11# Run tests with `./test-vector.sh`
22#
33# A downside of these test cases is that they compare the whole event and that the message can
4- # contain source code positions in vector.yaml, e.g. "function call error for \"parse_timestamp\" at (584:643 )". Please adapt the tests if you change VRL code in vector.yaml.
4+ # contain source code positions in vector.yaml, e.g. "function call error for \"parse_timestamp\" at (990:1070 )". Please adapt the tests if you change VRL code in vector.yaml.
55---
66tests :
77 - name : Test opensearch_server log entry without stacktrace
@@ -11,10 +11,10 @@ tests:
1111 log_fields :
1212 file : /stackable/log/opensearch/opensearch_server.json
1313 message : |
14- {"type": "server", "timestamp": "2025-10-01T12:47:28,582Z ", "level": "INFO", "component": "o.o.n.Node", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "started", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg" }
14+ {"type": "server", "timestamp": "2025-10-01T12:47:28,582+0000 ", "level": "INFO", "component": "o.o.n.Node", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "started", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg" }
1515 pod : opensearch-nodes-cluster-manager-0
1616 source_type : file
17- timestamp : 2025-10-01T12:47:29.473487331Z
17+ timestamp : 2025-10-01T12:47:29.473487331+0000
1818 outputs :
1919 - extract_from : extended_logs
2020 conditions :
3131 "pod": "opensearch-nodes-cluster-manager-0",
3232 "role": "nodes",
3333 "roleGroup": "cluster-manager",
34- "timestamp": t'2025-10-01T10 :47:28.582Z '
34+ "timestamp": t'2025-10-01T12 :47:28.582+0000 '
3535 }
3636
3737 assert_eq!(expected_log_event, .)
4242 log_fields :
4343 file : /stackable/log/opensearch/opensearch_server.json
4444 message : |
45- {"type": "server", "timestamp": "2025-10-01T12:47:28,363Z ", "level": "INFO", "component": "o.o.c.c.JoinHelper", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "failed to join {opensearch-nodes-cluster-manager-0}{sk-r0P_TTYuPqaamTFbjKg}{fIRSMbQYSe2nKQZ_sPn4kg}{10.244.0.20}{10.244.0.20:9300}{m}{shard_indexing_pressure_enabled=true} with JoinRequest{sourceNode={opensearch-nodes-cluster-manager-0}{sk-r0P_TTYuPqaamTFbjKg}{fIRSMbQYSe2nKQZ_sPn4kg}{10.244.0.20}{10.244.0.20:9300}{m}{shard_indexing_pressure_enabled=true}, minimumTerm=0, optionalJoin=Optional[Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={opensearch-nodes-cluster-manager-0}{sk-r0P_TTYuPqaamTFbjKg}{fIRSMbQYSe2nKQZ_sPn4kg}{10.244.0.20}{10.244.0.20:9300}{m}{shard_indexing_pressure_enabled=true}, targetNode={opensearch-nodes-cluster-manager-0}{sk-r0P_TTYuPqaamTFbjKg}{fIRSMbQYSe2nKQZ_sPn4kg}{10.244.0.20}{10.244.0.20:9300}{m}{shard_indexing_pressure_enabled=true}}]}",
45+ {"type": "server", "timestamp": "2025-10-01T12:47:28,363+0000 ", "level": "INFO", "component": "o.o.c.c.JoinHelper", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "failed to join {opensearch-nodes-cluster-manager-0}{sk-r0P_TTYuPqaamTFbjKg}{fIRSMbQYSe2nKQZ_sPn4kg}{10.244.0.20}{10.244.0.20:9300}{m}{shard_indexing_pressure_enabled=true} with JoinRequest{sourceNode={opensearch-nodes-cluster-manager-0}{sk-r0P_TTYuPqaamTFbjKg}{fIRSMbQYSe2nKQZ_sPn4kg}{10.244.0.20}{10.244.0.20:9300}{m}{shard_indexing_pressure_enabled=true}, minimumTerm=0, optionalJoin=Optional[Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={opensearch-nodes-cluster-manager-0}{sk-r0P_TTYuPqaamTFbjKg}{fIRSMbQYSe2nKQZ_sPn4kg}{10.244.0.20}{10.244.0.20:9300}{m}{shard_indexing_pressure_enabled=true}, targetNode={opensearch-nodes-cluster-manager-0}{sk-r0P_TTYuPqaamTFbjKg}{fIRSMbQYSe2nKQZ_sPn4kg}{10.244.0.20}{10.244.0.20:9300}{m}{shard_indexing_pressure_enabled=true}}]}",
