syslogparser icon indicating copy to clipboard operation
syslogparser copied to clipboard

Update rfc3164 to accept custom timestamp formats.

Open emmanuel opened this issue 10 years ago • 1 comments

This is in violation of the RFC itself, but allows syslogparser to parse output from Golang’s own log/syslog package.

emmanuel avatar Dec 20 '14 01:12 emmanuel

My goal is to parse the output from the go stdlib log/syslog package. It outputs syslog message with timestamps in time.RFC3339 when sending to a remote destination.

Go's time.RFC3339 is a timestamp format whose length does not necessarily match the length of the content matched, because the timestamp format string includes a timezone offset component. This offset is omitted in the case of UTC, which causes the length of the output to be shorter (by 5 characters) than output for other timezones.

AFAICT, this violates the assumptions of the rfc3164.Parser.parseTimestamp() function, and it would complicate the internals to support timestamp formats whose length does not match the length of the content matched.

@jeromer, do you have any thoughts about how this might be accomplished (using syslogparser)?

In my case I'm receiving messages with timestamps only in UTC, so my approach today is to use a timestamp format with the optional timezone offset omitted. However, I'd rather not worry about the day I start seeing messages with mixed timezones :smile:. Specifically, I'm using "2006-01-02T15:04:05Z" instead of "2006-01-02T15:04:05Z07:00", which is the value of time.RFC3339. See this playground for more details.

emmanuel avatar Dec 20 '14 06:12 emmanuel