From 72f66522a0e35e89bd43e7dc824233bb8ab91edc Mon Sep 17 00:00:00 2001 From: Derek Date: Mon, 16 Nov 2026 05:22:14 +1100 Subject: [PATCH] fix(tests): add a Cisco Meraki ip_flow_end filebeat case The synthetic cases covered ip_flow_start but not ip_flow_end, so nothing tested the flow-end branch of the Meraki parser. The new case sends a UDP flow-end line and checks the event type, protocol and both ports. --- tests/fixtures/filebeat/cases.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/tests/fixtures/filebeat/cases.yaml b/tests/fixtures/filebeat/cases.yaml index f7d6eee..78b9ee7 100644 --- a/tests/fixtures/filebeat/cases.yaml +++ b/tests/fixtures/filebeat/cases.yaml @@ -665,6 +665,22 @@ ip: 198.51.100.48 port: 443 +- name: meraki-ip-flow-end + module: meraki + conf: {"tz_offset": "UTC"} + line: |- + <134>1 1772000031.900000010 MX100 ip_flow_end src=192.0.2.16 dst=198.51.100.52 protocol=udp sport=51000 dport=53 translated_src_ip=203.0.113.3 translated_port=51000 + expect: + cisco_meraki: + event_type: ip_flow_end + network: + protocol: udp + source: + port: 51000 + destination: + ip: 198.51.100.52 + port: 53 + - name: meraki-security-ids module: meraki conf: {"tz_offset": "UTC"}