🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The testParserV2() mutation runs a parser script against a set of test cases in LogScale. Use this mutation to validate parser logic before saving changes. If the parser fails to run, the mutation returns a ParserTestRunAborted result containing an error message. If all test cases complete, it returns a ParserTestRunCompleted result with one entry per test case in submission order.

Syntax

graphql
testParserV2(
      input: ParserTestRunInput!
   ): ParserTestRunOutput!

The required input argument accepts a ParserTestRunInput object. Provide the repository name, parser name, the parser script to execute, fields to tag, fields to remove before parsing, and one or more test cases. The packageId, languageVersion, schema, and schemaName arguments are optional. See the Input Parameters section for the full field reference.

The mutation returns a non-null ParserTestRunOutput! union. It resolves to either ParserTestRunCompleted when all test cases run or ParserTestRunAborted when the parser fails to execute. See the Returned Values section for the full field reference.

Example

Raw
graphql
mutation {
  testParserV2(input: 
    { repositoryName: "humio",
      parserName: "my-parser",
      script: "kvParse()",
      testCases: [{
        event: {rawString: "key=value"}, 
        outputAssertions: [{outputEventIndex: 0, 
                            assertions: { fieldsHaveValues: 
                                   [{fieldName: "key", expectedValue: "value"}]
                            } } ],
        }],
      fieldsToTag: [],
      fieldsToBeRemovedBeforeParsing: []
    } )
  { ... on ParserTestRunCompleted {
              results {
                outputEvents { fields { fieldName, value } },
                outputFailures {
                  outputEventIndex,
                  failures {
                    parsingErrors,
                    assertionFailuresOnFields {
                      ... on FieldUnexpectedlyPresent { fieldName, actualValue }
                      ... on Field adUnexpectedValue { fieldName, expectedValue, actualValue }
                      ... on FieldHadConflictingAssertions { fieldName }
                      ... on AssertionOnFieldWasOrphaned { fieldName }
}
                } } } }
    ... on ParserTestRunAborted { errorMessage }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  testParserV2(input: 
    { repositoryName: \"humio\",
      parserName: \"my-parser\",
      script: \"kvParse()\",
      testCases: [{
        event: {rawString: \"key=value\"}, 
        outputAssertions: [{outputEventIndex: 0, 
                            assertions: { fieldsHaveValues: 
                                   [{fieldName: \"key\", expectedValue: \"value\"}]
                            } } ],
        }],
      fieldsToTag: [],
      fieldsToBeRemovedBeforeParsing: []
    } )
  { ... on ParserTestRunCompleted {
              results {
                outputEvents { fields { fieldName, value } },
                outputFailures {
                  outputEventIndex,
                  failures {
                    parsingErrors,
                    assertionFailuresOnFields {
                      ... on FieldUnexpectedlyPresent { fieldName, actualValue }
                      ... on Field adUnexpectedValue { fieldName, expectedValue, actualValue }
                      ... on FieldHadConflictingAssertions { fieldName }
                      ... on AssertionOnFieldWasOrphaned { fieldName }
}
                } } } }
    ... on ParserTestRunAborted { errorMessage }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  testParserV2(input: 
    { repositoryName: \"humio\",
      parserName: \"my-parser\",
      script: \"kvParse()\",
      testCases: [{
        event: {rawString: \"key=value\"}, 
        outputAssertions: [{outputEventIndex: 0, 
                            assertions: { fieldsHaveValues: 
                                   [{fieldName: \"key\", expectedValue: \"value\"}]
                            } } ],
        }],
      fieldsToTag: [],
      fieldsToBeRemovedBeforeParsing: []
    } )
  { ... on ParserTestRunCompleted {
              results {
                outputEvents { fields { fieldName, value } },
                outputFailures {
                  outputEventIndex,
                  failures {
                    parsingErrors,
                    assertionFailuresOnFields {
                      ... on FieldUnexpectedlyPresent { fieldName, actualValue }
                      ... on Field adUnexpectedValue { fieldName, expectedValue, actualValue }
                      ... on FieldHadConflictingAssertions { fieldName }
                      ... on AssertionOnFieldWasOrphaned { fieldName }
}
                } } } }
    ... on ParserTestRunAborted { errorMessage }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  testParserV2(input:  ^
    { repositoryName: \"humio\", ^
      parserName: \"my-parser\", ^
      script: \"kvParse()\", ^
      testCases: [{ ^
        event: {rawString: \"key=value\"},  ^
        outputAssertions: [{outputEventIndex: 0,  ^
                            assertions: { fieldsHaveValues:  ^
                                   [{fieldName: \"key\", expectedValue: \"value\"}] ^
                            } } ], ^
        }], ^
      fieldsToTag: [], ^
      fieldsToBeRemovedBeforeParsing: [] ^
    } ) ^
  { ... on ParserTestRunCompleted { ^
              results { ^
                outputEvents { fields { fieldName, value } }, ^
                outputFailures { ^
