@Test public void testMessageParsing() { SyslogParser parser = new SyslogParser(); Charset charset = Charsets.UTF_8; List<String> messages = Lists.newArrayList(); messages.add("<34>Oct 11 22:14:15 mymachine su: 'su root' failed for " + "lonvick on /dev/pts/8"); messages.add("<13>Feb 5 17:32:18 10.0.0.99 Use the BFG!"); messages.add("<165>Aug 24 05:34:00 CST 1987 mymachine myproc[10]: %% " + "It's time to make the do-nuts. %% Ingredients: Mix=OK, Jelly=OK # " + "Devices: Mixer=OK, Jelly_Injector=OK, Frier=OK # Transport: " + "Conveyer1=OK, Conveyer2=OK # %%"); messages.add("<0>Oct 22 10:52:12 scapegoat 1990 Oct 22 10:52:01 TZ-6 " + "scapegoat.dmz.example.org 10.1.2.3 sched[0]: That's All Folks!"); messages.add("<34>1 2003-10-11T22:14:15.003Z mymachine.example.com su - " + "ID47 - BOM'su root' failed for lonvick on /dev/pts/8"); messages.add("<165>1 2003-08-24T05:14:15.000003-07:00 192.0.2.1 myproc " + "8710 - - %% It's time to make the do-nuts."); messages.add("<13>2003-08-24T05:14:15Z localhost snarf?"); messages.add("<13>2012-08-16T14:34:03-08:00 127.0.0.1 test shnap!"); for (String msg : messages) { Event event = parser.parseMessage(msg, charset); Assert.assertNull("Failure to parse known-good syslog message", event.getHeaders().get(SyslogUtils.EVENT_STATUS)); } }
public Event parseMessage(String msg, Charset charset) { Map<String, String> headers = Maps.newHashMap(); int msgLen = msg.length(); int curPos = 0; Preconditions.checkArgument(msg.charAt(curPos) == '<', "Bad format: invalid priority: cannot find open bracket '<' (%s)", msg); int endBracketPos = msg.indexOf('>'); Preconditions.checkArgument(endBracketPos > 0 && endBracketPos <= 6, "Bad format: invalid priority: cannot find end bracket '>' (%s)", msg); String priority = msg.substring(1, endBracketPos); int pri = Integer.parseInt(priority); int facility = pri / 8; int severity = pri % 8; headers.put(SyslogUtils.SYSLOG_FACILITY, String.valueOf(facility)); headers.put(SyslogUtils.SYSLOG_SEVERITY, String.valueOf(severity)); Preconditions.checkArgument(msgLen > endBracketPos + 1, "Bad format: no data except priority (%s)", msg); curPos = endBracketPos + 1; if (msgLen > curPos + 2 && "1 ".equals(msg.substring(curPos, curPos + 2))) { curPos += 2; } long ts; char dateStartChar = msg.charAt(curPos); try { if (dateStartChar == '-') { ts = System.currentTimeMillis(); if (msgLen <= curPos + 2) { throw new IllegalArgumentException( "bad syslog format (missing hostname)"); } curPos += 2; } else if (dateStartChar >= 'A' && dateStartChar <= 'Z') { if (msgLen <= curPos + RFC3164_LEN) { throw new IllegalArgumentException("bad timestamp format"); } ts = parseRfc3164Time( msg.substring(curPos, curPos + RFC3164_LEN)); curPos += RFC3164_LEN + 1; } else { int nextSpace = msg.indexOf(' ', curPos); if (nextSpace == -1) { throw new IllegalArgumentException("bad timestamp format"); } ts = parseRfc5424Date(msg.substring(curPos, nextSpace)); curPos = nextSpace + 1; } } catch (IllegalArgumentException ex) { throw new IllegalArgumentException("Unable to parse message: " + msg, ex); } headers.put("timestamp", String.valueOf(ts)); int nextSpace = msg.indexOf(' ', curPos); if (nextSpace == -1) { throw new IllegalArgumentException( "bad syslog format (missing hostname)"); } String hostname = new String(msg.substring(curPos, nextSpace)); headers.put("host", hostname); String data = ""; if (msgLen > nextSpace + 1) { curPos = nextSpace + 1; data = msg.substring(curPos); } Event event = EventBuilder.withBody(data, charset, headers); return event; }
SyslogParser { public Event parseMessage(String msg, Charset charset) { Map<String, String> headers = Maps.newHashMap(); int msgLen = msg.length(); int curPos = 0; Preconditions.checkArgument(msg.charAt(curPos) == '<', "Bad format: invalid priority: cannot find open bracket '<' (%s)", msg); int endBracketPos = msg.indexOf('>'); Preconditions.checkArgument(endBracketPos > 0 && endBracketPos <= 6, "Bad format: invalid priority: cannot find end bracket '>' (%s)", msg); String priority = msg.substring(1, endBracketPos); int pri = Integer.parseInt(priority); int facility = pri / 8; int severity = pri % 8; headers.put(SyslogUtils.SYSLOG_FACILITY, String.valueOf(facility)); headers.put(SyslogUtils.SYSLOG_SEVERITY, String.valueOf(severity)); Preconditions.checkArgument(msgLen > endBracketPos + 1, "Bad format: no data except priority (%s)", msg); curPos = endBracketPos + 1; if (msgLen > curPos + 2 && "1 ".equals(msg.substring(curPos, curPos + 2))) { curPos += 2; } long ts; char dateStartChar = msg.charAt(curPos); try { if (dateStartChar == '-') { ts = System.currentTimeMillis(); if (msgLen <= curPos + 2) { throw new IllegalArgumentException( "bad syslog format (missing hostname)"); } curPos += 2; } else if (dateStartChar >= 'A' && dateStartChar <= 'Z') { if (msgLen <= curPos + RFC3164_LEN) { throw new IllegalArgumentException("bad timestamp format"); } ts = parseRfc3164Time( msg.substring(curPos, curPos + RFC3164_LEN)); curPos += RFC3164_LEN + 1; } else { int nextSpace = msg.indexOf(' ', curPos); if (nextSpace == -1) { throw new IllegalArgumentException("bad timestamp format"); } ts = parseRfc5424Date(msg.substring(curPos, nextSpace)); curPos = nextSpace + 1; } } catch (IllegalArgumentException ex) { throw new IllegalArgumentException("Unable to parse message: " + msg, ex); } headers.put("timestamp", String.valueOf(ts)); int nextSpace = msg.indexOf(' ', curPos); if (nextSpace == -1) { throw new IllegalArgumentException( "bad syslog format (missing hostname)"); } String hostname = new String(msg.substring(curPos, nextSpace)); headers.put("host", hostname); String data = ""; if (msgLen > nextSpace + 1) { curPos = nextSpace + 1; data = msg.substring(curPos); } Event event = EventBuilder.withBody(data, charset, headers); return event; } }
SyslogParser { public Event parseMessage(String msg, Charset charset) { Map<String, String> headers = Maps.newHashMap(); int msgLen = msg.length(); int curPos = 0; Preconditions.checkArgument(msg.charAt(curPos) == '<', "Bad format: invalid priority: cannot find open bracket '<' (%s)", msg); int endBracketPos = msg.indexOf('>'); Preconditions.checkArgument(endBracketPos > 0 && endBracketPos <= 6, "Bad format: invalid priority: cannot find end bracket '>' (%s)", msg); String priority = msg.substring(1, endBracketPos); int pri = Integer.parseInt(priority); int facility = pri / 8; int severity = pri % 8; headers.put(SyslogUtils.SYSLOG_FACILITY, String.valueOf(facility)); headers.put(SyslogUtils.SYSLOG_SEVERITY, String.valueOf(severity)); Preconditions.checkArgument(msgLen > endBracketPos + 1, "Bad format: no data except priority (%s)", msg); curPos = endBracketPos + 1; if (msgLen > curPos + 2 && "1 ".equals(msg.substring(curPos, curPos + 2))) { curPos += 2; } long ts; char dateStartChar = msg.charAt(curPos); try { if (dateStartChar == '-') { ts = System.currentTimeMillis(); if (msgLen <= curPos + 2) { throw new IllegalArgumentException( "bad syslog format (missing hostname)"); } curPos += 2; } else if (dateStartChar >= 'A' && dateStartChar <= 'Z') { if (msgLen <= curPos + RFC3164_LEN) { throw new IllegalArgumentException("bad timestamp format"); } ts = parseRfc3164Time( msg.substring(curPos, curPos + RFC3164_LEN)); curPos += RFC3164_LEN + 1; } else { int nextSpace = msg.indexOf(' ', curPos); if (nextSpace == -1) { throw new IllegalArgumentException("bad timestamp format"); } ts = parseRfc5424Date(msg.substring(curPos, nextSpace)); curPos = nextSpace + 1; } } catch (IllegalArgumentException ex) { throw new IllegalArgumentException("Unable to parse message: " + msg, ex); } headers.put("timestamp", String.valueOf(ts)); int nextSpace = msg.indexOf(' ', curPos); if (nextSpace == -1) { throw new IllegalArgumentException( "bad syslog format (missing hostname)"); } String hostname = new String(msg.substring(curPos, nextSpace)); headers.put("host", hostname); String data = ""; if (msgLen > nextSpace + 1) { curPos = nextSpace + 1; data = msg.substring(curPos); } Event event = EventBuilder.withBody(data, charset, headers); return event; } SyslogParser(); }
