diff --git a/src/main/java/org/graylog2/syslog4j/server/impl/event/SyslogServerEvent.java b/src/main/java/org/graylog2/syslog4j/server/impl/event/SyslogServerEvent.java index 3c38e1c..2c74fb5 100644 --- a/src/main/java/org/graylog2/syslog4j/server/impl/event/SyslogServerEvent.java +++ b/src/main/java/org/graylog2/syslog4j/server/impl/event/SyslogServerEvent.java @@ -3,6 +3,7 @@ package org.graylog2.syslog4j.server.impl.event; import org.graylog2.syslog4j.SyslogConstants; import org.graylog2.syslog4j.server.SyslogServerEventIF; import org.graylog2.syslog4j.util.SyslogUtility; +import org.joda.time.DateTime; import java.net.InetAddress; import java.text.DateFormat; @@ -80,6 +81,7 @@ public class SyslogServerEvent implements SyslogServerEventIF { protected void parseDate() { int datelength = 16; String dateFormatS = DATE_FORMAT; + boolean isDate8601 = false; if (this.message.length() > datelength) { @@ -89,12 +91,22 @@ public class SyslogServerEvent implements SyslogServerEventIF { dateFormatS = DATE_FORMAT_S; } - String year = Integer.toString(Calendar.getInstance().get(Calendar.YEAR)); + if (Character.isDigit(this.message.charAt(0))) { + datelength = this.message.indexOf(' ') + 1; + isDate8601 = true; + } + + String year = Integer.toString(Calendar.getInstance().get(Calendar.YEAR)); + String originalDate = this.message.substring(0, datelength - 1); + String modifiedDate = originalDate + " " + year; - String originalDate = this.message.substring(0, datelength - 1) + " " + year; DateFormat dateFormat = new SimpleDateFormat(dateFormatS, Locale.ENGLISH); try { - this.date = dateFormat.parse(originalDate); + if (!isDate8601) { + this.date = dateFormat.parse(modifiedDate); + } else { + this.date = DateTime.parse(originalDate).toDate(); + } this.message = this.message.substring(datelength); diff --git a/src/test/java/org/graylog2/syslog4j/server/impl/event/SyslogServerEventTest.java b/src/test/java/org/graylog2/syslog4j/server/impl/event/SyslogServerEventTest.java index 3fa2dcb..92f9e86 100644 --- a/src/test/java/org/graylog2/syslog4j/server/impl/event/SyslogServerEventTest.java +++ b/src/test/java/org/graylog2/syslog4j/server/impl/event/SyslogServerEventTest.java @@ -1,6 +1,7 @@ package org.graylog2.syslog4j.server.impl.event; import org.joda.time.DateTime; +import org.joda.time.DateTimeZone; import org.junit.Test; import java.net.InetAddress; @@ -165,4 +166,17 @@ public class SyslogServerEventTest { assertEquals("mymachine su[123]: 'su root' failed for lonvick on /dev/pts/8", event.getMessage()); } + @Test + public void testIssue16() throws Exception { + // Message from: https://github.com/Graylog2/syslog4j-graylog2/issues/16 + final String message = "<6>2016-10-12T14:10:18Z hostname testmsg[20]: Test"; + + final SyslogServerEvent event = buildEvent(message); + + assertEquals(new DateTime(2016, 10, 12, 14, 10, 18, DateTimeZone.UTC).toDate(), event.getDate()); + assertEquals(0, event.getFacility()); + assertEquals("hostname", event.getHost()); + assertEquals(6, event.getLevel()); + assertEquals("hostname testmsg[20]: Test", event.getMessage()); + } } \ No newline at end of file