Ldong/syslog4j-graylog2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix parsing of ISO timestamps without milliseconds. (syslog-ng default)

Browse Source 
This fixes parsing of structured syslog messages sent by syslog-ng.
This commit is contained in:
Bernd Ahlers 2014-10-21 20:48:16 +02:00
parent 3ce15eef4b
commit 3f4040f69d
2 changed files with 36 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/main/java/org/graylog2/syslog4j/server/impl/event/structured/StructuredSyslogServerEvent.java
View File

@ -1,13 +1,13 @@
package org.graylog2.syslog4j.server.impl.event.structured; package org.graylog2.syslog4j.server.impl.event.structured;
import java.net.InetAddress;
import org.joda.time.DateTime;
import org.joda.time.format.DateTimeFormatter;
import org.joda.time.format.ISODateTimeFormat;
import org.graylog2.syslog4j.SyslogConstants; import org.graylog2.syslog4j.SyslogConstants;
import org.graylog2.syslog4j.impl.message.structured.StructuredSyslogMessage; import org.graylog2.syslog4j.impl.message.structured.StructuredSyslogMessage;
import org.graylog2.syslog4j.server.impl.event.SyslogServerEvent; import org.graylog2.syslog4j.server.impl.event.SyslogServerEvent;
import org.joda.time.DateTime;
import org.joda.time.format.DateTimeFormatter;
import org.joda.time.format.ISODateTimeFormat;
import java.net.InetAddress;
/** /**
* SyslogServerStructuredEvent provides an implementation of the * SyslogServerStructuredEvent provides an implementation of the
@ -51,7 +51,7 @@ public class StructuredSyslogServerEvent extends SyslogServerEvent {
public DateTimeFormatter getDateTimeFormatter() { public DateTimeFormatter getDateTimeFormatter() {
if (dateTimeFormatter == null) { if (dateTimeFormatter == null) {
this.dateTimeFormatter = ISODateTimeFormat.dateTime(); this.dateTimeFormatter = ISODateTimeFormat.dateTimeParser();
} }
return dateTimeFormatter; return dateTimeFormatter;

30
src/test/java/org/graylog2/syslog4j/server/impl/event/structured/StructuredSyslogServerEventTest.java
View File

@ -138,4 +138,34 @@ public class StructuredSyslogServerEventTest {
assertEquals(event.getStructuredMessage().getMessageId(), null); assertEquals(event.getStructuredMessage().getMessageId(), null);
assertEquals(event.getStructuredMessage().getMessage(), "syslog-ng starting up; version='3.5.3'"); assertEquals(event.getStructuredMessage().getMessage(), "syslog-ng starting up; version='3.5.3'");
} }
@Test
public void testStructuredSyslogNgNoMillisecTimestamp() throws Exception {
// Message from: syslog-ng-core 3.5.3-1 package in Ubuntu 14.04 (default config)
final String message = "<45>1 2014-10-21T10:21:09+00:00 c4dc57ba1ebb syslog-ng 7120 - [meta sequenceId=\"1\"] syslog-ng starting up; version='3.5.3'";
final StructuredSyslogServerEvent event = buildEvent(message);
Map<String, Object> structuredData = new HashMap<String, Object>() {
{
put("meta", new HashMap<String, String>() {
{
put("sequenceId", "1");
}
});
}
};
assertEquals(event.getApplicationName(), "syslog-ng");
assertEquals(event.getDateTime(), new DateTime("2014-10-21T10:21:09.000Z"));
assertEquals(event.getFacility(), 5);
assertEquals(event.getHost(), "c4dc57ba1ebb");
assertEquals(event.getLevel(), 5);
assertEquals(event.getMessage(), "- [meta sequenceId=\"1\"] syslog-ng starting up; version='3.5.3'");
assertEquals(event.getProcessId(), "7120");
assertEquals(event.getStructuredMessage().getStructuredData(), structuredData);
assertEquals(event.getStructuredMessage().getMessageId(), null);
assertEquals(event.getStructuredMessage().getMessage(), "syslog-ng starting up; version='3.5.3'");
}
} }