parsefields/parse_test.go at master · MonaxGT/parsefields · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
package parsefield

import (
	"sync"
	"testing"
)

func TestParse(t *testing.T) {
	var fields sync.Map
	var events sync.Map
	c := &Config{
		Fields: &fields,
		Events: &events,
	}
	body := []byte(`{"event_id":1,"event_log_name":"sysmon"}`)
	err := c.parse(body)
	if err != nil {
		t.Error(err)
	}
	body = []byte(`"event_id":1,"event_log_name":"sysmon"`)
	err = c.parse(body)
	if err == nil {
		t.Error(err)
	}

}

func TestParseMulti (t *testing.T) {
	var fields sync.Map
	var events sync.Map
	c := &Config{
		Fields: &fields,
		Events: &events,
	}
	body := []byte(`[{"event_id":1,"event_log_name":"sysmon"},{"event_id":2,"event_log_name":"security"}]`)
	err := c.parseMulti(body)
	if err != nil {
		t.Error(err)
	}
	body = []byte(`^"event_id":1,"event_log_name":"sysmon"`)
	err = c.parse(body)
	if err == nil {
		t.Error(err)
	}
}