SyslogParser { public Event parseMessage(String msg, Charset charset) { Map<String, String> headers = Maps.newHashMap(); int msgLen = msg.length(); int curPos = 0; Preconditions.checkArgument(msg.charAt(curPos) == '<', "Bad format: invalid priority: cannot find open bracket '<' (%s)", msg); int endBracketPos = msg.indexOf('>'); Preconditions.checkArgument(endBracketPos > 0 && endBracketPos <= 6, "Bad format: invalid priority: cannot find end bracket '>' (%s)", msg); String priority = msg.substring(1, endBracketPos); int pri = Integer.parseInt(priority); int facility = pri / 8; int severity = pri % 8; headers.put(SyslogUtils.SYSLOG_FACILITY, String.valueOf(facility)); headers.put(SyslogUtils.SYSLOG_SEVERITY, String.valueOf(severity)); Preconditions.checkArgument(msgLen > endBracketPos + 1, "Bad format: no data except priority (%s)", msg); curPos = endBracketPos + 1; if (msgLen > curPos + 2 && "1 ".equals(msg.substring(curPos, curPos + 2))) { curPos += 2; } long ts; char dateStartChar = msg.charAt(curPos); try { if (dateStartChar == '-') { ts = System.currentTimeMillis(); if (msgLen <= curPos + 2) { throw new IllegalArgumentException( "bad syslog format (missing hostname)"); } curPos += 2; } else if (dateStartChar >= 'A' && dateStartChar <= 'Z') { if (msgLen <= curPos + RFC3164_LEN) { throw new IllegalArgumentException("bad timestamp format"); } ts = parseRfc3164Time( msg.substring(curPos, curPos + RFC3164_LEN)); curPos += RFC3164_LEN + 1; } else { int nextSpace = msg.indexOf(' ', curPos); if (nextSpace == -1) { throw new IllegalArgumentException("bad timestamp format"); } ts = parseRfc5424Date(msg.substring(curPos, nextSpace)); curPos = nextSpace + 1; } } catch (IllegalArgumentException ex) { throw new IllegalArgumentException("Unable to parse message: " + msg, ex); } headers.put("timestamp", String.valueOf(ts)); int nextSpace = msg.indexOf(' ', curPos); if (nextSpace == -1) { throw new IllegalArgumentException( "bad syslog format (missing hostname)"); } String hostname = new String(msg.substring(curPos, nextSpace)); headers.put("host", hostname); String data = ""; if (msgLen > nextSpace + 1) { curPos = nextSpace + 1; data = msg.substring(curPos); } Event event = EventBuilder.withBody(data, charset, headers); return event; } SyslogParser(); Event parseMessage(String msg, Charset charset); }
SyslogParser { public Event parseMessage(String msg, Charset charset) { Map<String, String> headers = Maps.newHashMap(); int msgLen = msg.length(); int curPos = 0; Preconditions.checkArgument(msg.charAt(curPos) == '<', "Bad format: invalid priority: cannot find open bracket '<' (%s)", msg); int endBracketPos = msg.indexOf('>'); Preconditions.checkArgument(endBracketPos > 0 && endBracketPos <= 6, "Bad format: invalid priority: cannot find end bracket '>' (%s)", msg); String priority = msg.substring(1, endBracketPos); int pri = Integer.parseInt(priority); int facility = pri / 8; int severity = pri % 8; headers.put(SyslogUtils.SYSLOG_FACILITY, String.valueOf(facility)); headers.put(SyslogUtils.SYSLOG_SEVERITY, String.valueOf(severity)); Preconditions.checkArgument(msgLen > endBracketPos + 1, "Bad format: no data except priority (%s)", msg); curPos = endBracketPos + 1; if (msgLen > curPos + 2 && "1 ".equals(msg.substring(curPos, curPos + 2))) { curPos += 2; } long ts; char dateStartChar = msg.charAt(curPos); try { if (dateStartChar == '-') { ts = System.currentTimeMillis(); if (msgLen <= curPos + 2) { throw new IllegalArgumentException( "bad syslog format (missing hostname)"); } curPos += 2; } else if (dateStartChar >= 'A' && dateStartChar <= 'Z') { if (msgLen <= curPos + RFC3164_LEN) { throw new IllegalArgumentException("bad timestamp format"); } ts = parseRfc3164Time( msg.substring(curPos, curPos + RFC3164_LEN)); curPos += RFC3164_LEN + 1; } else { int nextSpace = msg.indexOf(' ', curPos); if (nextSpace == -1) { throw new IllegalArgumentException("bad timestamp format"); } ts = parseRfc5424Date(msg.substring(curPos, nextSpace)); curPos = nextSpace + 1; } } catch (IllegalArgumentException ex) { throw new IllegalArgumentException("Unable to parse message: " + msg, ex); } headers.put("timestamp", String.valueOf(ts)); int nextSpace = msg.indexOf(' ', curPos); if (nextSpace == -1) { throw new IllegalArgumentException( "bad syslog format (missing hostname)"); } String hostname = new String(msg.substring(curPos, nextSpace)); headers.put("host", hostname); String data = ""; if (msgLen > nextSpace + 1) { curPos = nextSpace + 1; data = msg.substring(curPos); } Event event = EventBuilder.withBody(data, charset, headers); return event; } SyslogParser(); Event parseMessage(String msg, Charset charset);  }