Fixed broken unit test
This commit is contained in:
@@ -78,10 +78,11 @@
|
||||
},
|
||||
{
|
||||
"date": {
|
||||
"condition": "[type] == \"Win32-IISLog\"",
|
||||
"match": [
|
||||
"timestamp",
|
||||
"MMM d HH:mm:sss",
|
||||
"MMM dd HH:mm:ss"
|
||||
"MMM dd HH:mm:ss"
|
||||
],
|
||||
"target": "UtcTimestamp",
|
||||
"convertToUTC": true
|
||||
@@ -89,8 +90,9 @@
|
||||
},
|
||||
{
|
||||
"mutate": {
|
||||
"_comment": "Orion Rules",
|
||||
"_comment": "Orion Rules",
|
||||
"rename": [
|
||||
"ComputerName", "Host",
|
||||
"host", "Host",
|
||||
"message","Message",
|
||||
"type","Type",
|
||||
|
||||
@@ -105,6 +105,7 @@ namespace TimberWinR.UnitTests
|
||||
""Filters"":[
|
||||
{
|
||||
""date"":{
|
||||
""target"": ""timestamp"",
|
||||
""match"":[
|
||||
""timestamp"",
|
||||
""MMM d HH:mm:sss"",
|
||||
|
||||
@@ -16,6 +16,9 @@ namespace TimberWinR.Parser
|
||||
{
|
||||
public override bool Apply(JObject json)
|
||||
{
|
||||
if (Condition != null && !EvaluateCondition(json, Condition))
|
||||
return false;
|
||||
|
||||
if (Matches(json))
|
||||
{
|
||||
ApplyFilter(json);
|
||||
@@ -57,6 +60,12 @@ namespace TimberWinR.Parser
|
||||
{
|
||||
DateTime ts;
|
||||
var exprArray = Match.Skip(1).ToArray();
|
||||
var resolver = new RegexGrokResolver();
|
||||
for (int i=0; i<exprArray.Length; i++)
|
||||
{
|
||||
var pattern = resolver.ResolveToRegex(exprArray[i]);
|
||||
exprArray[i] = pattern;
|
||||
}
|
||||
if (DateTime.TryParseExact(text, exprArray, CultureInfo.InvariantCulture,DateTimeStyles.None, out ts))
|
||||
AddOrModify(json, ts);
|
||||
}
|
||||
|
||||
@@ -471,6 +471,9 @@ namespace TimberWinR.Parser
|
||||
}
|
||||
}
|
||||
|
||||
[JsonProperty("condition")]
|
||||
public string Condition { get; set; }
|
||||
|
||||
[JsonProperty("match")]
|
||||
public string[] Match { get; set; }
|
||||
|
||||
|
||||
Reference in New Issue
Block a user