7f0cac8ee6
* add support for 'expression' (fix #822) in grok patterns * add tests
28 lines
702 B
YAML
28 lines
702 B
YAML
#these are the events we input into parser
|
|
lines:
|
|
- Line:
|
|
Labels:
|
|
#this one will be checked by a filter
|
|
type: testlog
|
|
Raw: xxheader VALUE1 trailing stuff
|
|
- Line:
|
|
#see tricky case : first one is nginx via syslog, the second one is local nginx :)
|
|
Labels:
|
|
#this one will be checked by a filter
|
|
type: testlog
|
|
Raw: xxheader VALUE2 trailing stuff
|
|
#these are the results we expect from the parser
|
|
results:
|
|
- Meta:
|
|
log_type: parsed_testlog
|
|
Parsed:
|
|
extracted_value: VALUE1
|
|
Process: true
|
|
Stage: s00-raw
|
|
- Meta:
|
|
log_type: parsed_testlog
|
|
Parsed:
|
|
extracted_value: VALUE2
|
|
Process: true
|
|
Stage: s00-raw
|
|
|