there might be one or two spaces between month and day for syslog dat…

…e format

lib/fluent/plugin/in_syslog.rb

@@ -22,7 +22,7 @@ class SyslogInput < Input
   Plugin.register_input('syslog', self)
 
   SYSLOG_REGEXP = /^\<([0-9]+)\>(.*)/
-  SYSLOG_ALL_REGEXP = /^\<(?<pri>[0-9]+)\>(?<time>[^ ]* [^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?[^\:]*\: *(?<message>.*)$/
+  SYSLOG_ALL_REGEXP = /^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?[^\:]*\: *(?<message>.*)$/
   TIME_FORMAT = "%b %d %H:%M:%S"
 
   FACILITY_MAP = {
@@ -155,7 +155,7 @@ def receive_data(data)
         when "pri"
           pri = value.to_i
         when "time"
-          time = Time.strptime(value, TIME_FORMAT).to_i
+          time = Time.strptime(value.gsub(/ +/, ' '), TIME_FORMAT).to_i
         else
           record[name] = value
         end

test/plugin/in_syslog.rb

@@ -0,0 +1,70 @@
+require 'fluent/test'
+
+class SyslogInputTest < Test::Unit::TestCase
+  def setup
+    Fluent::Test.setup
+  end
+
+  CONFIG = %[
+    port 9911
+    bind 127.0.0.1
+    tag syslog
+  ]
+
+  def create_driver(conf=CONFIG)
+    Fluent::Test::InputTestDriver.new(Fluent::SyslogInput).configure(conf)
+  end
+
+  def test_configure
+    d = create_driver
+    assert_equal 9911, d.instance.port
+    assert_equal '127.0.0.1', d.instance.bind
+  end
+
+  def test_time_format
+    d = create_driver
+
+    tests = [
+      {'msg' => '<6>Sep 11 00:00:00 localhost logger: foo', 'expected' => Time.strptime('Sep 11 00:00:00', '%b %d %H:%M:%S').to_i},
+      {'msg' => '<6>Sep  1 00:00:00 localhost logger: foo', 'expected' => Time.strptime('Sep  1 00:00:00', '%b  %d %H:%M:%S').to_i},
+    ]
+
+    d.run do
+      u = UDPSocket.new
+      u.connect('127.0.0.1', 9911)
+      tests.each {|test|
+        u.send(test['msg'], 0)
+      }
+      sleep 1
+    end
+
+    emits = d.emits
+    emits.each_index {|i|
+      assert_equal(tests[i]['expected'], emits[i][1])
+    }
+  end
+
+  def test_msg_size
+    d = create_driver
+
+    tests = [
+      {'msg' => '<6>Sep 10 00:00:00 localhost logger: ' + 'x' * 100, 'expected' => 'x' * 100},
+      {'msg' => '<6>Sep 10 00:00:00 localhost logger: ' + 'x' * 1024, 'expected' => 'x' * 1024},
+    ]
+
+    d.run do
+      u = UDPSocket.new
+      u.connect('127.0.0.1', 9911)
+      tests.each {|test|
+        u.send(test['msg'], 0)
+      }
+      sleep 1
+    end
+
+    emits = d.emits
+    emits.each_index {|i|
+      assert_equal(tests[i]['expected'], emits[i][2]['message'])
+    }
+  end
+end
+