From d601e21afbdab4bbd10795bbd306cd79d6ae4007 Mon Sep 17 00:00:00 2001 From: Thibault bui Koechlin Date: Sat, 23 May 2020 13:22:43 +0200 Subject: [PATCH] working tests for json --- pkg/exprhelpers/jsonextract.go | 9 +++++++-- pkg/parser/tests/base-json-extract/base-grok.yaml | 5 ++++- pkg/parser/tests/base-json-extract/base-grok2.yaml | 2 ++ pkg/parser/tests/base-json-extract/test.yaml | 5 ++++- 4 files changed, 17 insertions(+), 4 deletions(-) diff --git a/pkg/exprhelpers/jsonextract.go b/pkg/exprhelpers/jsonextract.go index bda6dc736..682d5ad4e 100644 --- a/pkg/exprhelpers/jsonextract.go +++ b/pkg/exprhelpers/jsonextract.go @@ -13,9 +13,8 @@ func JsonExtractLib(jsblob string, target ...string) string { jsonparser.StringToBytes(jsblob), target..., ) - if err != nil { - log.Errorf("jsonExtractLib : %s", err) + log.Errorf("jsonExtractLib : %+v : %s", target, err) return "" } if dataType == jsonparser.NotExist { @@ -23,10 +22,16 @@ func JsonExtractLib(jsblob string, target ...string) string { return "" } strvalue := string(value) + //debug stuff return strvalue } func JsonExtract(jsblob string, target string) string { + if !strings.HasPrefix(target, "[") { + target = strings.Replace(target, "[", ".[", -1) + } fullpath := strings.Split(target, ".") + + log.Printf("path -> %+v", fullpath) return JsonExtractLib(jsblob, fullpath...) } diff --git a/pkg/parser/tests/base-json-extract/base-grok.yaml b/pkg/parser/tests/base-json-extract/base-grok.yaml index a9bd5f129..53d274c24 100644 --- a/pkg/parser/tests/base-json-extract/base-grok.yaml +++ b/pkg/parser/tests/base-json-extract/base-grok.yaml @@ -9,6 +9,9 @@ statics: expression: JsonExtract(evt.Line.Raw, "testfield") - meta: program expression: evt.Line.Labels.progrname - + - parsed: extracted_array + expression: JsonExtract(evt.Line.Raw, "nested_1.anarray") + - parsed: extracted_array_field + expression: JsonExtract(evt.Line.Raw, "nested_1.anarray[0]") diff --git a/pkg/parser/tests/base-json-extract/base-grok2.yaml b/pkg/parser/tests/base-json-extract/base-grok2.yaml index 3c2868788..5ff38c377 100644 --- a/pkg/parser/tests/base-json-extract/base-grok2.yaml +++ b/pkg/parser/tests/base-json-extract/base-grok2.yaml @@ -11,4 +11,6 @@ nodes: statics: - meta: log_type value: parsed_testlog + - parsed: extracted_arrayfield_from_object + expression: JsonExtract(evt.Parsed.extracted_array, '[1]') diff --git a/pkg/parser/tests/base-json-extract/test.yaml b/pkg/parser/tests/base-json-extract/test.yaml index 22e1c3aa3..b1e0e5a6e 100644 --- a/pkg/parser/tests/base-json-extract/test.yaml +++ b/pkg/parser/tests/base-json-extract/test.yaml @@ -4,7 +4,7 @@ lines: Labels: type: json-1 progrname: my_test_prog - Raw: '{"testfield": "some stuff", "log": "xxheader VALUE1 trailing stuff"}' + Raw: '{"testfield": "some stuff", "log": "xxheader VALUE1 trailing stuff", "nested_1" : {"anarray" : ["foo","bar","xx1"], "xxx" : "zzzz"}}' results: - Meta: other_field: some stuff @@ -12,5 +12,8 @@ results: Parsed: message: xxheader VALUE1 trailing stuff extracted_value: VALUE1 + extracted_array_field: foo + extracted_array: '["foo","bar","xx1"]' + extracted_arrayfield_from_object: bar Process: true