Support RFC3339/ISO8601-formatted timestamps when parsing syslog messages in logengine#3723
Merged
lunkwill42 merged 8 commits into5.16.xfrom Jan 8, 2026
Merged
Conversation
Logengine is not able to parse log messages that use RFC 3339 (ISO 8601) formatted timestamps. Adding this single log line to the test data exposes the problem.
Instead of parsing timestamps as regexp match groups, I intend to identify and feed the full timestamp string to this function, which would be more flexible in how timestamps are actually parsed in the logs.
This removes complicated group matching of timestamp strings, adding RFC3339 timestamp support and delegates matching strings to the new parse_timestamp function.
The new timestamp parser supports returning timestamps with microseconds, since these are supported in the RFC 3339 formats. The tests need to take that into account.
Legacy NAV code is timezone-naive and stores timestamps in the local system time. However, that doesn't mean we should ignore timezone information in incoming data timestamps - we should at least convert those timestamps to the local time so we can expect them to be consistent with other NAV timestamps.
4263719 to
b42a285
Compare
Test results 27 files 27 suites 46m 23s ⏱️ Results for commit fd678b5. ♻️ This comment has been updated with latest results. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## 5.16.x #3723 +/- ##
==========================================
- Coverage 63.03% 63.03% -0.01%
==========================================
Files 614 614
Lines 45420 45438 +18
Branches 43 43
==========================================
+ Hits 28631 28641 +10
- Misses 16779 16787 +8
Partials 10 10 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Hopefully we will be dropping Python 3.9 support soon, but for now we keep this.
hmpf
reviewed
Jan 8, 2026
hmpf
previously approved these changes
Jan 8, 2026
johannaengland
previously approved these changes
Jan 8, 2026
|
johannaengland
approved these changes
Jan 8, 2026
Member
Author
|
Stupid GitHub, I did no such thing :D |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope and purpose
Fixes #3722.
The timestamp parsing was already needlessly complex and rife with regexp-crap (I believe this was once ported directly from a Perl script without much change). I felt compelled to refactor it somewhat along the way, in order to not introduce even more complex timestamp pattern matching and match group manipulations (still need patterns to match what looks like timestamps, though).
Contributor Checklist
Every pull request should have this checklist filled out, no matter how small it is.
More information about contributing to NAV can be found in the
Hacker's guide to NAV.
Added/changed documentation<major>.<minor>.x). For a new feature or other additions, it should be based onmaster.If applicable: Created new issues if this PR does not fix the issue completely/there is further work to be doneIf it's not obvious from a linked issue, described how to interact with NAV in order for a reviewer to observe the effects of this change first-hand (commands, URLs, UI interactions)If this results in changes in the UI: Added screenshots of the before and afterIf this adds a new Python source code file: Added the boilerplate header to that file