---
# `vector test` unit tests for the aggregator transforms. Merged with
# aggregator.yaml in CI (.woodpecker/vector-test.yaml). This is the pattern the
# per-app parsing follow-ups extend: add a test per new transform here.
tests:
  - name: subject_routes_k8s_vs_vm
    inputs:
      - insert_at: route
        type: log
        log_fields:
          subject: "logs.k8s.shop.web"
          message: "routed"
    outputs:
      - extract_from: route.k8s
        conditions:
          - type: vrl
            source: |
              assert_eq!(.message, "routed")

  - name: k8s_log_is_normalised
    inputs:
      - insert_at: k8s_shape
        type: log
        log_fields:
          message: "hello from pod"
          stream: "stdout"
          timestamp: "2026-07-27T00:00:00Z"
          kubernetes.pod_name: "web-abc"
          kubernetes.pod_namespace: "shop"
          kubernetes.container_name: "web"
          kubernetes.pod_node_name: "node-1"
    outputs:
      - extract_from: k8s_shape
        conditions:
          - type: vrl
            source: |
              assert_eq!(.source, "k8s")
              assert_eq!(.namespace, "shop")
              assert_eq!(.pod, "web-abc")
              assert_eq!(.container, "web")
              assert_eq!(.host, "node-1")
              assert_eq!(.stream, "stdout")
              assert_eq!(.message, "hello from pod")

  - name: vm_log_is_normalised
    inputs:
      - insert_at: vm_shape
        type: log
        log_fields:
          message: "sshd started"
          host: "vm-db-1"
          severity: "info"
          role: "database"
    outputs:
      - extract_from: vm_shape
        conditions:
          - type: vrl
            source: |
              assert_eq!(.source, "vm")
              assert_eq!(.host, "vm-db-1")
              assert_eq!(.severity, "info")
              assert_eq!(.message, "sshd started")
              assert_eq!(.labels.role, "database")