feat(#4281): New invalid decoder test case for wazuh-logtest

wazuh · Jul 6, 2023 · bb56c93 · bb56c93
1 parent 1e018e8
commit bb56c93
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/tests/integration/test_logtest/test_invalid_rule_decoders_syntax/data/custom_decoder_11.xml b/tests/integration/test_logtest/test_invalid_rule_decoders_syntax/data/custom_decoder_11.xml
@@ -0,0 +1,6 @@
+<!-- Test: invalid regex offset-->
+<decoder name="sudo-fields">
+  <parent>sudo</parent>
+  <regex offset="after_regex">(\S+)</regex>
+  <order>boom</order>
+</decoder>
diff --git a/...tegration/test_logtest/test_invalid_rule_decoders_syntax/data/invalid_decoder_syntax.yaml b/...tegration/test_logtest/test_invalid_rule_decoders_syntax/data/invalid_decoder_syntax.yaml
@@ -76,3 +76,10 @@
   output_error: 0
   output_data_msg: "(2107): Decoder configuration error: 'name'."
   output_data_codemsg: -1
+-
+  name: "Invalid decoder syntax: invalid offset"
+  decoder: "custom_decoder_11.xml"
+  input: '{"version":1,"origin":{"name":"Integration Test","module":"api"},"command":"log_processing","parameters":{"event": "dummy log","log_format": "syslog","location": "master->/var/log/syslog"}}'
+  output_error: 0
+  output_data_msg: "ERROR: (2120): Invalid offset value: 'sudo-fields'"
+  output_data_codemsg: -1