Works in production, but fails this rspec test.

parse-dropwizard-log.rb

require "test_utils"

describe "dropwizard java logs", :if => RUBY_ENGINE == "jruby" do
    extend LogStash::RSpec
    
    config <<-CONFIG
        filter {
            grok {
                match => [ "message", "%{LOGLEVEL:loglevel}  \[%{TIMESTAMP_ISO8601:logdate}\] %{JAVACLASS:class}:" ]
            }
            date {
                match => ["logdate", "yyyy-MM-dd HH:mm:ss,SSS"]
            }
        }
    CONFIG

    sample "INFO  [2013-09-19 17:43:05,508] com.yammer.metrics.reporting.GraphiteReporter: Error writing to Graphite: 127.0.0.1." do
        # Require that grok does not fail to parse this event.
        insist { subject["tags"] }.nil?

        # Ensure that grok captures certain expected fields.
        insist { subject }.include?("loglevel")
        insist { subject }.include?("logdate")
        insist { subject }.include?("class")

        # Ensure that the fields match expected values.
        insist { subject["loglevel"] } == "INFO"
        insist { subject["logdate"] } == "2013-09-19 17:43:05,508"
        insist { subject["class"] } == "com.yammer.metrics.reporting.GraphiteReporter"
    end
end

This test doesn't pass because Ruby interprets [ as just [, so it can by fixed by either replacing it with \[ or changing:

config <<-CONFIG
    ...
CONFIG

to:

config %q(
    ...
)