62 lines
1.9 KiB
Go
62 lines
1.9 KiB
Go
package ingest
|
|
|
|
import (
|
|
"encoding/json"
|
|
"testing"
|
|
|
|
"git.apinb.com/ops/logs/internal/models"
|
|
)
|
|
|
|
func TestSyslogRuleMatchDetailsExtractsResourceUID(t *testing.T) {
|
|
rule := models.SyslogRule{
|
|
Name: "H3C link down",
|
|
Enabled: true,
|
|
SourceMatch: "h3c-core",
|
|
MessageRegex: `Interface (?P<iface>GigabitEthernet[0-9/]+) is down`,
|
|
ResourceUIDExtractRegex: `Interface (?P<resource_uid>GigabitEthernet[0-9/]+) is down`,
|
|
}
|
|
|
|
match := syslogRuleMatchDetails(&rule, "h3c-core-01", "Interface GigabitEthernet1/0/1 is down", "")
|
|
if !match.Matched {
|
|
t.Fatal("expected rule to match")
|
|
}
|
|
if match.ResourceUID != "network:GigabitEthernet1/0/1" {
|
|
t.Fatalf("unexpected resource uid: %q", match.ResourceUID)
|
|
}
|
|
}
|
|
|
|
func TestBuildReplayRawEventPayloadMarksReplayed(t *testing.T) {
|
|
ev := models.LogEvent{
|
|
ID: 12,
|
|
SourceKind: "syslog",
|
|
SourceIP: "10.1.2.3",
|
|
RemoteAddr: "10.1.2.3:514",
|
|
DeviceName: "h3c-core-01",
|
|
RawPayload: "<189>Jun 24 10:00:01 h3c-core-01 IFNET/4/LINK_DOWN: Interface GigabitEthernet1/0/1 is down",
|
|
NormalizedSummary: "h3c-core-01: Interface GigabitEthernet1/0/1 is down",
|
|
SeverityCode: "warning",
|
|
DispatchStatus: "pending",
|
|
}
|
|
|
|
body, err := BuildReplayRawEventPayload(ev)
|
|
if err != nil {
|
|
t.Fatalf("BuildReplayRawEventPayload returned error: %v", err)
|
|
}
|
|
if body.SourceType != "syslog" {
|
|
t.Fatalf("unexpected source type: %q", body.SourceType)
|
|
}
|
|
if body.ParseStatus != "replayed" {
|
|
t.Fatalf("unexpected parse status: %q", body.ParseStatus)
|
|
}
|
|
if body.Labels["replay_of_log_event_id"] != "12" {
|
|
t.Fatalf("missing replay label: %#v", body.Labels)
|
|
}
|
|
var raw map[string]any
|
|
if err := json.Unmarshal(body.RawPayload, &raw); err != nil {
|
|
t.Fatalf("raw payload should be json: %v", err)
|
|
}
|
|
if raw["raw_packet"] == "" {
|
|
t.Fatalf("raw packet missing: %#v", raw)
|
|
}
|
|
}
|