Testing logstash filters

There are many posts on techniques for testing your logstash config, but I found most of them to lack in the exact details of getting it working and others are just obsolete, so here are my dumbed down notes:

download, unpack and cd into the logstash version you are using or planning to use
install development tools: ./bin/logstash-plugin install --development
check if the bin directory contains an rspec file. If not create it and make it executable using this source
now cd into the project holding your logstash configs. I'll assume your logstash config lives in a conf.d directory: create a spec directory at the same level or run ${LOGSTASH_HOME}/bin/rspec --init for rspec to create its directory structure. You should now have conf.d and spec at the same level
in spec drop a test specification, like the one below
test your specs with the following command:

${LOGSTASH_HOME}/bin/rspec

Enjoy :-)

Edited on Jan 29th 2017 as I missed the plugin step. Apparently I had an older version lying around which filled the missing gems. Got bitten reproducing on new laptop.

File: example_spec.rb --------------------- # encoding: utf-8 require "logstash/devutils/rspec/spec_helper" files = Dir['conf.d/*.conf'] @@configuration = String.new files.sort.each do |file| @@configuration << File.read(file) end describe "simple test" do config(@@configuration) sample( "message" => "my message", "type" => "log", "time" => "2016-12-26T10:58:05.0Z", "source" => "stdout" ) do insist { subject.get("type") } == "log" insist { subject.get("source") } == "stdout" insist { subject.get("message") } == "my message" insist { subject.include?("log") } == false insist { subject.timestamp.to_i } == Time.iso8601("2016-12-26T10:58:05.0Z").to_i end end

Search This Blog

unicolet.org

Testing logstash filters