BasicFireEyeParser extends BasicParser { @Override @SuppressWarnings("unchecked") public List<JSONObject> parse(byte[] rawMessage) { String toParse; List<JSONObject> messages = new ArrayList<>(); try { toParse = new String(rawMessage, getReadCharset()); Matcher m = syslogPriorityPattern.matcher(toParse); String delimiter = ""; while (m.find()) { delimiter = m.group(); } if (!StringUtils.isBlank(delimiter)) { String[] tokens = toParse.split(delimiter); if (tokens.length > 1) { toParse = delimiter + tokens[1]; } } JSONObject toReturn = parseMessage(toParse); toReturn.put("timestamp", getTimeStamp(toParse)); messages.add(toReturn); return messages; } catch (Exception e) { String message = "Unable to parse " + new String(rawMessage, StandardCharsets.UTF_8) + ": " + e.getMessage(); LOG.error(message, e); throw new IllegalStateException(message, e); } }  @Override void configure(Map<String, Object> parserConfig); @Override void init(); @Override @SuppressWarnings("unchecked") List<JSONObject> parse(byte[] rawMessage);  }
@SuppressWarnings({"rawtypes"}) @Test public void testParse() throws ParseException { for (String inputString : inputStrings) { JSONObject parsed = parser.parse(inputString.getBytes(StandardCharsets.UTF_8)).get(0); assertNotNull(parsed); JSONParser parser = new JSONParser(); Map json = (Map) parser.parse(parsed.toJSONString()); assertNotNull(json); assertFalse(json.isEmpty()); for (Object o : json.entrySet()) { Entry entry = (Entry) o; String key = (String) entry.getKey(); String value = json.get(key).toString(); assertNotNull(value); } } }
@SuppressWarnings("rawtypes") @Test public void testTimestampParsing() throws ParseException { JSONObject parsed = parser.parse(fireeyeMessage.getBytes(StandardCharsets.UTF_8)).get(0); JSONParser parser = new JSONParser(); Map json = (Map) parser.parse(parsed.toJSONString()); long expectedTimestamp = ZonedDateTime.of(Year.now(ZoneOffset.UTC).getValue(), 3, 19, 5, 24, 39, 0, ZoneOffset.UTC).toInstant().toEpochMilli(); assertEquals(expectedTimestamp, json.get("timestamp")); }