syslogparser
syslogparser copied to clipboard
Update rfc3164 to accept custom timestamp formats.
This is in violation of the RFC itself, but allows syslogparser to parse output from Golang’s own log/syslog package.
My goal is to parse the output from the go stdlib log/syslog
package. It outputs syslog message with timestamps in time.RFC3339 when sending to a remote destination.
Go's time.RFC3339
is a timestamp format whose length does not necessarily match the length of the content matched, because the timestamp format string includes a timezone offset component. This offset is omitted in the case of UTC, which causes the length of the output to be shorter (by 5 characters) than output for other timezones.
AFAICT, this violates the assumptions of the rfc3164.Parser.parseTimestamp()
function, and it would complicate the internals to support timestamp formats whose length does not match the length of the content matched.
@jeromer, do you have any thoughts about how this might be accomplished (using syslogparser
)?
In my case I'm receiving messages with timestamps only in UTC, so my approach today is to use a timestamp format with the optional timezone offset omitted. However, I'd rather not worry about the day I start seeing messages with mixed timezones :smile:. Specifically, I'm using "2006-01-02T15:04:05Z" instead of "2006-01-02T15:04:05Z07:00", which is the value of time.RFC3339
. See this playground for more details.