Implement new parser for syslog rfc3164

Signed-off-by: Masahiro Nakagawa <[email protected]>

lib/fluent/plugin/parser_syslog.rb

@@ -38,6 +38,10 @@ class SyslogParser < Parser
       config_param :message_format, :enum, list: [:rfc3164, :rfc5424, :auto], default: :rfc3164
       desc 'Specify time format for event time for rfc5424 protocol'
       config_param :rfc5424_time_format, :string, default: "%Y-%m-%dT%H:%M:%S.%L%z"
+      desc 'The parser type used to parse syslog message'
+      config_param :parser_type, :enum, list: [:regexp, :string], default: :regexp
+      desc 'support colonless ident in string parser'
+      config_param :support_colonless_ident, :bool, default: true
 
       def initialize
         super
@@ -50,10 +54,17 @@ def configure(conf)
         @time_parser_rfc3164 = @time_parser_rfc5424 = nil
         @time_parser_rfc5424_without_subseconds = nil
         @support_rfc5424_without_subseconds = false
+        @regexp_parser = @parser_type == :regexp
         @regexp = case @message_format
                   when :rfc3164
-                    class << self
-                      alias_method :parse, :parse_plain
+                    if @regexp_parser
+                      class << self
+                        alias_method :parse, :parse_plain
+                      end
+                    else
+                      class << self
+                        alias_method :parse, :parse_rfc3164
+                      end
                     end
                     @with_priority ? REGEXP_WITH_PRI : REGEXP
                   when :rfc5424
@@ -88,11 +99,16 @@ def parse_auto(text, &block)
           @regexp = @with_priority ? REGEXP_RFC5424_WITH_PRI : REGEXP_RFC5424
           @time_parser = @time_parser_rfc5424
           @support_rfc5424_without_subseconds = true
+          parse_plain(text, &block)
         else
           @regexp = @with_priority ? REGEXP_WITH_PRI : REGEXP
           @time_parser = @time_parser_rfc3164
+          if @regexp_parser
+            parse_plain(text, &block)
+          else
+            parse_rfc3164(text, &block)
+          end
         end
-        parse_plain(text, &block)
       end
 
       def parse_plain(text, &block)
@@ -137,6 +153,91 @@ def parse_plain(text, &block)
 
         yield time, record
       end
+
+      SPLIT_CHAR = ' '.freeze
+      PRI_START_CHAR = '<'.freeze
+
+      def parse_rfc3164(text, &block)
+        pri = nil
+        start = 0
+        if @with_priority
+          if text.start_with?(PRI_START_CHAR)
+            i = text.index('>'.freeze, 1)
+            pri = text.slice(1, i - 1).to_i
+            start = i + 1
+          else
+            yield nil, nil
+            return
+          end
+        end
+
+        # header part
+        diff = 15 # skip Mmm dd hh:mm:ss
+        time_end = text[start + diff]
+        if time_end == SPLIT_CHAR
+          time_str = text.slice(start, diff)
+          start += 16 # time + ' '
+        elsif time_end == '.'.freeze
+          # support subsecond time
+          i = text.index(SPLIT_CHAR, diff)
+          time_str = text.slice(start, i - start)
+          start = i + 1
+        else
+          yield nil, nil
+          return
+        end
+
+        i = text.index(SPLIT_CHAR, start)
+        if i.nil?
+          yield nil, nil
+          return
+        end
+        diff = i - start
+        host = text.slice(start, diff)
+        start += (diff + 1)
+
+        i = text.index(SPLIT_CHAR, start)
+        if i.nil?
+          yield nil, nil
+          return
+        end
+        diff = i - start
+
+        record = {'host' => host}
+        record['pri'] = pri if pri
+
+        # message part
+        msg = if text[i - 1] == ':'.freeze
+                if text[i - 2] == ']'.freeze
+                  j = text.index('['.freeze, start)
+                  record['ident'] = text.slice(start, j - start)
+                  record['pid'] = text.slice(j + 1, i - j - 3) # remove '[' / ']:'
+                else
+                  record['ident'] = text.slice(start, i - start - 1)
+                end
+                text.slice(i + 1, text.bytesize)
+              else
+                if @support_colonless_ident
+                  if text[i - 1] == ']'.freeze
+                    j = text.index('['.freeze, start)
+                    record['ident'] = text.slice(start, j - start)
+                    record['pid'] = text.slice(j + 1, i - j - 2) # remove '[' / ']'
+                  else
+                    record['ident'] = text.slice(start, i - start)
+                  end
+                  text.slice(i + 1, text.bytesize)
+                else
+                  text.slice(i - diff, text.bytesize)
+                end
+              end
+        msg.chomp!
+        record['message'] = msg
+
+        time = @time_parser.parse(time_str.squeeze(SPLIT_CHAR))
+        record['time'] = time_str if @keep_time_key
+
+        yield time, record
+      end
     end
   end
 end