();
}

Example 64 with Message

use of org.graylog2.plugin.Message in project graylog2-server by Graylog2.

the class GeoIpResolverEngineTest method testGetIpAddressFieldsEnforceGraylogSchema.

@Test
public void testGetIpAddressFieldsEnforceGraylogSchema() {
    GeoIpResolverConfig conf = config.toBuilder().enforceGraylogSchema(true).build();
    final GeoIpResolverEngine engine = new GeoIpResolverEngine(geoIpVendorResolverService, conf, metricRegistry);
    Map<String, Object> fields = new HashMap<>();
    fields.put("_id", java.util.UUID.randomUUID().toString());
    fields.put("source_ip", "127.0.0.1");
    fields.put("src_ip", "127.0.0.1");
    fields.put("destination_ip", "127.0.0.1");
    fields.put("dest_ip", "127.0.0.1");
    fields.put("gl2_test", "127.0.0.1");
    Message message = new Message(fields);
    List<String> ipFields = engine.getIpAddressFields(message);
    // with the Graylog Schema enforced, only the source_ip and destination_ip should be returned
    Assertions.assertEquals(2, ipFields.size());
    Assertions.assertTrue(ipFields.contains("source_ip"));
    Assertions.assertTrue(ipFields.contains("destination_ip"));
}

Example 65 with Message

use of org.graylog2.plugin.Message in project graylog2-server by Graylog2.

the class GeoIpResolverEngineTest method testFilterWithReservedIpAddress.

@Test
public void testFilterWithReservedIpAddress() {
    final GeoIpResolverEngine engine = new GeoIpResolverEngine(geoIpVendorResolverService, config, metricRegistry);
    Map<String, Object> fields = new HashMap<>();
    fields.put("_id", java.util.UUID.randomUUID().toString());
    fields.put("source_ip", "127.0.0.1");
    Message message = new Message(fields);
    engine.filter(message);
    Assertions.assertTrue(message.hasField("source_reserved_ip"));
}