# Unit Testing Grok Patterns / Logstash Configs

**URL:** <https://discuss.elastic.co/t/unit-testing-grok-patterns-logstash-configs/87605>\
**Category:** Logstash\
**Created:** [May 30, 2017, 5:10pm UTC](https://discuss.elastic.co/t/unit-testing-grok-patterns-logstash-configs/87605 "2017-05-30T17:10:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hahe](https://avatars.discourse-cdn.com/v4/letter/h/fbc32d/32.png) [@hahe](https://discuss.elastic.co/u/hahe)\
**Post date:** [May 30, 2017, 5:10pm UTC](https://discuss.elastic.co/t/unit-testing-grok-patterns-logstash-configs/87605/1 "2017-05-30T17:10:55Z")

</div>

I'm wondering how others are managing evolving Grok patterns / logstash configurations.

Are there any best practices / approaches to make sure that after making changes in a logstash configuration messages that have been parsed properly before are still being parsed properly?

In a "perfect" world I imagine having some kind of junit test where I can define inputs and expected outputs for a given logstash configuration and run junit in eclipse and/or jenkins to see if something broke.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 30, 2017, 9:16pm UTC](https://discuss.elastic.co/t/unit-testing-grok-patterns-logstash-configs/87605/2 "2017-05-30T21:16:04Z")

</div>

I recommend a tool I've written, [Logstash Filter Verifier](https://github.com/magnusbaeck/logstash-filter-verifier). It lets you define inputs that it runs through (possibly a subset of) your Logstash filters and compares the result with what you have defined as the expected output.

What's currently lacking is Logstash 5 support, but I hope I'll be able to address that during the next month. Depending on the kind of filters you have it's possible that you'll be able to use Logstash 2.4 with it until Logstash 5 support is available.

---

<div class="post-metadata">

**Author:** ![hahe](https://avatars.discourse-cdn.com/v4/letter/h/fbc32d/32.png) [@hahe](https://discuss.elastic.co/u/hahe)\
**Post date:** [May 30, 2017, 9:28pm UTC](https://discuss.elastic.co/t/unit-testing-grok-patterns-logstash-configs/87605/3 "2017-05-30T21:28:30Z")

</div>

Thanks! I'll have a look into the the filter verifier.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 27, 2017, 9:37pm UTC](https://discuss.elastic.co/t/unit-testing-grok-patterns-logstash-configs/87605/4 "2017-06-27T21:37:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.