Merge pull request #193 from whyscream/validate-config-syntax

Validate config syntax

Author: whyscream

.github/workflows/test_config_syntax.yml

@@ -0,0 +1,13 @@
+name: Validate configuration syntax
+on: [push]
+jobs:
+  test-syntax:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: |
+          docker run --rm \
+          --volume ./postfix.grok:/etc/logstash/patterns.d/postfix.grok \
+          --volume ./50-filter-postfix.conf:/usr/share/logstash/pipeline/50-filter-postfix.conf \
+          logstash:8.12.0 \
+          logstash --config.test_and_exit -f /usr/share/logstash/pipeline/50-filter-postfix.conf

.github/workflows/run_tests.yml .github/workflows/test_grok_patterns.yml.github/workflows/run_tests.yml renamed to .github/workflows/test_grok_patterns.yml

@@ -1,6 +1,7 @@
+name: Test grok patterns
 on: [push]
 jobs:
-  test:
+  test-patterns:
     runs-on: ubuntu-latest
 
     steps:

ALTERNATIVE-INPUTS.md

@@ -7,9 +7,11 @@ Various other Logstash filters can produce the needed input fields (`program` an
 ----------------
 
 ``` 
-grok {
-    match => { "message" => "%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST} %{DATA:program}(?:\[%{POSINT}\])?: %{GREEDYDATA:message}" }
-    overwrite => ["timestamp", "message"]
+filter {
+    grok {
+        match => { "message" => "%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST} %{DATA:program}(?:\[%{POSINT}\])?: %{GREEDYDATA:message}" }
+        overwrite => ["timestamp", "message"]
+    }
 }
 ```
 

test_config_syntax.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -eux
+
+docker run --rm -it \
+  --volume $(pwd)/postfix.grok:/etc/logstash/patterns.d/postfix.grok \
+  --volume $(pwd)/50-filter-postfix.conf:/usr/share/logstash/pipeline/50-filter-postfix.conf \
+  logstash:8.12.0 \
+  logstash --config.test_and_exit -f /usr/share/logstash/pipeline/50-filter-postfix.conf