tests for syslog_pri and other cleanup

CHANGELOG

@@ -3,7 +3,7 @@
   * New input plugins: generator, heroku, pipe, ganglia
   * New output plugins: juggernaut, metricscatcher, nagios_ncsa, pipe,
                         opentsdb
-  * New filter plugins: zeromq, environment, xml, csv
+  * New filter plugins: zeromq, environment, xml, csv, syslog_pri
   * Fixes for gelf output
 
  ## IMPORTANT CHANGES FOR UPGRADES FROM 1.1.0

CONTRIBUTORS

@@ -45,6 +45,7 @@ Contributors:
 * bodik
 * Philippe Weber
 * Marc Huffnagle (mhuffnagle)
+* Oliver Gorwits (ollyg)
 
 
 Note: If you've sent me patches, bug reports, or other stuff for logstash, and

lib/logstash/filters/syslog_pri.rb

@@ -2,7 +2,8 @@
 require "logstash/namespace"
 
 # Filter plugin for logstash to parse the PRI field from the front
-# of a Syslog (RFC3164) message.
+# of a Syslog (RFC3164) message.  If no priority is set, it will
+# default to 13 (per RFC).
 #
 # This filter is based on the original syslog.rb code shipped
 # with logstash.
@@ -74,9 +75,16 @@ def filter(event)
   def parse_pri(event)
     # Per RFC3164, priority = (facility * 8) + severity
     # = (facility << 3) & (severity)
-    priority = event.fields[@syslog_pri_field_name].first.to_i rescue 13
+    if event.fields[@syslog_pri_field_name]
+      if event.fields[@syslog_pri_field_name].is_a?(Array)
+        priority = event.fields[@syslog_pri_field_name].first.to_i
+      else
+        priority = event.fields[@syslog_pri_field_name].to_i
+      end
+    else
+      priority = 13  # default
+    end
     severity = priority & 7 # 7 is 111 (3 bits)
-    $stderr.puts "priority=#{priority} severity=#{severity}"
     facility = priority >> 3
     event.fields["syslog_severity_code"] = severity
     event.fields["syslog_facility_code"] = facility

test/logstash/filters/test_syslog_pri.rb

@@ -0,0 +1,117 @@
+require "rubygems"
+require File.join(File.dirname(__FILE__), "..", "minitest")
+
+require "logstash/loadlibs"
+require "logstash"
+require "logstash/filters"
+require "logstash/filters/syslog_pri"
+require "logstash/event"
+
+describe LogStash::Filters::Syslog_pri do
+  before do
+    @filter = LogStash::Filters.from_name("syslog_pri", {})
+    @typename = "syslog_pri"
+  end
+
+  def config(cfg)
+    cfg["type"] = @typename
+    cfg.each_key do |key|
+      if cfg[key].is_a?(String)
+        cfg[key] = [cfg[key]]
+      end
+    end
+
+    @filter = LogStash::Filters::Syslog_pri.new(cfg)
+    @filter.register
+  end # def config
+
+  test "severity" do
+    event = LogStash::Event.new
+    event.type = @typename
+    event["syslog_pri"] = 75
+    @filter.filter(event)
+    assert_equal(3, event["syslog_severity_code"])
+  end
+
+  test "severity field name" do
+    event = LogStash::Event.new
+    event.type = @typename
+    event["syslog_pri"] = 75
+    @filter.filter(event)
+    assert_equal("error", event["syslog_severity"])
+  end
+
+  test "facility" do
+    event = LogStash::Event.new
+    event.type = @typename
+    event["syslog_pri"] = 75
+    @filter.filter(event)
+    assert_equal(9, event["syslog_facility_code"])
+  end
+
+  test "facility field name" do
+    event = LogStash::Event.new
+    event.type = @typename
+    event["syslog_pri"] = 75
+    @filter.filter(event)
+    assert_equal("clock", event["syslog_facility"])
+  end
+
+  test "no field names added with use_labels=false" do
+    config "use_labels" => "false"
+
+    event = LogStash::Event.new
+    event.type = @typename
+    event["syslog_pri"] = 75
+    @filter.filter(event)
+    assert_equal(nil, event["syslog_facility"])
+    assert_equal(nil, event["syslog_severity"])
+  end
+
+  test "default priority of 13" do
+    event = LogStash::Event.new
+    event.type = @typename
+    @filter.filter(event)
+    assert_equal(1, event["syslog_facility_code"])
+    assert_equal(5, event["syslog_severity_code"])
+  end
+
+  test "priority as array" do
+    event = LogStash::Event.new
+    event.type = @typename
+    event["syslog_pri"] = [75]
+    @filter.filter(event)
+    assert_equal(9, event["syslog_facility_code"])
+    assert_equal(3, event["syslog_severity_code"])
+  end
+
+  test "set priority field name" do
+    config "syslog_pri_field_name" => "syslog_pri2"
+
+    event = LogStash::Event.new
+    event.type = @typename
+    event["syslog_pri"] = 15
+    event["syslog_pri2"] = 75
+    @filter.filter(event)
+    assert_equal(9, event["syslog_facility_code"])
+    assert_equal(3, event["syslog_severity_code"])
+  end
+
+  test "custom facility labels" do
+    config "facility_labels" => ["a", "b", "c", "d", "e", "f"]
+
+    event = LogStash::Event.new
+    event.type = @typename
+    @filter.filter(event)
+    assert_equal("b", event["syslog_facility"])
+  end
+
+  test "custom severity labels" do
+    config "severity_labels" => ["a", "b", "c", "d", "e", "f"]
+
+    event = LogStash::Event.new
+    event.type = @typename
+    @filter.filter(event)
+    assert_equal("f", event["syslog_severity"])
+  end
+end # Test 'syslog_pri' filter