Github user nickwallen commented on a diff in the pull request: https://github.com/apache/metron/pull/1245#discussion_r237584581 --- Diff: metron-platform/metron-parsers/src/test/java/org/apache/metron/parsers/regex/RegularExpressionsParserTest.java --- @@ -0,0 +1,152 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one or more contributor license + * agreements. See the NOTICE file distributed with this work for additional information regarding + * copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance with the License. You may obtain a + * copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software distributed under the License + * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express + * or implied. See the License for the specific language governing permissions and limitations under + * the License. + */ +package org.apache.metron.parsers.regex; + +import org.json.simple.JSONObject; +import org.json.simple.parser.JSONParser; +import org.junit.Before; +import org.junit.Test; + +import java.nio.file.Files; +import java.nio.file.Paths; +import java.util.HashMap; +import java.util.List; +import java.util.Map; + +import static org.junit.Assert.assertTrue; + +public class RegularExpressionsParserTest { + + private RegularExpressionsParser regularExpressionsParser; + private JSONObject parserConfig; + + @Before + public void setUp() throws Exception { + regularExpressionsParser = new RegularExpressionsParser(); + } + + @Test + public void testSSHDParse() throws Exception { + String message = + "<38>Jun 20 15:01:17 deviceName sshd[11672]: Accepted publickey for prod from 22.22.22.22 port 55555 ssh2"; + + parserConfig = getJsonConfig( + Paths.get("src/test/resources/config/RegularExpressionsParserConfig.json").toString()); + regularExpressionsParser.configure(parserConfig); + JSONObject parsed = parse(message); + // Expected + Map<String, Object> expectedJson = new HashMap<>(); + expectedJson.put("device_name", "deviceName"); + expectedJson.put("dst_process_name", "sshd"); + expectedJson.put("dst_process_id", "11672"); + expectedJson.put("dst_user_id", "prod"); + expectedJson.put("ip_src_addr", "22.22.22.22"); + expectedJson.put("ip_src_port", "55555"); + expectedJson.put("app_protocol", "ssh2"); --- End diff -- Can you also ensure that "timestamp" and "original_string" are correctly added to each message?
---