fix

internal/ingest/syslog_parse_test.go

@@ -0,0 +1,32 @@
+package ingest
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestParseSyslogPayloadPri(t *testing.T) {
+	p := parseSyslogPayload([]byte("<34>Oct 11 22:14:15 mymachine su: 'su root' failed for lonvick on /dev/pts/8"))
+	if p.Priority != 34 {
+		t.Fatalf("priority=%d", p.Priority)
+	}
+}
+
+func TestForwardAlertBodyIncludesRawData(t *testing.T) {
+	raw := []byte(`{"source":"syslog","parsed":{}}`)
+	b := AlertReceiveBody{
+		AlertName: "a",
+		RawData:   raw,
+	}
+	data, err := json.Marshal(b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var dec map[string]json.RawMessage
+	if err := json.Unmarshal(data, &dec); err != nil {
+		t.Fatal(err)
+	}
+	if string(dec["raw_data"]) != string(raw) {
+		t.Fatalf("raw_data %s", dec["raw_data"])
+	}
+}