Running integration tests for a specific integration

Elastic Stack Beats
,
1

Hi All,

I'm trying to update some mappings for an Elastic Agent integration, specifically Suricata. I see some test input files and expected output files, but I haven't found a test that actually uses them.

I've tried the tests outline in the testing guide (Testing | Beats Developer Guide [master] | Elastic), but it doesn't appear execute the Suricata integration tests, am I missing something?

I'm hoping to update the mappings and test without deploying the full stack and doing trial and error.

Thanks!

2

Hi Jason,
Thank you for the question. For the Suricata, if you want to update the ingest pipeline and parsing logic, your best bet is to use elastic-package to run the system and pipeline tests. There is documentation online on how to run these tests.

Quickly, you'd bring up the stack locally
elastic-package stack up -d
navigate on the command line to ./packages/suricata (within the elastic/integrations repo) and then run either the system
elastic-package test system -v
or the pipeline tests
elastic-package test pipeline -v

3

Thanks, I'm now able to make a simple test fail. So integrations from this repo land in beats/agent?

4

The integration pipeline is multi-element, there's beats that does enrichment, there's also an ingest pipeline that gets installed and is a destination for when agent sends data to elasticsearch. The code within elastic/integrations is released out of band from the stack release and consists of configuration that can be done to agent/beats, configuration of the ingest pipeline and visual assets.

So to answer your question, no. elastic/integrations works in conjunction of the beats/agent repo