Merge pull request #3014 from fluent/parser_syslog-support-conigured-…

…time_format-3164 parser_syslog: Support configured time_format for rfc3164 string parser
fluent · Jun 1, 2020 · 35c8245 · 35c8245
2 parents 190d06f + c5b1ed0
commit 35c8245
Show file tree

Hide file tree

Showing 2 changed files with 36 additions and 15 deletions.
diff --git a/lib/fluent/plugin/parser_syslog.rb b/lib/fluent/plugin/parser_syslog.rb
@@ -65,6 +65,7 @@ def initialize
         @mutex = Mutex.new
         @space_count = nil
         @space_count_rfc5424 = nil
+        @skip_space_count = false
       end
 
       def configure(conf)
@@ -106,6 +107,10 @@ class << self
         @space_count_rfc5424 = @rfc5424_time_format.squeeze(' ').count(' ') + 1
         @time_parser = time_parser_create
         @time_parser_rfc5424_without_subseconds = time_parser_create(format: "%Y-%m-%dT%H:%M:%S%z")
+
+        if ['%b %d %H:%M:%S', '%b %d %H:%M:%S.%N'].include?(@time_format)
+          @skip_space_count = true
+        end
       end
 
       # this method is for tests
@@ -264,20 +269,35 @@ def parse_rfc3164(text, &block)
           end
         end
 
-        # header part
-        time_size = 15 # skip Mmm dd hh:mm:ss
-        time_end = text[cursor + time_size]
-        if time_end == SPLIT_CHAR
-          time_str = text.slice(cursor, time_size)
-          cursor += 16 # time + ' '
-        elsif time_end == '.'.freeze
-          # support subsecond time
-          i = text.index(SPLIT_CHAR, time_size)
-          time_str = text.slice(cursor, i - cursor)
-          cursor = i + 1
+        if @skip_space_count
+          # header part
+          time_size = 15 # skip Mmm dd hh:mm:ss
+          time_end = text[cursor + time_size]
+          if time_end == SPLIT_CHAR
+            time_str = text.slice(cursor, time_size)
+            cursor += 16 # time + ' '
+          elsif time_end == '.'.freeze
+            # support subsecond time
+            i = text.index(SPLIT_CHAR, time_size)
+            time_str = text.slice(cursor, i - cursor)
+            cursor = i + 1
+          else
+            yield nil, nil
+            return
+          end
         else
-          yield nil, nil
-          return
+          i = cursor - 1
+          sq = false
+          @space_count.times do
+            while text[i + 1] == ' '.freeze
+              sq = true
+              i += 1
+            end
+            i = text.index(' '.freeze, i + 1)
+          end
+
+          time_str = sq ? text.slice(idx, i - cursor).squeeze(' '.freeze) : text.slice(cursor, i - cursor)
+          cursor = i + 1
         end
 
         i = text.index(SPLIT_CHAR, cursor)

diff --git a/test/plugin/test_parser_syslog.rb b/test/plugin/test_parser_syslog.rb
@@ -35,8 +35,9 @@ def test_parse_with_time_format(param)
     assert_equal('%b %d %M:%S:%H', @parser.instance.patterns['time_format'])
   end
 
-  def test_parse_with_time_format2
-    @parser.configure('time_format' => '%Y-%m-%dT%H:%M:%SZ')
+  data('regexp' => 'regexp', 'string' => 'string')
+  def test_parse_with_time_format2(param)
+    @parser.configure('time_format' => '%Y-%m-%dT%H:%M:%SZ', 'parser_type' => param)
     @parser.instance.parse('2020-03-03T10:14:29Z 192.168.0.1 fluentd[11111]: [error] Syslog test') { |time, record|
       assert_equal(event_time('Mar 03 10:14:29', format: '%b %d %H:%M:%S'), time)
       assert_equal(@expected, record)