4646 "stacktrace": ["org.opensearch.transport.RemoteTransportException: [opensearch-nodes-cluster-manager-0][10.244.0.20:9300][internal:cluster/coordination/join]",
4747 "Caused by: org.opensearch.cluster.coordination.CoordinationStateRejectedException: became follower",
4848 "at org.opensearch.cluster.coordination.JoinHelper$$CandidateJoinAccumulator.lambda$$close$$3(JoinHelper.java:648) ~[opensearch-3.6.0.jar:3.6.0]",
5858 "at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]"] }
5959 pod : opensearch-nodes-cluster-manager-0
6060 source_type : file
61- timestamp : 2025-10-01T12:47:29.473451193Z
61+ timestamp : 2025-10-01T12:47:29.473451193+0000
6262 outputs :
6363 - extract_from : extended_logs
6464 conditions :
9090 "pod": "opensearch-nodes-cluster-manager-0",
9191 "role": "nodes",
9292 "roleGroup": "cluster-manager",
93- "timestamp": t'2025-10-01T10 :47:28.363Z '
93+ "timestamp": t'2025-10-01T12 :47:28.363+0000 '
9494 }
9595
9696 assert_eq!(expected_log_event, .)
@@ -101,10 +101,10 @@ tests:
101101 log_fields :
102102 file : /stackable/log/opensearch/opensearch_server.json
103103 message : |
104- {"type": "server", "timestamp": "2025-10-01T12:47:28,582Z ", "level": "INFO", "component": "o.o.n.Node", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "started", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg"
104+ {"type": "server", "timestamp": "2025-10-01T12:47:28,582+0000 ", "level": "INFO", "component": "o.o.n.Node", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "started", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg"
105105 pod : opensearch-nodes-cluster-manager-0
106106 source_type : file
107- timestamp : 2025-10-01T12:47:29.473487331Z
107+ timestamp : 2025-10-01T12:47:29.473487331+0000
108108 outputs :
109109 - extract_from : extended_logs
110110 conditions :
@@ -119,12 +119,12 @@ tests:
119119 "file": "opensearch_server.json",
120120 "level": "INFO",
121121 "logger": "",
122- "message": "{\"type\": \"server\", \"timestamp\": \"2025-10-01T12:47:28,582Z \", \"level\": \"INFO\", \"component\": \"o.o.n.Node\", \"cluster.name\": \"opensearch\", \"node.name\": \"opensearch-nodes-cluster-manager-0\", \"message\": \"started\", \"cluster.uuid\": \"Jh1D6YAhTmyzkHI7vM1WWw\", \"node.id\": \"sk-r0P_TTYuPqaamTFbjKg\"\n",
122+ "message": "{\"type\": \"server\", \"timestamp\": \"2025-10-01T12:47:28,582+0000 \", \"level\": \"INFO\", \"component\": \"o.o.n.Node\", \"cluster.name\": \"opensearch\", \"node.name\": \"opensearch-nodes-cluster-manager-0\", \"message\": \"started\", \"cluster.uuid\": \"Jh1D6YAhTmyzkHI7vM1WWw\", \"node.id\": \"sk-r0P_TTYuPqaamTFbjKg\"\n",
123123 "namespace": "default",
124124 "pod": "opensearch-nodes-cluster-manager-0",
125125 "role": "nodes",
126126 "roleGroup": "cluster-manager",
127- "timestamp": "2025-10-01T12:47:29.473487331Z "
127+ "timestamp": "2025-10-01T12:47:29.473487331+0000 "
128128 }
129129
130130 assert_eq!(expected_log_event, .)
