Rspec tests for logstash 2.1


I'm trying to write a rspec test for the following filter:

filter {
  if [type] == "apache-access" {
    grok {
      pattern => "%{COMBINEDAPACHELOG}"
      singles => true
    date {
      match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"]

More specifically I have trouble figuring out what to pass to the sample rspec call. And how to call the insists on the function.

This doesn't work:

sample( { @message => ' - - [29/Aug/2012:20:17:38 -0400] "GET /favicon.ico HTTP/1.1" 200 3638 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:14.0) Gecko/20100101 Firefox/14.0.1"',
            @type    => 'apache-access'}
        ) do

However I must admit I'm new to writing rspec tests and don't know how to inspect to contents of the subject variable. So I'm guessing a lot.

I've put a gist online of a rspec test I managed to get to work.

But this is the one I would like to get to work:

Thanks in advance,


Do the tests have to be rspec-based? If not and the end goal is simply to test the filters you want to use you may find easier to work with.

Hello Magnus,

Thank you for taking the time to reply to my question. This is the second post I do here, where the first one was left unanswered. So I'm happy now :wink:

My tests don't need to be rspec based. Maybe it's even better to not depend on logstash specific functions for doing the tests. I also didn't like the need I had to download the plugins.

What I want to really test is the flow through logstash using the logstash version I'm running.

To be honest I didn't like I had to download logstash sources to get the tests running. Your tool looks nice. I'm going to try it because it would solve my problem.

I hope I can get it to run after I upgrade my go version (go1.1.1 linux/amd64)

rgevaert@eames:~/go$ go get

src/ undefined: VERSION

If I don't get it to work I'll open an issue in your github project page :wink:

If I don't get it to work I'll open an issue in your github project page

For posterity, Rudy filed issue #1 which has been addressed by updating the documentation.