def test_merge_field_within_schema(self):
custom = {
'base': {
'schema_details': {},
'field_details': {
'name': 'base'
},
'fields': {
'my_field': {
'field_details': {
'name': 'my_field',
'type': 'keyword'
}
}
}
}
}
expected_fields = {
'base': {
'schema_details': {
'root': True
},
'field_details': {
'name': 'base',
'type': 'group'
},
'fields': {
'message': {
'field_details': {
'name': 'message',
'type': 'keyword'
}
},
'my_field': {
'field_details': {
'name': 'my_field',
'type': 'keyword'
}
}
}
}
}
merged_fields = loader.merge_fields(self.schema_base(), custom)
self.assertEqual(['message', 'my_field'],
sorted(expected_fields['base']['fields'].keys()))
self.assertEqual(
expected_fields, merged_fields,
"New fields being merged in existing schemas are merged in the 'fields' dict."
)
def test_merge_non_array_attributes(self):
custom = {
'base': {
'schema_details': {
'root':
False, # Override (not that I'd recommend overriding that)
'group': 3 # New
},
'field_details': {
'type': 'object', # Override
'example': 'foo' # New
},
'fields': {
'message': {
'field_details': {
'type': 'wildcard', # Override
'example': 'wild value' # New
}
}
}
}
}
merged_fields = loader.merge_fields(self.schema_base(), custom)
expected_fields = {
'base': {
'schema_details': {
'root': False,
'group': 3
},
'field_details': {
'name': 'base',
'type': 'object',
'example': 'foo'
},
'fields': {
'message': {
'field_details': {
'name': 'message',
'type': 'wildcard',
'example': 'wild value'
}
}
}
}
}
self.assertEqual(merged_fields, expected_fields)
def test_merge_new_schema(self):
custom = {
'custom': {
'schema_details': {},
'field_details': {
'name': 'custom',
'type': 'group'
},
'fields': {
'my_field': {
'field_details': {
'name': 'my_field',
'type': 'keyword'
}
}
}
}
}
expected_fields = {**self.schema_base(), **custom}
merged_fields = loader.merge_fields(self.schema_base(), custom)
self.assertEqual(expected_fields, merged_fields,
"New schemas should just be a dictionary merge")
def test_merge_array_attributes(self):
# array attributes:
# - schema/reusable.expected
# - field/normalize
ecs = {
'foo': {
'schema_details': {
'reusable': {
'top_level': True,
'expected': ['normal.location']
}
},
'field_details': {
'name': 'foo',
'type': 'group'
},
'fields': {
'normalized_field': {
'field_details': {
'name': 'normalized_field',
'type': 'keyword',
'normalize': ['lowercase']
}
},
'not_initially_normalized': {
'field_details': {
'name': 'not_initially_normalized',
'type': 'keyword'
}
}
}
}
}
custom = {
'foo': {
'schema_details': {
'reusable': {
'expected': ['a_new.location']
}
},
'field_details': {
'name': 'foo',
'type': 'group'
},
'fields': {
'normalized_field': {
'field_details': {
'name': 'normalized_field',
'normalize': ['array']
}
},
'not_initially_normalized': {
'field_details': {
'name': 'not_initially_normalized',
'normalize': ['array']
}
}
}
}
}
merged_fields = loader.merge_fields(ecs, custom)
expected_fields = {
'foo': {
'schema_details': {
'reusable': {
'top_level': True,
'expected': ['normal.location', 'a_new.location']
}
},
'field_details': {
'name': 'foo',
'type': 'group'
},
'fields': {
'normalized_field': {
'field_details': {
'name': 'normalized_field',
'type': 'keyword',
'normalize': ['lowercase', 'array']
}
},
'not_initially_normalized': {
'field_details': {
'name': 'not_initially_normalized',
'type': 'keyword',
'normalize': ['array']
}
}
}
}
}
self.assertEqual(
merged_fields['foo']['schema_details']['reusable']['expected'],
['normal.location', 'a_new.location'])
self.assertEqual(
merged_fields['foo']['fields']['normalized_field']['field_details']
['normalize'], ['lowercase', 'array'])
self.assertEqual(
merged_fields['foo']['fields']['not_initially_normalized']
['field_details']['normalize'], ['array'])
self.assertEqual(merged_fields, expected_fields)
def test_fields_with_subfields_mergeable(self):
custom = {
'process': {
'schema_details': {},
'field_details': {
'name': 'process'
},
'fields': {
'parent': {
'field_details': {
'type': 'object'
},
'fields': {
'name': {
'field_details': {
'name': 'parent.name',
'type': 'keyword'
}
}
}
}
}
}
}
merged_fields = loader.merge_fields(self.schema_process(), custom)
expected_fields = {
'process': {
'schema_details': {},
'field_details': {
'name': 'process',
'type': 'group'
},
'fields': {
'pid': {
'field_details': {
'name': 'pid',
'type': 'keyword'
}
},
'parent': {
'field_details': {
'type': 'object'
},
'fields': {
'pid': {
'field_details': {
'name': 'parent.pid',
'type': 'keyword'
}
},
'name': {
'field_details': {
'name': 'parent.name',
'type': 'keyword'
}
}
}
}
}
}
}
self.assertEqual(merged_fields, expected_fields)