From 3f4040f69d98aed3984a364ca6e072ff3e44d33f Mon Sep 17 00:00:00 2001
From: Bernd Ahlers <bernd@torch.sh>
Date: Tue, 21 Oct 2014 20:48:16 +0200
Subject: [PATCH] Fix parsing of ISO timestamps without milliseconds.
 (syslog-ng default)

This fixes parsing of structured syslog messages sent by syslog-ng.
---
 .../StructuredSyslogServerEvent.java          | 12 ++++----
 .../StructuredSyslogServerEventTest.java      | 30 +++++++++++++++++++
 2 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/src/main/java/org/graylog2/syslog4j/server/impl/event/structured/StructuredSyslogServerEvent.java b/src/main/java/org/graylog2/syslog4j/server/impl/event/structured/StructuredSyslogServerEvent.java
index 9f9acdd..6bca356 100644
--- a/src/main/java/org/graylog2/syslog4j/server/impl/event/structured/StructuredSyslogServerEvent.java
+++ b/src/main/java/org/graylog2/syslog4j/server/impl/event/structured/StructuredSyslogServerEvent.java
@@ -1,13 +1,13 @@
 package org.graylog2.syslog4j.server.impl.event.structured;
 
-import java.net.InetAddress;
-
-import org.joda.time.DateTime;
-import org.joda.time.format.DateTimeFormatter;
-import org.joda.time.format.ISODateTimeFormat;
 import org.graylog2.syslog4j.SyslogConstants;
 import org.graylog2.syslog4j.impl.message.structured.StructuredSyslogMessage;
 import org.graylog2.syslog4j.server.impl.event.SyslogServerEvent;
+import org.joda.time.DateTime;
+import org.joda.time.format.DateTimeFormatter;
+import org.joda.time.format.ISODateTimeFormat;
+
+import java.net.InetAddress;
 
 /**
  * SyslogServerStructuredEvent provides an implementation of the
@@ -51,7 +51,7 @@ public class StructuredSyslogServerEvent extends SyslogServerEvent {
 
     public DateTimeFormatter getDateTimeFormatter() {
         if (dateTimeFormatter == null) {
-            this.dateTimeFormatter = ISODateTimeFormat.dateTime();
+            this.dateTimeFormatter = ISODateTimeFormat.dateTimeParser();
         }
 
         return dateTimeFormatter;
diff --git a/src/test/java/org/graylog2/syslog4j/server/impl/event/structured/StructuredSyslogServerEventTest.java b/src/test/java/org/graylog2/syslog4j/server/impl/event/structured/StructuredSyslogServerEventTest.java
index a8374d8..955c2e2 100644
--- a/src/test/java/org/graylog2/syslog4j/server/impl/event/structured/StructuredSyslogServerEventTest.java
+++ b/src/test/java/org/graylog2/syslog4j/server/impl/event/structured/StructuredSyslogServerEventTest.java
@@ -138,4 +138,34 @@ public class StructuredSyslogServerEventTest {
         assertEquals(event.getStructuredMessage().getMessageId(), null);
         assertEquals(event.getStructuredMessage().getMessage(), "syslog-ng starting up; version='3.5.3'");
     }
+
+    @Test
+    public void testStructuredSyslogNgNoMillisecTimestamp() throws Exception {
+        // Message from: syslog-ng-core 3.5.3-1 package in Ubuntu 14.04 (default config)
+        final String message = "<45>1 2014-10-21T10:21:09+00:00 c4dc57ba1ebb syslog-ng 7120 - [meta sequenceId=\"1\"] syslog-ng starting up; version='3.5.3'";
+
+        final StructuredSyslogServerEvent event = buildEvent(message);
+
+        Map<String, Object> structuredData = new HashMap<String, Object>() {
+            {
+                put("meta", new HashMap<String, String>() {
+                    {
+                        put("sequenceId", "1");
+                    }
+                });
+            }
+        };
+
+        assertEquals(event.getApplicationName(), "syslog-ng");
+        assertEquals(event.getDateTime(), new DateTime("2014-10-21T10:21:09.000Z"));
+        assertEquals(event.getFacility(), 5);
+        assertEquals(event.getHost(), "c4dc57ba1ebb");
+        assertEquals(event.getLevel(), 5);
+        assertEquals(event.getMessage(), "- [meta sequenceId=\"1\"] syslog-ng starting up; version='3.5.3'");
+        assertEquals(event.getProcessId(), "7120");
+
+        assertEquals(event.getStructuredMessage().getStructuredData(), structuredData);
+        assertEquals(event.getStructuredMessage().getMessageId(), null);
+        assertEquals(event.getStructuredMessage().getMessage(), "syslog-ng starting up; version='3.5.3'");
+    }
 }
\ No newline at end of file