class_docstr: Test class for JSONParser
class_docstr_tok: ["Test","class","for","JSONParser"]
docstr: JSONParser - CloudWatch JSON with envelope keys
docstr_tok: ["JSONParser","-","CloudWatch","JSON","with","envelope","keys"]
code: def test_cloudwatch(self):
      """JSONParser - CloudWatch JSON with envelope keys"""
      options = {
          "schema": {
              "account": "integer",
              "action": "string",
              "bytes": "integer",
              "destination": "string",
              "destport": "integer",
              "eni": "string",
              "flowlogstatus": "string",
              "packets": "integer",
              "protocol": "integer",
              "source": "string",
              "srcport": "integer",
              "version": "integer",
              "windowend": "integer",
              "windowstart": "integer",
          },
          "configuration": {
              "json_path": "logEvents[*].extractedFields",
              "envelope_keys": {
                  "logGroup": "string",
                  "logStream": "string",
                  "owner": "integer",
              },
          },
      }
  
      record_data = json.dumps(
          {
              "logEvents": [
                  {
                      "extractedFields": {
                          "account": "123456789012",
                          "action": "REJECT",
                          "bytes": "240",
                          "destination": "172.31.12.209",
                          "destport": "80",
                          "eni": "eni-77ccbe24",
                          "flowlogstatus": "OK",
                          "packets": "4",
                          "protocol": "6",
                          "source": "172.31.1.54",
                          "srcport": "27974",
                          "version": "2",
                          "windowend": "1488216389",
                          "windowstart": "1488216331",
                      },
                      "id": "33188333197923110564639124232124531540364522455662723073",
                      "message": (
                          "2 123456789012 eni-77ccbe24 172.31.1.54 172.31.12.209 "
                          "27974 80 6 4 240 1488216331 1488216389 REJECT OK"
                      ),
                      "timestamp": 1488216331000,
                  },
                  {
                      "extractedFields": {
                          "account": "123456789012",
                          "action": "REJECT",
                          "bytes": "240",
                          "destination": "172.31.12.209",
                          "destport": "80",
                          "eni": "eni-77ccbe24",
                          "flowlogstatus": "OK",
                          "packets": "4",
                          "protocol": "6",
                          "source": "172.31.39.106",
                          "srcport": "22598",
                          "version": "2",
                          "windowend": "1488216389",
                          "windowstart": "1488216331",
                      },
                      "id": "33188333197923110564639124232124531540364522455662723074",
                      "message": (
                          "2 123456789012 eni-77ccbe24 172.31.39.106 172.31.12.209 "
                          "22598 80 6 4 240 1488216331 1488216389 REJECT OK"
                      ),
                      "timestamp": 1488216331000,
                  },
              ],
              "logGroup": "airdev_prod_streamalert_flow_logs",
              "logStream": "eni-77ccbe24-all",
              "messageType": "DATA_MESSAGE",
              "owner": "123456789012",
              "subscriptionFilters": [
                  "airdev_prod_streamalert_flow_logs_to_lambda"
              ],
          }
      )
  
      # get parsed data
      parser = JSONParser(options)
      assert_equal(parser.parse(record_data), True)
  
      expected_result = [
          {
              "account": 123456789012,
              "action": "REJECT",
              "bytes": 240,
              "destination": "172.31.12.209",
              "destport": 80,
              "eni": "eni-77ccbe24",
              "flowlogstatus": "OK",
              "packets": 4,
              "protocol": 6,
              "source": "172.31.1.54",
              "srcport": 27974,
              "version": 2,
              "windowend": 1488216389,
              "windowstart": 1488216331,
              "streamalert:envelope_keys": {
                  "logGroup": "airdev_prod_streamalert_flow_logs",
                  "logStream": "eni-77ccbe24-all",
                  "owner": 123456789012,
              },
          },
          {
              "account": 123456789012,
              "action": "REJECT",
              "bytes": 240,
              "destination": "172.31.12.209",
              "destport": 80,
              "eni": "eni-77ccbe24",
              "flowlogstatus": "OK",
              "packets": 4,
              "protocol": 6,
              "source": "172.31.39.106",
              "srcport": 22598,
              "version": 2,
              "windowend": 1488216389,
              "windowstart": 1488216331,
              "streamalert:envelope_keys": {
                  "logGroup": "airdev_prod_streamalert_flow_logs",
                  "logStream": "eni-77ccbe24-all",
                  "owner": 123456789012,
              },
          },
      ]
      assert_equal(parser.parsed_records, expected_result)
  
imports: import json
  from mock import patch
  from nose.tools import assert_equal
  from streamalert.classifier.parsers import JSONParser
label_desc: Use image node_id 22 for calling the TestJSONParser obj's underlying member method code with example usage: obj.test_cloudwatch() without return types