github.com/crowdsecurity/crowdsec@v1.6.1/pkg/parser/tests/multi-stage-grok/test.yaml (about)

     1  #these are the events we input into parser
     2  lines:
     3    - Line:
     4        Labels:
     5          #this one will be checked by a filter
     6          type: testlog
     7        Raw: xxheader VALUE1 trailing stuff
     8    - Line:
     9    #see tricky case : first one is nginx via syslog, the second one is local nginx :)
    10        Labels:
    11          #this one will be checked by a filter
    12          type: testlog
    13        Raw: xxheader VALUE2 trailing stuff
    14  #these are the results we expect from the parser
    15  results:
    16    - Meta:
    17        log_type: parsed_testlog
    18      Parsed:
    19        extracted_value: VALUE1
    20        test_bis: lolilol
    21      Process: true
    22      Stage: s01-raw
    23    #because of how our second stage parser is done, this one won't pass stage
    24    - Meta:
    25        log_type: parsed_testlog
    26      Parsed:
    27        extracted_value: VALUE2
    28      Process: false
    29      Stage: s01-raw