| 1 | # Test rewrite pipeline logic - multiple rules, stop/continue behavior |
| 2 | pattern: "(?P<level>\\w+)\\s+(?P<code>\\d+)\\s+(?P<message>.*)" |
| 3 | |
| 4 | rewrite: |
| 5 | # Test stop=yes behavior (default) |
| 6 | - key: LEVEL |
| 7 | match: "ERROR" |
| 8 | value: "CRITICAL" |
| 9 | # stop: yes is default |
| 10 | |
| 11 | - key: LEVEL |
| 12 | match: ".*" |
| 13 | value: "SHOULD_NOT_APPLY" # This should not apply because previous rule stopped |
| 14 | |
| 15 | # Test stop=no behavior |
| 16 | - key: CODE |
| 17 | match: "(\\d+)" |
| 18 | value: "CODE_${1}" |
| 19 | stop: no |
| 20 | |
| 21 | - key: CODE |
| 22 | match: "CODE_(\\d+)" |
| 23 | value: "FORMATTED_${1}" |
| 24 | # This should apply because previous rule didn't stop |
| 25 | |
| 26 | # Test injection with rewrite |
| 27 | - key: SEVERITY_SCORE |
| 28 | value: "1" |
| 29 | inject: yes |
| 30 | stop: no |
| 31 | |
| 32 | - key: SEVERITY_SCORE |
| 33 | match: "1" |
| 34 | value: "2" |
| 35 | stop: no |
| 36 | |
| 37 | - key: SEVERITY_SCORE |
| 38 | match: "2" |
| 39 | value: "3" |
| 40 | # Final value should be 3 |