(defn ogstream
      [index]
      (sdo (tag "ohboy")
           (tap :sshalert index)
           (where (and (tagged "ssh")
                       (tagged "slack_alert")))))

(tests
  (deftest ssh-test
    (let [result (inject! [(riemann.config/ogstream :foo)]
                      [{:host "ssh_server"
                        :tags '("ssh" "slack_alert")
                        :rsa_pub "ac:eb:3d"
                        :username "manuel"}])]
      (is (= (:sshalert result) [{:host "ssh_server"
                                  :tags ["ssh" "slack_alert"]
                                  :rsa_pub "ac:eb:3d"
                                  :username "manuel"}]))
    )
  )
)