search

magnusbaeck / logstash-filter-verifier

Apache License 2.0
192 stars 27 forks source link

Some clarifications #65

Closed lispercat closed 5 years ago

lispercat commented 5 years ago

Just trying to understand the usage model of the application

You mention that the command to the verifier would be like: path/to/logstash-filter-verifier path/to/syslog.json path/to/filters

Can you clarify what exactly is path/to/filters? Do I need to have logstash installed for it (so it's a path to logstash filters)?

Also let's say I have a pipeline conf file with some grok, mutate, date etc. Can you give an example how can I test this pipeline or I miss the point entirely :) ?

magnusbaeck commented 5 years ago

Can you clarify what exactly is path/to/filters?

It's the location of your Logstash pipeline configuration files.

Also let's say I have a pipeline conf file with some grok, mutate, date etc. Can you give an example how can I test this pipeline or I miss the point entirely :) ?

You write a testcase configuration file (see the Examples section of the readme file) that describes the expected output given particular input and pass that file to LFV together with your Logstash configuration files. LFV will run Logstash with your configuration, pass the input in the testcase configuration file, and verify that Logstash returns the expected result you've listed in the testcase configuration file.

lispercat commented 5 years ago

Thanks @magnusbaeck, it works! Only it takes like 1min for a simple test with one line grok, not sure if it's expected.

magnusbaeck commented 5 years ago

Only it takes like 1min for a simple test with one line grok, not sure if it's expected.

Well, Logstash has a pretty long startup time. I don't think LFV is at fault here. If you have multiple testcase files I suggest you start with the --sockets flag to reduce the number of times Logstash needs to start.