Fixed broken unit test

This commit is contained in:
Eric Fontana
2014-07-28 14:10:46 -04:00
parent 5bd3f53663
commit 640e18e8c4
4 changed files with 17 additions and 2 deletions

View File

@@ -78,10 +78,11 @@
},
{
"date": {
"condition": "[type] == \"Win32-IISLog\"",
"match": [
"timestamp",
"MMM d HH:mm:sss",
"MMM dd HH:mm:ss"
"MMM dd HH:mm:ss"
],
"target": "UtcTimestamp",
"convertToUTC": true
@@ -89,8 +90,9 @@
},
{
"mutate": {
"_comment": "Orion Rules",
"_comment": "Orion Rules",
"rename": [
"ComputerName", "Host",
"host", "Host",
"message","Message",
"type","Type",

View File

@@ -105,6 +105,7 @@ namespace TimberWinR.UnitTests
""Filters"":[
{
""date"":{
""target"": ""timestamp"",
""match"":[
""timestamp"",
""MMM d HH:mm:sss"",

View File

@@ -16,6 +16,9 @@ namespace TimberWinR.Parser
{
public override bool Apply(JObject json)
{
if (Condition != null && !EvaluateCondition(json, Condition))
return false;
if (Matches(json))
{
ApplyFilter(json);
@@ -57,6 +60,12 @@ namespace TimberWinR.Parser
{
DateTime ts;
var exprArray = Match.Skip(1).ToArray();
var resolver = new RegexGrokResolver();
for (int i=0; i<exprArray.Length; i++)
{
var pattern = resolver.ResolveToRegex(exprArray[i]);
exprArray[i] = pattern;
}
if (DateTime.TryParseExact(text, exprArray, CultureInfo.InvariantCulture,DateTimeStyles.None, out ts))
AddOrModify(json, ts);
}

View File

@@ -471,6 +471,9 @@ namespace TimberWinR.Parser
}
}
[JsonProperty("condition")]
public string Condition { get; set; }
[JsonProperty("match")]
public string[] Match { get; set; }