diff --git a/TimberWinR.UnitTests/GrokFilterTests.cs b/TimberWinR.UnitTests/GrokFilterTests.cs index 436b34c..69d572a 100644 --- a/TimberWinR.UnitTests/GrokFilterTests.cs +++ b/TimberWinR.UnitTests/GrokFilterTests.cs @@ -106,6 +106,108 @@ namespace TimberWinR.UnitTests Assert.IsNull(json["LogFilename"]); } + [Test] + public void TestDropConditions() + { + JObject json1 = new JObject + { + {"LogFilename", @"C:\\Logs1\\test1.log"}, + {"EventType", 1}, + {"Index", 7}, + {"Text", null}, + { + "tags", new JArray + { + "tag1", + "tag2" + } + }, + {"type", "Win32-FileLog"}, + {"ComputerName", "dev.vistaprint.net"} + }; + + JObject json2 = new JObject + { + {"LogFilename", @"C:\\Logs1\\test1.log"}, + {"EventType", 2}, + {"Index", 7}, + {"Text", null}, + { + "tags", new JArray + { + "tag1", + "tag2" + } + }, + {"type", "Win32-FileLog"}, + {"ComputerName", "dev.vistaprint.net"} + }; + + + string grokJsonDropIf1 = @"{ + ""TimberWinR"":{ + ""Filters"":[ + { + ""grok"":{ + ""condition"": ""[EventType] == 1"", + ""drop"": ""true"", + ""match"":[ + ""Text"", + """" + ], + ""remove_tag"":[ + ""tag1"" + ] + } + }] + } + }"; + + string grokJsonDropIfNot1 = @"{ + ""TimberWinR"":{ + ""Filters"":[ + { + ""grok"":{ + ""condition"": ""[EventType] != 1"", + ""drop"": ""true"", + ""match"":[ + ""Text"", + """" + ], + ""remove_tag"":[ +// ""tag1"" + ] + } + }] + } + }"; + + + // Positive Tests + Configuration c = Configuration.FromString(grokJsonDropIf1); + Grok grok = c.Filters.First() as Grok; + Assert.IsFalse(grok.Apply(json1)); + + c = Configuration.FromString(grokJsonDropIf1); + grok = c.Filters.First() as Grok; + Assert.IsTrue(grok.Apply(json2)); + + // Negative Tests + c = Configuration.FromString(grokJsonDropIfNot1); + grok = c.Filters.First() as Grok; + Assert.IsFalse(grok.Apply(json2)); + + c = Configuration.FromString(grokJsonDropIfNot1); + grok = c.Filters.First() as Grok; + Assert.IsTrue(grok.Apply(json1)); + + + + + } + + + [Test] public void TestConditions() { @@ -191,7 +293,7 @@ namespace TimberWinR.UnitTests // Negative Test c = Configuration.FromString(grokJson3); grok = c.Filters.First() as Grok; - Assert.IsFalse(grok.Apply(json)); + Assert.IsTrue(grok.Apply(json)); } [Test] diff --git a/TimberWinR/Filters/GrokFilter.cs b/TimberWinR/Filters/GrokFilter.cs index dbfe3c5..7748c9f 100644 --- a/TimberWinR/Filters/GrokFilter.cs +++ b/TimberWinR/Filters/GrokFilter.cs @@ -32,6 +32,8 @@ namespace TimberWinR.Parser public partial class Grok : LogstashFilter { + // Returns: true - Filter does not apply or has been applied successfully + // Returns: false - Drop this object public override bool Apply(JObject json) { if (!string.IsNullOrEmpty(Type)) @@ -52,7 +54,7 @@ namespace TimberWinR.Parser return false; // drop this one } else - return false; + return true; } if (DropIfMatch) @@ -61,10 +63,10 @@ namespace TimberWinR.Parser AddFields(json); AddTags(json); RemoveFields(json); - RemoveTags(json); - return true; + RemoveTags(json); } - return false; + + return true; } private bool Matches(Newtonsoft.Json.Linq.JObject json)