---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
---
Messages structure finder with JSON messages:
- do:
    text_structure.find_message_structure:
      timeout: "10s"
      body:
        messages:
        - "{\"airline\": \"AAL\", \"responsetime\": 132.2046, \"sourcetype\": \"text-structure-test\"\
          , \"time\": 1403481600}"
        - "{\"airline\": \"JZA\", \"responsetime\": 990.4628, \"sourcetype\": \"text-structure-test\"\
          , \"time\": 1403481700}"
        - "{\"airline\": \"AAL\", \"responsetime\": 134.2046, \"sourcetype\": \"text-structure-test\"\
          , \"time\": 1403481800}"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    num_lines_analyzed: 3
- match:
    num_messages_analyzed: 3
- match:
    charset: "UTF-8"
- match:
    has_byte_order_marker: null
- match:
    format: "ndjson"
- match:
    timestamp_field: "time"
- match:
    joda_timestamp_formats.0: "UNIX"
- match:
    java_timestamp_formats.0: "UNIX"
- match:
    need_client_timezone: false
- match:
    mappings.properties.airline.type: "keyword"
- match:
    mappings.properties.responsetime.type: "double"
- match:
    mappings.properties.sourcetype.type: "keyword"
- match:
    mappings.properties.time.type: "date"
- match:
    mappings.properties.time.format: "epoch_second"
- match:
    ingest_pipeline.description: "Ingest pipeline created by text structure finder"
- match:
    ingest_pipeline.processors.0.date.field: "time"
- match:
    ingest_pipeline.processors.0.date.formats.0: "UNIX"
- match:
    field_stats.airline.count: 3
- match:
    field_stats.airline.cardinality: 2
- match:
    field_stats.responsetime.count: 3
- match:
    field_stats.responsetime.cardinality: 3
- match:
    field_stats.responsetime.min_value: 132.2046
- match:
    field_stats.responsetime.max_value: 990.4628
- match:
    field_stats.responsetime.median_value: 134.2046
- match:
    field_stats.sourcetype.count: 3
- match:
    field_stats.sourcetype.cardinality: 1
- match:
    field_stats.time.count: 3
- match:
    field_stats.time.cardinality: 3
- match:
    field_stats.time.earliest: "1403481600"
- match:
    field_stats.time.latest: "1403481800"
- is_false: "explanation"
---
Messages structure finder with log messages:
- do:
    text_structure.find_message_structure:
      timeout: "10s"
      body:
        messages:
        - "2019-05-16 16:56:14 line 1 abcdefghijklmnopqrstuvwxyz"
        - "2019-05-16 16:56:14 line 2 abcdefghijklmnopqrstuvwxyz\ncontinuation...\n\
          continuation...\n"
        - "2019-05-16 16:56:14 line 3 abcdefghijklmnopqrstuvwxyz"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    num_lines_analyzed: 3
- match:
    num_messages_analyzed: 3
- match:
    format: "semi_structured_text"
- match:
    grok_pattern: "%{TIMESTAMP_ISO8601:timestamp} .*? %{INT:field} .*"
