rspec fails, but same in grok debugger works (tried on both 1.2.1 & 1.1.13)

Ok, so the quoting mistake came from https://github.com/logstash/logstash/wiki/Testing-your-filters

I've fixed this, and it now works. I also fixed up the wiki page.

Cheers, M.

PS. Script continues at

I believe what Philippe has suggested for two fixes (using %q() and using 'tags' instead) is correct.

It is also important to note that the 'tags' field may not be present, if you expect that one tag not to be present in this simple example, you should insist { subject["tags"] }.nil?

1. I had a look in other logstash tests, since 1.2.x the event is not created with an empty tags arrays, so you should change your line

simply to

2. I had a similar issue in the past with grok test containing escaped characters, you should either double-escape them or use the %q{} syntax

http://en.wikibooks.org/wiki/Ruby_Programming/Syntax/Literals#The_.25_Notation

You should not be able to run the same script on both version as, starting with 1.2.x, @tags has been changed to simply tags.
That would explain the nil, at least for the 1.2.1 version

PS. I tend to run like this:

including the sed makes the yaml output semi-visible across lines. If there is a better way please let me know!