diff --git a/spec/outputs/elasticsearch_http.rb b/spec/outputs/elasticsearch_http.rb index 79cd70c50d2..48819ee8897 100644 --- a/spec/outputs/elasticsearch_http.rb +++ b/spec/outputs/elasticsearch_http.rb @@ -89,7 +89,7 @@ agent do ftw = FTW::Agent.new - ftw.post!("http://localhost:9200/#{index}/_flush") + ftw.post!("http://localhost:9200/#{index}/_refresh") # Wait until all events are available. Stud::try(10.times) do @@ -136,7 +136,7 @@ agent do ftw = FTW::Agent.new - ftw.post!("http://localhost:9200/#{index}/_flush") + ftw.post!("http://localhost:9200/#{index}/_refresh") # Wait until all events are available. Stud::try(10.times) do @@ -158,4 +158,83 @@ end end end + + describe "index template expected behavior" do + subject do + Elasticsearch::Client.new.indices.delete_template(:name => "*") + require "logstash/outputs/elasticsearch_http" + settings = { + "manage_template" => true, + "template_overwrite" => true, + "host" => "localhost" + } + output = LogStash::Outputs::ElasticSearchHTTP.new(settings) + output.register + next output + end + + before :each do + require "elasticsearch" + @es = Elasticsearch::Client.new + @es.indices.delete + + subject.receive(LogStash::Event.new("message" => "sample message here")) + subject.receive(LogStash::Event.new("somevalue" => 100)) + subject.receive(LogStash::Event.new("somevalue" => 10)) + subject.receive(LogStash::Event.new("somevalue" => 1)) + subject.receive(LogStash::Event.new("country" => "us")) + subject.receive(LogStash::Event.new("country" => "at")) + subject.receive(LogStash::Event.new("geoip" => { "location" => [ 0.0, 0.0 ] })) + subject.buffer_flush(:final => true) + @es.indices.refresh + + # Wait or fail until everything's indexed. + Stud::try(20.times) do + r = @es.search + insist { r["hits"]["total"] } == 7 + end + end + + it "permits phrase searching on string fields" do + results = @es.search(:q => "message:\"sample message\"") + insist { results["hits"]["total"] } == 1 + insist { results["hits"]["hits"][0]["_source"]["message"] } == "sample message here" + end + + it "numbers dynamically map to a numeric type and permit range queries" do + results = @es.search(:q => "somevalue:[5 TO 105]") + insist { results["hits"]["total"] } == 2 + + values = results["hits"]["hits"].collect { |r| r["_source"]["somevalue"] } + insist { values }.include?(10) + insist { values }.include?(100) + reject { values }.include?(1) + end + + it "creates .raw field fro any string field which is not_analyzed" do + results = @es.search(:q => "message.raw:\"sample message here\"") + insist { results["hits"]["total"] } == 1 + insist { results["hits"]["hits"][0]["_source"]["message"] } == "sample message here" + + # partial or terms should not work. + results = @es.search(:q => "message.raw:\"sample\"") + insist { results["hits"]["total"] } == 0 + end + + it "make [geoip][location] a geo_point" do + results = @es.search(:body => { "filter" => { "geo_distance" => { "distance" => "1000km", "geoip.location" => { "lat" => 0.5, "lon" => 0.5 } } } }) + insist { results["hits"]["total"] } == 1 + insist { results["hits"]["hits"][0]["_source"]["geoip"]["location"] } == [ 0.0, 0.0 ] + end + + it "should index stopwords like 'at' " do + results = @es.search(:body => { "facets" => { "t" => { "terms" => { "field" => "country" } } } })["facets"]["t"] + terms = results["terms"].collect { |t| t["term"] } + + insist { terms }.include?("us") + + # 'at' is a stopword, make sure stopwords are not ignored. + insist { terms }.include?("at") + end + end end