I'm afraid I can't help with your RSpec woes, but for testing Logstash filter configurations I think you'll find https://github.com/magnusbaeck/logstash-filter-verifier easier to use than writing RSpec tests (full disclosure: I am the author of said tool). It's basically an automation wrapper around the Logstash command that you ran to verify your filter.