How can I write multiple pantherlog tests for a schema?
QUESTION
When I write a test file to use with pantherlog
, I can only specify one input log and one expected result. How can I write multiple tests for the same schema?
ANSWER
We support multiple tests by utilizing multiple YAML documents in the same file. Consider this example:
name: Custom Log Test 1 logType: Custom.MyLog input: | { <your log input here> } result: | { <parsed log here> } --- name: Custom Log Test 2 logType: Custom.MyLog input: | { <second log input> } result: | { <second parsed result> }
We can denote separate tests by adding a single line with three dashes: ---