/test/logstash/filters/test_dns.rb

https://github.com/bleach/logstash · Ruby · 138 lines · 102 code · 34 blank · 2 comment · 1 complexity · 220969060d4d7c369e9199334f363496 MD5 · raw file

  1. require "rubygems"
  2. require File.join(File.dirname(__FILE__), "..", "minitest")
  3. require "logstash"
  4. require "logstash/loadlibs"
  5. require "logstash/filters"
  6. require "logstash/filters/dns"
  7. require "logstash/event"
  8. require "timeout"
  9. describe LogStash::Filters::DNS do
  10. before do
  11. @typename = "foozle"
  12. end
  13. def config(cfg)
  14. cfg["type"] = @typename
  15. cfg.each_key do |key|
  16. if cfg[key].is_a?(String)
  17. cfg[key] = [cfg[key]]
  18. end
  19. end
  20. @filter = LogStash::Filters::DNS.new(cfg)
  21. @filter.register
  22. end
  23. ## REVERSE tests
  24. test "dns reverse lookup, replace (on event.source)" do
  25. config "reverse" => "@source",
  26. "action" => "replace"
  27. event = LogStash::Event.new
  28. event.type = @typename
  29. event.source = "199.192.228.250"
  30. @filter.filter(event)
  31. assert_equal("carrera.databits.net", event.source)
  32. end # dns reverse lookup, replace (on event.source)
  33. test "dns reverse lookup, replace" do
  34. config "reverse" => "foo",
  35. "action" => "replace"
  36. event = LogStash::Event.new
  37. event.type = @typename
  38. event["foo"] = ["199.192.228.250"]
  39. @filter.filter(event)
  40. assert_equal(["carrera.databits.net"], event["foo"])
  41. end # dns reverse lookup, replace
  42. test "dns reverse lookup, append" do
  43. config "reverse" => "foo",
  44. "action" => "append"
  45. event = LogStash::Event.new
  46. event.type = @typename
  47. event["foo"] = ["199.192.228.250"]
  48. @filter.filter(event)
  49. assert_equal(["199.192.228.250", "carrera.databits.net"], event["foo"])
  50. end # dns reverse lookup, replace
  51. test "dns reverse lookup, not an IP" do
  52. config "reverse" => "foo"
  53. event = LogStash::Event.new
  54. event.type = @typename
  55. event["foo"] = ["not.an.ip"]
  56. @filter.filter(event)
  57. assert_equal(["not.an.ip"], event["foo"])
  58. end # dns reverse lookup, not an IP
  59. ## RESOLVE tests
  60. test "dns resolve lookup, replace (on event.source)" do
  61. config "resolve" => "@source",
  62. "action" => "replace"
  63. event = LogStash::Event.new
  64. event.type = @typename
  65. event.source = "carrera.databits.net"
  66. @filter.filter(event)
  67. assert_equal("199.192.228.250", event.source)
  68. end # dns reverse lookup, replace (on event.source)
  69. test "dns resolve lookup, replace" do
  70. config "resolve" => "foo",
  71. "action" => "replace"
  72. event = LogStash::Event.new
  73. event.type = @typename
  74. event["foo"] = ["carrera.databits.net"]
  75. @filter.filter(event)
  76. assert_equal(["199.192.228.250"], event["foo"])
  77. end # dns resolve lookup, replace
  78. test "dns resolve lookup, skip multi-value" do
  79. config "resolve" => "foo",
  80. "action" => "replace"
  81. event = LogStash::Event.new
  82. event.type = @typename
  83. event["foo"] = ["carrera.databits.net", "foo.databits.net"]
  84. @filter.filter(event)
  85. assert_equal(["carrera.databits.net", "foo.databits.net"], event["foo"])
  86. end # dns resolve lookup, replace
  87. test "dns resolve lookup, append" do
  88. config "resolve" => "foo",
  89. "action" => "append"
  90. event = LogStash::Event.new
  91. event.type = @typename
  92. event["foo"] = ["carrera.databits.net"]
  93. @filter.filter(event)
  94. assert_equal(["carrera.databits.net", "199.192.228.250"], event["foo"])
  95. end # dns resolve lookup, replace
  96. test "dns resolve lookup, not a valid hostname" do
  97. config "resolve" => "foo"
  98. event = LogStash::Event.new
  99. event.type = @typename
  100. event["foo"] = ["does.not.exist"]
  101. @filter.filter(event)
  102. assert_equal(["does.not.exist"], event["foo"])
  103. end # dns resolve lookup, not a valid hostname
  104. end # describe LogStash::Filters::DNS