@@ -138,7 +138,7 @@ tests:
138138 false
139139 pod : opensearch-nodes-cluster-manager-0
140140 source_type : file
141- timestamp : 2025-10-01T12:47:29.473487331Z
141+ timestamp : 2025-10-01T12:47:29.473487331+0000
142142 outputs :
143143 - extract_from : extended_logs
144144 conditions :
@@ -158,7 +158,38 @@ tests:
158158 "pod": "opensearch-nodes-cluster-manager-0",
159159 "role": "nodes",
160160 "roleGroup": "cluster-manager",
161- "timestamp": "2025-10-01T12:47:29.473487331Z"
161+ "timestamp": "2025-10-01T12:47:29.473487331+0000"
162+ }
163+
164+ assert_eq!(expected_log_event, .)
165+ - name : Test opensearch_server log entry with a timestamp in the Zulu timezone
166+ inputs :
167+ - type : log
168+ insert_at : processed_files_opensearch_server
169+ log_fields :
170+ file : /stackable/log/opensearch/opensearch_server.json
171+ message : |
172+ {"type": "server", "timestamp": "2025-10-01T12:47:28,582Z", "level": "INFO", "component": "o.o.n.Node", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "started", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg" }
173+ pod : opensearch-nodes-cluster-manager-0
174+ source_type : file
175+ timestamp : 2025-10-01T12:47:29.473487331+0000
176+ outputs :
177+ - extract_from : extended_logs
178+ conditions :
179+ - type : vrl
180+ source : |
181+ expected_log_event = {
182+ "cluster": "opensearch",
183+ "container": "opensearch",
184+ "file": "opensearch_server.json",
185+ "level": "INFO",
186+ "logger": "o.o.n.Node",
187+ "message": "started",
188+ "namespace": "default",
189+ "pod": "opensearch-nodes-cluster-manager-0",
190+ "role": "nodes",
191+ "roleGroup": "cluster-manager",
192+ "timestamp": t'2025-10-01T12:47:28.582+0000'
162193 }
163194
164195 assert_eq!(expected_log_event, .)
@@ -172,7 +203,7 @@ tests:
172203 {"type": "server", "timestamp": "unparsable", "level": "INFO", "component": "o.o.n.Node", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "started", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg" }
173204 pod : opensearch-nodes-cluster-manager-0
174205 source_type : file
175- timestamp : 2025-10-01T12:47:29.473487331Z
206+ timestamp : 2025-10-01T12:47:29.473487331+0000
176207 outputs :
177208 - extract_from : extended_logs
178209 conditions :
@@ -182,7 +213,7 @@ tests:
182213 "cluster": "opensearch",
183214 "container": "opensearch",
184215 "errors": [
185- "Timestamp not parsable, using current time instead: function call error for \"parse_timestamp\" at (584:643 ): Invalid timestamp \"unparsable\": input contains invalid characters"
216+ "Timestamp not parsable, using current time instead: function call error for \"parse_timestamp\" at (990:1070 ): Invalid timestamp \"unparsable\": input contains invalid characters"
186217 ],
187218 "file": "opensearch_server.json",
188219 "level": "INFO",
@@ -192,7 +223,7 @@ tests:
192223 "pod": "opensearch-nodes-cluster-manager-0",
193224 "role": "nodes",
194225 "roleGroup": "cluster-manager",
195- "timestamp": "2025-10-01T12:47:29.473487331Z "
226+ "timestamp": "2025-10-01T12:47:29.473487331+0000 "
196227 }
197228
198229 assert_eq!(expected_log_event, .)