                  outputEventIndex, ^
                  failures { ^
                    parsingErrors, ^
                    assertionFailuresOnFields { ^
                      ... on FieldUnexpectedlyPresent { fieldName, actualValue } ^
                      ... on Field adUnexpectedValue { fieldName, expectedValue, actualValue } ^
                      ... on FieldHadConflictingAssertions { fieldName } ^
                      ... on AssertionOnFieldWasOrphaned { fieldName } ^
} ^
                } } } } ^
    ... on ParserTestRunAborted { errorMessage } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  testParserV2(input: 
    { repositoryName: \"humio\",
      parserName: \"my-parser\",
      script: \"kvParse()\",
      testCases: [{
        event: {rawString: \"key=value\"}, 
        outputAssertions: [{outputEventIndex: 0, 
                            assertions: { fieldsHaveValues: 
                                   [{fieldName: \"key\", expectedValue: \"value\"}]
                            } } ],
        }],
      fieldsToTag: [],
      fieldsToBeRemovedBeforeParsing: []
    } )
  { ... on ParserTestRunCompleted {
              results {
                outputEvents { fields { fieldName, value } },
                outputFailures {
                  outputEventIndex,
                  failures {
                    parsingErrors,
                    assertionFailuresOnFields {
                      ... on FieldUnexpectedlyPresent { fieldName, actualValue }
                      ... on Field adUnexpectedValue { fieldName, expectedValue, actualValue }
                      ... on FieldHadConflictingAssertions { fieldName }
                      ... on AssertionOnFieldWasOrphaned { fieldName }
}
                } } } }
    ... on ParserTestRunAborted { errorMessage }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  testParserV2(input: 
    { repositoryName: \"humio\",
      parserName: \"my-parser\",
      script: \"kvParse()\",
      testCases: [{
        event: {rawString: \"key=value\"}, 
        outputAssertions: [{outputEventIndex: 0, 
                            assertions: { fieldsHaveValues: 
                                   [{fieldName: \"key\", expectedValue: \"value\"}]
                            } } ],
        }],
      fieldsToTag: [],
      fieldsToBeRemovedBeforeParsing: []
    } )
  { ... on ParserTestRunCompleted {
              results {
                outputEvents { fields { fieldName, value } },
                outputFailures {
                  outputEventIndex,
                  failures {
                    parsingErrors,
                    assertionFailuresOnFields {
                      ... on FieldUnexpectedlyPresent { fieldName, actualValue }
                      ... on Field adUnexpectedValue { fieldName, expectedValue, actualValue }
                      ... on FieldHadConflictingAssertions { fieldName }
                      ... on AssertionOnFieldWasOrphaned { fieldName }
}
                } } } }
    ... on ParserTestRunAborted { errorMessage }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  testParserV2(input: 
    { repositoryName: \"humio\",
      parserName: \"my-parser\",
      script: \"kvParse()\",
      testCases: [{
        event: {rawString: \"key=value\"}, 
        outputAssertions: [{outputEventIndex: 0, 
                            assertions: { fieldsHaveValues: 
                                   [{fieldName: \"key\", expectedValue: \"value\"}]
                            } } ],
        }],
      fieldsToTag: [],
      fieldsToBeRemovedBeforeParsing: []
    } )
  { ... on ParserTestRunCompleted {
              results {
                outputEvents { fields { fieldName, value } },
                outputFailures {
                  outputEventIndex,
                  failures {
                    parsingErrors,
                    assertionFailuresOnFields {
                      ... on FieldUnexpectedlyPresent { fieldName, actualValue }
                      ... on Field adUnexpectedValue { fieldName, expectedValue, actualValue }
                      ... on FieldHadConflictingAssertions { fieldName }
                      ... on AssertionOnFieldWasOrphaned { fieldName }
}
                } } } }
    ... on ParserTestRunAborted { errorMessage }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  testParserV2(input: 
    { repositoryName: \"humio\",
      parserName: \"my-parser\",
      script: \"kvParse()\",
      testCases: [{
        event: {rawString: \"key=value\"}, 
        outputAssertions: [{outputEventIndex: 0, 
                            assertions: { fieldsHaveValues: 
                                   [{fieldName: \"key\", expectedValue: \"value\"}]
                            } } ],
        }],
      fieldsToTag: [],
      fieldsToBeRemovedBeforeParsing: []
    } )
  { ... on ParserTestRunCompleted {
              results {
                outputEvents { fields { fieldName, value } },
                outputFailures {
                  outputEventIndex,
                  failures {
                    parsingErrors,
                    assertionFailuresOnFields {
                      ... on FieldUnexpectedlyPresent { fieldName, actualValue }
                      ... on Field adUnexpectedValue { fieldName, expectedValue, actualValue }
                      ... on FieldHadConflictingAssertions { fieldName }
                      ... on AssertionOnFieldWasOrphaned { fieldName }
}
                } } } }
    ... on ParserTestRunAborted { errorMessage }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Input Parameters

