{"action":"closed","issue":{"url":"https://api.github.com/repos/elastic/logstash/issues/3448","labels_url":"https://api.github.com/repos/elastic/logstash/issues/3448/labels{/name}","comments_url":"https://api.github.com/repos/elastic/logstash/issues/3448/comments","events_url":"https://api.github.com/repos/elastic/logstash/issues/3448/events","html_url":"https://github.com/elastic/logstash/issues/3448","id":88743879,"number":3448,"title":"Logstash 1.5.0 - Can not reliably create tests for my grok patterns.","user":{"login":"simonjohansson","id":736248,"avatar_url":"https://avatars.githubusercontent.com/u/736248?v=3","gravatar_id":"","url":"https://api.github.com/users/simonjohansson","html_url":"https://github.com/simonjohansson","followers_url":"https://api.github.com/users/simonjohansson/followers","following_url":"https://api.github.com/users/simonjohansson/following{/other_user}","gists_url":"https://api.github.com/users/simonjohansson/gists{/gist_id}","starred_url":"https://api.github.com/users/simonjohansson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simonjohansson/subscriptions","organizations_url":"https://api.github.com/users/simonjohansson/orgs","repos_url":"https://api.github.com/users/simonjohansson/repos","events_url":"https://api.github.com/users/simonjohansson/events{/privacy}","received_events_url":"https://api.github.com/users/simonjohansson/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/logstash/labels/bug","name":"bug","color":"e11d21"},{"url":"https://api.github.com/repos/elastic/logstash/labels/tests-infra","name":"tests-infra","color":"bfd4f2"},{"url":"https://api.github.com/repos/elastic/logstash/labels/v1.5.3","name":"v1.5.3","color":"ededed"}],"state":"closed","locked":false,"assignee":{"login":"untergeek","id":1020383,"avatar_url":"https://avatars.githubusercontent.com/u/1020383?v=3","gravatar_id":"","url":"https://api.github.com/users/untergeek","html_url":"https://github.com/untergeek","followers_url":"https://api.github.com/users/untergeek/followers","following_url":"https://api.github.com/users/untergeek/following{/other_user}","gists_url":"https://api.github.com/users/untergeek/gists{/gist_id}","starred_url":"https://api.github.com/users/untergeek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/untergeek/subscriptions","organizations_url":"https://api.github.com/users/untergeek/orgs","repos_url":"https://api.github.com/users/untergeek/repos","events_url":"https://api.github.com/users/untergeek/events{/privacy}","received_events_url":"https://api.github.com/users/untergeek/received_events","type":"User","site_admin":false},"milestone":null,"comments":8,"created_at":"2015-06-16T14:29:52Z","updated_at":"2015-07-13T13:05:50Z","closed_at":"2015-07-13T13:05:50Z","body":"Howdie. We want to roll out 1.5, currently we are on 1.4.\r\n\r\nWe have a bunch of tests to make sure our patterns are correct but half of them are not passing with 1.5, for the sake of easy debug I have supplied a working and a failing test here(if you want my real tests and configs, please let me know). Curiously I noticed that grok matching does not work, unless the source field comes from a previous operation.\r\n\r\nTo reproduce\r\n\r\nHow I setup logstash\r\n```\r\n➜  ~  cd ~/src\r\n➜  src  git clone https://github.com/elastic/logstash.git\r\n➜  src cd logstash\r\n➜  logstash git:(master) git checkout -b v1.5.0 v1.5.0 # I have also tried HEAD.\r\nSwitched to a new branch 'v1.5.0'\r\n➜  logstash git:(v1.5.0) rake test:install-core\r\n...... Lots of output...\r\n```\r\n\r\nMy tests specs.\r\n```\r\n➜  logstash git:(v1.5.0) cat /tmp/logstash/working.rb \r\nrequire \"spec_helper\"\r\nrequire \"logstash/filters/grok\"\r\n\r\ndescribe \"A working test\" do\r\n  config <<-CONFIG\r\n    filter {\r\n      json {\r\n         source => 'message'\r\n      }\r\n      grok {\r\n        match => {\r\n          'foo' => '%{WORD:grokMatched}'\r\n        }\r\n      }\r\n    }\r\n    CONFIG\r\n\r\n  sample '{\"foo\": \"matchThisStringAsgrokMatched\"}' do\r\n    insist { subject['foo'] } == \"matchThisStringAsgrokMatched\"\r\n    insist { subject['grokMatched'] } == \"matchThisStringAsgrokMatched\"\r\n  end\r\nend\r\n\r\n➜  logstash git:(v1.5.0) cat /tmp/logstash/failing.rb \r\nrequire \"spec_helper\"\r\nrequire \"logstash/filters/grok\"\r\n\r\ndescribe \"A non working test\" do\r\n  config <<-CONFIG\r\n    filter {\r\n      grok {\r\n        match => {\r\n          'message' => '%{WORD:grokMatched}'\r\n        }\r\n      }\r\n    }\r\n    CONFIG\r\n\r\n  sample 'matchThisStringAsgrokMatched' do\r\n    insist { subject['grokMatched'] } == \"matchThisStringAsgrokMatched\"\r\n  end\r\nend\r\n```\r\n\r\nTest output\r\n```\r\n➜  logstash git:(v1.5.0) ./bin/rspec /tmp/logstash/working.rb\r\nUsing Accessor#strict_set for specs\r\nRun options: exclude {:redis=>true, :socket=>true, :performance=>true, :couchdb=>true, :elasticsearch=>true, :elasticsearch_secure=>true, :export_cypher=>true, :integration=>true, :windows=>true}\r\n.\r\n\r\nFinished in 0.258 seconds\r\n1 example, 0 failures\r\n\r\nRandomized with seed 44926\r\n\r\n➜  logstash git:(v1.5.0) ./bin/rspec /tmp/logstash/failing.rb \r\nUsing Accessor#strict_set for specs\r\nRun options: exclude {:redis=>true, :socket=>true, :performance=>true, :couchdb=>true, :elasticsearch=>true, :elasticsearch_secure=>true, :export_cypher=>true, :integration=>true, :windows=>true}\r\nF\r\n\r\nFailures:\r\n\r\n  1) A non working test \"matchThisStringAsgrokMatched\" when processed\r\n     Failure/Error: Unable to find matching line from backtrace\r\n     Insist::Failure:\r\n       Expected \"matchThisStringAsgrokMatched\", but got nil\r\n     # /tmp/logstash/failing.rb:16:in `(root)'\r\n     # ./lib/bootstrap/rspec.rb:10:in `(root)'\r\n\r\nFinished in 0.066 seconds\r\n1 example, 1 failure\r\n\r\nFailed examples:\r\n\r\nrspec ./vendor/bundle/jruby/1.9/gems/logstash-devutils-0.0.13-java/lib/logstash/devutils/rspec/logstash_helpers.rb:52 # A non working test \"matchThisStringAsgrokMatched\" when processed\r\n\r\nRandomized with seed 4585\r\n```"}}