@@ -206,7 +237,7 @@ tests:
206237 {"type": "server", "level": "INFO", "component": "o.o.n.Node", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "started", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg" }
207238 pod : opensearch-nodes-cluster-manager-0
208239 source_type : file
209- timestamp : 2025-10-01T12:47:29.473487331Z
240+ timestamp : 2025-10-01T12:47:29.473487331+0000
210241 outputs :
211242 - extract_from : extended_logs
212243 conditions :
@@ -226,7 +257,7 @@ tests:
226257 "pod": "opensearch-nodes-cluster-manager-0",
227258 "role": "nodes",
228259 "roleGroup": "cluster-manager",
229- "timestamp": "2025-10-01T12:47:29.473487331Z "
260+ "timestamp": "2025-10-01T12:47:29.473487331+0000 "
230261 }
231262
232263 assert_eq!(expected_log_event, .)
@@ -237,10 +268,10 @@ tests:
237268 log_fields :
238269 file : /stackable/log/opensearch/opensearch_server.json
239270 message : |
240- {"type": "server", "timestamp": "2025-10-01T12:47:28,582Z ", "level": "INFO", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "started", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg" }
271+ {"type": "server", "timestamp": "2025-10-01T12:47:28,582+0000 ", "level": "INFO", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "started", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg" }
241272 pod : opensearch-nodes-cluster-manager-0
242273 source_type : file
243- timestamp : 2025-10-01T12:47:29.473487331Z
274+ timestamp : 2025-10-01T12:47:29.473487331+0000
244275 outputs :
245276 - extract_from : extended_logs
246277 conditions :
@@ -260,7 +291,7 @@ tests:
260291 "pod": "opensearch-nodes-cluster-manager-0",
261292 "role": "nodes",
262293 "roleGroup": "cluster-manager",
263- "timestamp": t'2025-10-01T10 :47:28.582Z '
294+ "timestamp": t'2025-10-01T12 :47:28.582+0000 '
264295 }
265296
266297 assert_eq!(expected_log_event, .)
@@ -271,10 +302,10 @@ tests:
271302 log_fields :
272303 file : /stackable/log/opensearch/opensearch_server.json
273304 message : |
274- {"type": "server", "timestamp": "2025-10-01T12:47:28,582Z ", "component": "o.o.n.Node", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "started", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg" }
305+ {"type": "server", "timestamp": "2025-10-01T12:47:28,582+0000 ", "component": "o.o.n.Node", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "started", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg" }
275306 pod : opensearch-nodes-cluster-manager-0
276307 source_type : file
277- timestamp : 2025-10-01T12:47:29.473487331Z
308+ timestamp : 2025-10-01T12:47:29.473487331+0000
278309 outputs :
279310 - extract_from : extended_logs
280311 conditions :
@@ -294,7 +325,7 @@ tests:
294325 "pod": "opensearch-nodes-cluster-manager-0",
295326 "role": "nodes",
296327 "roleGroup": "cluster-manager",
297- "timestamp": t'2025-10-01T10 :47:28.582Z '
328+ "timestamp": t'2025-10-01T12 :47:28.582+0000 '
298329 }
299330
300331 assert_eq!(expected_log_event, .)
@@ -305,10 +336,10 @@ tests:
305336 log_fields :
306337 file : /stackable/log/opensearch/opensearch_server.json
307338 message : |
308- {"type": "server", "timestamp": "2025-10-01T12:47:28,582Z ", "level": "DEPRECATION", "component": "o.o.d.t.TransportInfo", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "transport.publish_address was printed as [ip:port] instead of [hostname/ip:port]. This format is deprecated and will change to [hostname/ip:port] in a future version. Use -Dopensearch.transport.cname_in_publish_address=true to enforce non-deprecated formatting.", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg" }
339+ {"type": "server", "timestamp": "2025-10-01T12:47:28,582+0000 ", "level": "DEPRECATION", "component": "o.o.d.t.TransportInfo", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "transport.publish_address was printed as [ip:port] instead of [hostname/ip:port]. This format is deprecated and will change to [hostname/ip:port] in a future version. Use -Dopensearch.transport.cname_in_publish_address=true to enforce non-deprecated formatting.", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg" }
309340 pod : opensearch-nodes-cluster-manager-0
310341 source_type : file
311- timestamp : 2025-10-01T12:47:29.473487331Z
342+ timestamp : 2025-10-01T12:47:29.473487331+0000
312343 outputs :
313344 - extract_from : extended_logs
314345 conditions :
@@ -325,7 +356,7 @@ tests:
325356 "pod": "opensearch-nodes-cluster-manager-0",
326357 "role": "nodes",
327358 "roleGroup": "cluster-manager",
328- "timestamp": t'2025-10-01T10 :47:28.582Z '
359+ "timestamp": t'2025-10-01T12 :47:28.582+0000 '
329360 }
330361
331362 assert_eq!(expected_log_event, .)
