Be more lenient with fieldnames in Grok Processor (#21745)

elastic · Jun 29, 2018 · 0ef98d6 · 0ef98d6
1 parent 125933b
commit 0ef98d6
Showing 1 changed file with 44 additions and 9 deletions.
diff --git a/libs/grok/src/test/java/org/elasticsearch/grok/GrokTests.java b/libs/grok/src/test/java/org/elasticsearch/grok/GrokTests.java
@@ -440,14 +440,49 @@ public void testExponentialExpressions() {
         assertThat(e.getMessage(), equalTo("grok pattern matching was interrupted after [200] ms"));
     }
 
-    public void testUnicodeFieldnames() {
-        for (String fieldName : Arrays.asList("@metadata", "@metädata", "@metädat[a]",
-            randomAlphaOfLengthBetween(1, 5), String.valueOf(randomIntBetween(0, 100)),
-            randomAlphaOfLengthBetween(1, 5) + randomIntBetween(0, 100))) {
-            String line = "foo";
-            Grok grok = new Grok(basePatterns, "%{WORD:" + fieldName + "}");
-            Map<String, Object> matches = grok.captures(line);
-            assertEquals("foo", matches.get(fieldName));
-        }
+    public void testAtInFieldName() {
+        assertGrokedField("@metadata");
+    }
+
+    public void assertNonAsciiLetterInFieldName() {
+        assertGrokedField("metädata");
+    }
+
+    public void assertSquareBracketInFieldName() {
+        assertGrokedField("metadat[a]");
+        assertGrokedField("metad[a]ta");
+        assertGrokedField("[m]etadata");
+    }
+
+    public void testUnderscoreInFieldName() {
+        assertGrokedField("meta_data");
+    }
+
+    public void testDotInFieldName() {
+        assertGrokedField("meta.data");
+    }
+
+    public void testMinusInFieldName() {
+        assertGrokedField("meta-data");
+    }
+
+    public void testAlphanumericFieldName() {
+        assertGrokedField(randomAlphaOfLengthBetween(1, 5));
+        assertGrokedField(randomAlphaOfLengthBetween(1, 5) + randomIntBetween(0, 100));
+        assertGrokedField(randomIntBetween(0, 100) + randomAlphaOfLengthBetween(1, 5));
+        assertGrokedField(String.valueOf(randomIntBetween(0, 100)));
+    }
+
+    public void testUnsupportedBracketsInFieldName() {
+        Grok grok = new Grok(basePatterns, "%{WORD:unsuppo(r)ted}");
+        Map<String, Object> matches = grok.captures("line");
+        assertNull(matches);
+    }
+
+    private void assertGrokedField(String fieldName) {
+        String line = "foo";
+        Grok grok = new Grok(basePatterns, "%{WORD:" + fieldName + "}");
+        Map<String, Object> matches = grok.captures(line);
+        assertEquals(line, matches.get(fieldName));
     }
 }