Modify test so it doesn't pick up real user events

elastic · May 5, 2020 · 03008d0 · 03008d0
1 parent e9eb7d0
commit 03008d0
Showing 1 changed file with 7 additions and 4 deletions.
diff --git a/x-pack/auditbeat/module/system/user/user_test.go b/x-pack/auditbeat/module/system/user/user_test.go
@@ -38,10 +38,13 @@ func TestData(t *testing.T) {
 	}
 
 	for _, e := range events {
-		if name, _ := e.RootFields.GetValue("user.name"); name == "elastic" {
+		if name, _ := e.RootFields.GetValue("user.name"); name == "__elastic" {
 			relatedNames, err := e.RootFields.GetValue("related.user")
 			require.NoError(t, err)
-			require.Equal(t, []string{"elastic"}, relatedNames)
+			require.Equal(t, []string{"__elastic"}, relatedNames)
+			groupName, err := e.RootFields.GetValue("user.group.name")
+			require.NoError(t, err)
+			require.Equal(t, "__elastic", groupName)
 			groupID, err := e.RootFields.GetValue("user.group.id")
 			require.NoError(t, err)
 			require.Equal(t, "1001", groupID)
@@ -56,13 +59,13 @@ func TestData(t *testing.T) {
 
 func testUser() *User {
 	return &User{
-		Name: "elastic",
+		Name: "__elastic",
 		UID:  "9999",
 		GID:  "1001",
 		Groups: []*user.Group{
 			&user.Group{
 				Gid:  "1001",
-				Name: "elastic",
+				Name: "__elastic",
 			},
 			&user.Group{
 				Gid:  "1002",