@@ -336,10 +367,10 @@ tests:
336367 log_fields :
337368 file : /stackable/log/opensearch/opensearch_server.json
338369 message : |
339- {"type": "server", "timestamp": "2025-10-01T12:47:28,582Z ", "level": "CRITICAL", "component": "o.o.n.Node", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "started", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg" }
370+ {"type": "server", "timestamp": "2025-10-01T12:47:28,582+0000 ", "level": "CRITICAL", "component": "o.o.n.Node", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "message": "started", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg" }
340371 pod : opensearch-nodes-cluster-manager-0
341372 source_type : file
342- timestamp : 2025-10-01T12:47:29.473487331Z
373+ timestamp : 2025-10-01T12:47:29.473487331+0000
343374 outputs :
344375 - extract_from : extended_logs
345376 conditions :
@@ -359,7 +390,7 @@ tests:
359390 "pod": "opensearch-nodes-cluster-manager-0",
360391 "role": "nodes",
361392 "roleGroup": "cluster-manager",
362- "timestamp": t'2025-10-01T10 :47:28.582Z '
393+ "timestamp": t'2025-10-01T12 :47:28.582+0000 '
363394 }
364395
365396 assert_eq!(expected_log_event, .)
@@ -370,10 +401,10 @@ tests:
370401 log_fields :
371402 file : /stackable/log/opensearch/opensearch_server.json
372403 message : |
373- {"type": "server", "timestamp": "2025-10-01T12:47:28,582Z ", "level": "INFO", "component": "o.o.n.Node", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg" }
404+ {"type": "server", "timestamp": "2025-10-01T12:47:28,582+0000 ", "level": "INFO", "component": "o.o.n.Node", "cluster.name": "opensearch", "node.name": "opensearch-nodes-cluster-manager-0", "cluster.uuid": "Jh1D6YAhTmyzkHI7vM1WWw", "node.id": "sk-r0P_TTYuPqaamTFbjKg" }
374405 pod : opensearch-nodes-cluster-manager-0
375406 source_type : file
376- timestamp : 2025-10-01T12:47:29.473487331Z
407+ timestamp : 2025-10-01T12:47:29.473487331+0000
377408 outputs :
378409 - extract_from : extended_logs
379410 conditions :
@@ -393,7 +424,7 @@ tests:
393424 "pod": "opensearch-nodes-cluster-manager-0",
394425 "role": "nodes",
395426 "roleGroup": "cluster-manager",
396- "timestamp": t'2025-10-01T10 :47:28.582Z '
427+ "timestamp": t'2025-10-01T12 :47:28.582+0000 '
397428 }
398429
399430 assert_eq!(expected_log_event, .)
@@ -414,7 +445,7 @@ tests:
414445 pod : opensearch-nodes-cluster-manager-0
415446 revision : dc7e792 2025-08-12 13:47:08.632326804
416447 source_type : internal_logs
417- timestamp : 2025-10-02T09:46:14.479381097Z
448+ timestamp : 2025-10-02T09:46:14.479381097+0000
418449 version : 0.49.0
419450 outputs :
420451 - extract_from : extended_logs
@@ -434,7 +465,7 @@ tests:
434465 "revision": "dc7e792 2025-08-12 13:47:08.632326804",
435466 "role": "nodes",
436467 "roleGroup": "cluster-manager",
437- "timestamp": "2025-10-02T09:46:14.479381097Z ",
468+ "timestamp": "2025-10-02T09:46:14.479381097+0000 ",
438469 "version": "0.49.0"
439470 }
440471
0 commit comments