The input argument accepts a ParserTestRunInput object. Required fields identify the repository and parser, supply the parser script to execute, specify tag fields, list fields to strip before parsing, and provide the test cases to run. Optional fields control package dependency resolution, language version, and schema validation. The table following describes each field:

Table: ParserTestRunInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
fieldsToBeRemovedBeforeParsingStringyes Long-Term A list of fields that will be removed from the event before it's parsed. These fields will not be included when calculating usage.
fieldsToTagStringyes Long-Term The fields that are used as tags.
languageVersionLanguageVersionInputType  Long-Term A specific language version. See LanguageVersionInputType.
packageIdUnversionedPackageSpecifier    The id of the package the parser is part of. This is used to properly resolve dependencies when testing the parser
parserNameStringyes Long-Term The name of the parser. This is part of the test output in the #type field in each parsed event.
repositoryNameRepoOrViewNameyes Long-Term The name of the repository in which the parser is located. This is part of the test output in the #repo field in each parsed event. The RepoOrViewName is a scalar.
schemaYAML  Long-Term The yaml specification of schema by which to validate parser output. YAML is a scalar.
schemaNameSchema  Long-Term The name of the used schema. See Schema.
scriptStringyes Long-Term The parser script that is executed for every incoming event.
testCasesParserTestCaseInputyes Long-Term The test cases to run the parsing script against. See ParserTestCaseInput.

Returned Values

The mutation returns a ParserTestRunOutput! union. Use inline fragments to select fields from each member type. ParserTestRunCompleted provides a results list, with one entry per test case in the same order they were submitted, so you can match results to test cases by index. ParserTestRunAborted provides an errorMessage string when the parser script fails to execute. The tables following describe each type:

Table: ParserTestRunCompleted Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
resultsParserTestCaseResultyes Long-Term The results from running each test case. See ParserTestCaseResult.

Table: ParserTestRunAborted Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
errorMessageStringyes Long-Term The error message returned when a parser test is run aborted.