From e15ded54059a7a71eed8b08ddbad77516ba1ab8f Mon Sep 17 00:00:00 2001 From: Eric Fontana Date: Fri, 12 Sep 2014 12:25:57 -0400 Subject: [PATCH] Cleanup doc --- TimberWinR.UnitTests/JsonFilterTests.cs | 7 +------ TimberWinR/mdocs/JsonFilter.md | 12 ++++++------ 2 files changed, 7 insertions(+), 12 deletions(-) diff --git a/TimberWinR.UnitTests/JsonFilterTests.cs b/TimberWinR.UnitTests/JsonFilterTests.cs index ec7bbd6..2521182 100644 --- a/TimberWinR.UnitTests/JsonFilterTests.cs +++ b/TimberWinR.UnitTests/JsonFilterTests.cs @@ -68,8 +68,6 @@ namespace TimberWinR.UnitTests // 4 fields, Email, Active, CreatedDate, Roles Assert.AreEqual(4, stuff.Count); - - // Now, merge it into the root (starts as 3 fields, ends up with 7 fields) Assert.AreEqual(3, jsonInputLine2.Count); c = Configuration.FromString(jsonFilterNoTarget); @@ -77,10 +75,7 @@ namespace TimberWinR.UnitTests Assert.IsTrue(jf.Apply(jsonInputLine2)); JObject nostuff = jsonInputLine2["stuff"] as JObject; Assert.IsNull(nostuff); - Assert.AreEqual(7, jsonInputLine2.Count); - - var o1 = jsonInputLine1.ToString(); - var o2 = jsonInputLine2.ToString(); + Assert.AreEqual(7, jsonInputLine2.Count); } } } diff --git a/TimberWinR/mdocs/JsonFilter.md b/TimberWinR/mdocs/JsonFilter.md index 97c5de9..13ce92a 100644 --- a/TimberWinR/mdocs/JsonFilter.md +++ b/TimberWinR/mdocs/JsonFilter.md @@ -7,8 +7,8 @@ The following operations are allowed when mutating a field. | Operation | Type | Description | :---------------|:----------------|:-----------------------------------------------------------------------| -| *type* | property:string |Type to which this filter applyes, if empty, applies to all types. -| *condition* | property:string |C# expression +| *type* | property:string |Type to which this filter applies, if empty, applies to all types. +| *condition* | property:string |C# expression, if the expression is true, continue, otherwise, ignore | *source* | property:string |Required field indicates which field contains the Json to be parsed | *target* | property:string |If suppled, the parsed json will be contained underneath a propery named *target* | *add_field* | property:array |If the filter is successful, add an arbitrary field to this event. Field names can be dynamic and include parts of the event using the %{field} syntax. This property must be specified in pairs. @@ -74,7 +74,7 @@ The fields must be in pairs with fieldName first and value second. ```json "Filters": [ { - "grok": { + "json": { "add_field": [ "ComputerName", "Host", "Username", "%{SID}" @@ -89,7 +89,7 @@ Remove the fields. More than one field can be specified at a time. ```json "Filters": [ { - "grok": { + "json": { "remove_tag": [ "static_tag1", "Computer_%{Host}" @@ -105,7 +105,7 @@ Adds the tag(s) to the tag array. ```json "Filters": [ { - "grok": { + "json": { "add_tag": [ "foo_%{Host}", "static_tag1" @@ -120,7 +120,7 @@ Remove the tag(s) to the tag array. More than one tag can be specified at a tim ```json "Filters": [ { - "grok": { + "json": { "remove_tag": [ "static_tag1", "Username"