<NME> parse-haproxy-logs.rb
<BEF> ADDFILE
<MSG> Merge pull request #469 from wesmaldonado/spec_for_parse_haproxy_log_example

Added spec for HAPROXYHTTP pattern.
<DFF> @@ -0,0 +1,115 @@
+require "test_utils"
+
+describe "haproxy httplog format" do
+  extend LogStash::RSpec
+
+  # The logstash config goes here.
+  # At this time, only filters are supported.
+  config <<-CONFIG
+  filter {
+    grok {
+      pattern => "%{HAPROXYHTTP}"
+    }
+  }
+  CONFIG
+  # Here we provide a sample log event for the testing suite.
+  #
+  # Any filters you define above will be applied the same way the logstash
+  # agent performs. Inside the 'sample ... ' block the 'subject' will be
+  # a LogStash::Event object for you to inspect and verify for correctness.
+  # HAPROXYHTTP %{SYSLOGTIMESTAMP:syslog_timestamp} %{IPORHOST:syslog_server} %{SYSLOGPROG}: %{IP:client_ip}:%{INT:client_port} \[%{HAPROXYDATE:accept_date}\] %{NOTSPACE:frontend_name} %{NOTSPACE:backend_name}/%{NOTSPACE:server_name} %{INT:time_request}/%{INT:time_queue}/%{INT:time_backend_connect}/%{INT:time_backend_response}/%{NOTSPACE:time_duration} %{INT:http_status_code} %{NOTSPACE:bytes_read} %{DATA:captured_request_cookie} %{DATA:captured_response_cookie} %{NOTSPACE:termination_state} %{INT:actconn}/%{INT:feconn}/%{INT:beconn}/%{INT:srvconn}/%{NOTSPACE:retries} %{INT:srv_queue}/%{INT:backend_queue} (\{%{HAPROXYCAPTUREDREQUESTHEADERS}\})?( )?(\{%{HAPROXYCAPTUREDRESPONSEHEADERS}\})?( )?"(<BADREQ>|(%{WORD:http_verb} (%{URIPROTO:http_proto}://)?(?:%{USER:http_user}(?::[^@]*)?@)?(?:%{URIHOST:http_host})?(?:%{URIPATHPARAM:http_request})?( HTTP/%{NUMBER:http_version})?))?"
+
+  sample 'Feb  6 12:14:14 localhost haproxy[14389]: 10.0.1.2:33317 [06/Feb/2009:12:14:14.655] http-in static/srv1 10/0/30/69/109 200 2750 - - ---- 1/1/1/1/0 0/0 {1wt.eu} {} "GET /index.html HTTP/1.1"' do
+
+    # These 'insist' and 'reject' calls use my 'insist' rubygem.
+    # See http://rubydoc.info/gems/insist for more info.
+
+    # Require that grok does not fail to parse this event.
+    reject { subject["@tags"] }.include?("_grokparsefailure")
+
+
+    # Ensure that grok captures certain expected fields.
+    insist { subject }.include?("syslog_timestamp")
+    insist { subject }.include?("syslog_server")
+    insist { subject }.include?("program")
+    insist { subject }.include?("pid")
+    insist { subject }.include?("client_ip")
+    insist { subject }.include?("client_port")
+    insist { subject }.include?("accept_date")
+    insist { subject }.include?("haproxy_monthday")
+    insist { subject }.include?("haproxy_month")
+    insist { subject }.include?("haproxy_year")
+    insist { subject }.include?("haproxy_time")
+    insist { subject }.include?("haproxy_hour")
+    insist { subject }.include?("haproxy_minute")
+    insist { subject }.include?("haproxy_second")
+    insist { subject }.include?("haproxy_milliseconds")
+    insist { subject }.include?("frontend_name")
+    insist { subject }.include?("backend_name")
+    insist { subject }.include?("server_name")
+    insist { subject }.include?("time_request")
+    insist { subject }.include?("time_queue")
+    insist { subject }.include?("time_backend_connect")
+    insist { subject }.include?("time_backend_response")
+    insist { subject }.include?("time_duration")
+    insist { subject }.include?("http_status_code")
+    insist { subject }.include?("bytes_read")
+    insist { subject }.include?("captured_request_cookie")
+    insist { subject }.include?("captured_response_cookie")
+    insist { subject }.include?("termination_state")
+    insist { subject }.include?("actconn")
+    insist { subject }.include?("feconn")
+    insist { subject }.include?("beconn")
+    insist { subject }.include?("srvconn")
+    insist { subject }.include?("retries")
+    insist { subject }.include?("srv_queue")
+    insist { subject }.include?("backend_queue")
+    insist { subject }.include?("captured_request_headers")
+    insist { subject }.include?("http_verb")
+    insist { subject }.include?("http_request")
+    insist { subject }.include?("http_version")
+
+#    # Ensure that those fields match expected values from the event.
+
+    insist{ subject["syslog_timestamp"] } == ["Feb  6 12:14:14"]
+    insist{ subject["syslog_server"] } == ["localhost"]
+    insist{ subject["program"] } == ["haproxy"]
+    insist{ subject["pid"] } == ["14389"]
+    insist{ subject["client_ip"] } == ["10.0.1.2"]
+    insist{ subject["client_port"] } == ["33317"]
+    insist{ subject["accept_date"] } == ["06/Feb/2009:12:14:14.655"]
+    insist{ subject["haproxy_monthday"] } == ["06"]
+    insist{ subject["haproxy_month"] } == ["Feb"]
+    insist{ subject["haproxy_year"] } == ["2009"]
+    insist{ subject["haproxy_time"] } == ["12:14:14"]
+    insist{ subject["haproxy_hour"] } == ["12"]
+    insist{ subject["haproxy_minute"] } == ["14"]
+    insist{ subject["haproxy_second"] } == ["14"]
+    insist{ subject["haproxy_milliseconds"] } == ["655"]
+    insist{ subject["frontend_name"] } == ["http-in"]
+    insist{ subject["backend_name"] } == ["static"]
+    insist{ subject["server_name"] } == ["srv1"]
+    insist{ subject["time_request"] } == ["10"]
+    insist{ subject["time_queue"] } == ["0"]
+    insist{ subject["time_backend_connect"] } == ["30"]
+    insist{ subject["time_backend_response"] } == ["69"]
+    insist{ subject["time_duration"] } == ["109"]
+    insist{ subject["http_status_code"] } == ["200"]
+    insist{ subject["bytes_read"] } == ["2750"]
+    insist{ subject["captured_request_cookie"] } == ["-"]
+    insist{ subject["captured_response_cookie"] } == ["-"]
+    insist{ subject["termination_state"] } == ["----"]
+    insist{ subject["actconn"] } == ["1"]
+    insist{ subject["feconn"] } == ["1"]
+    insist{ subject["beconn"] } == ["1"]
+    insist{ subject["srvconn"] } == ["1"]
+    insist{ subject["retries"] } == ["0"]
+    insist{ subject["srv_queue"] } == ["0"]
+    insist{ subject["backend_queue"] } == ["0"]
+    insist{ subject["captured_request_headers"] } == ["1wt.eu"]
+    insist{ subject["http_verb"] } == ["GET"]
+    insist{ subject["http_request"] } == ["/index.html"]
+    insist{ subject["http_version"] } == ["1.1"]
+  end
+
+end

Merge pull request #469 from wesmaldonado/spec_for_parse_haproxy_log_example