crowdsec/pkg/parser/tests/base-grok-expression/test.yaml
Thibault "bui" Koechlin 7f0cac8ee6
add support for 'expression' (fix #822) in grok patterns (#830)
* add support for 'expression' (fix #822) in grok patterns

* add tests
2021-06-21 09:07:33 +02:00

29 lines
702 B
YAML

#these are the events we input into parser
lines:
- Line:
Labels:
#this one will be checked by a filter
type: testlog
Raw: xxheader VALUE1 trailing stuff
- Line:
#see tricky case : first one is nginx via syslog, the second one is local nginx :)
Labels:
#this one will be checked by a filter
type: testlog
Raw: xxheader VALUE2 trailing stuff
#these are the results we expect from the parser
results:
- Meta:
log_type: parsed_testlog
Parsed:
extracted_value: VALUE1
Process: true
Stage: s00-raw
- Meta:
log_type: parsed_testlog
Parsed:
extracted_value: VALUE2
Process: true
Stage: s00-raw