scouty 0.1.2

Log parsing, filtering, and analysis library
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101

#[cfg(test)]
mod tests {
    use crate::parser::factory::ParserFactory;
    use crate::record::LogLevel;
    use crate::traits::{LoaderInfo, LoaderType};

    fn text_loader_info(sample_lines: Vec<String>) -> LoaderInfo {
        LoaderInfo {
            id: "test-loader".to_string(),
            loader_type: LoaderType::TextFile,
            multiline_enabled: false,
            sample_lines,
        }
    }

    #[test]
    fn test_auto_group_parses_iso_level_msg() {
        let info = text_loader_info(vec!["2024-01-15 10:30:00 INFO Starting service".to_string()]);
        let group = ParserFactory::create_parser_group(&info);

        let record = group
            .parse(
                "2024-01-15 10:30:00 ERROR Something failed",
                "test",
                "loader",
                0,
            )
            .unwrap();
        assert_eq!(record.level, Some(LogLevel::Error));
        assert_eq!(record.message, "Something failed");
    }

    #[test]
    fn test_auto_group_parses_bracket_level() {
        let info = text_loader_info(vec![]);
        let group = ParserFactory::create_parser_group(&info);

        let record = group
            .parse(
                "2024-01-15T10:30:00 [WARN] disk space low",
                "test",
                "loader",
                1,
            )
            .unwrap();
        assert_eq!(record.level, Some(LogLevel::Warn));
        assert_eq!(record.message, "disk space low");
    }

    #[test]
    fn test_fallback_catches_unstructured() {
        let info = text_loader_info(vec![]);
        let group = ParserFactory::create_parser_group(&info);

        let record = group
            .parse("just a random line", "test", "loader", 2)
            .unwrap();
        assert_eq!(record.message, "just a random line");
        assert_eq!(record.level, None);
    }

    #[test]
    fn test_syslog_detection() {
        let info = text_loader_info(vec![
            "Jan 15 10:30:00 myhost sshd[1234]: Accepted publickey".to_string(),
        ]);
        let group = ParserFactory::create_parser_group(&info);

        let record = group
            .parse(
                "Jan 15 10:30:00 myhost sshd[1234]: Accepted publickey",
                "test",
                "loader",
                3,
            )
            .unwrap();
        assert_eq!(record.process_name.as_deref(), Some("sshd"));
        assert_eq!(record.pid, Some(1234));
        // hostname should be in metadata
        assert_eq!(
            record
                .metadata
                .as_ref()
                .and_then(|m| m.get("hostname"))
                .map(|s| s.as_str()),
            Some("myhost")
        );
    }

    #[test]
    fn test_syslog_loader_type() {
        let info = LoaderInfo {
            id: "syslog-loader".to_string(),
            loader_type: LoaderType::Syslog,
            multiline_enabled: false,
            sample_lines: vec![],
        };
        let group = ParserFactory::create_parser_group(&info);
        assert!(group.parsers.len() >= 2);
    }
}