Skip to content

Commit a49d6d4

Browse files
andrewkrohandrewkroh
committed
Accept syslog dates with leading 0
This makes the RFC3164 parser accept dates with a leading 0. This makes the parser a little more liberal than the spec. From RFC3164 https://datatracker.ietf.org/doc/html/rfc3164#section-4.1.2 If the day of the month is less than 10, then it MUST be represented as a space and then the number. For example, the 7th day of August would be represented as "Aug 7", with two spaces between the "g" and the "7". So now it will accept both `Sep 01` and `Sep 1`.
1 parent 8afb80e commit a49d6d4

4 files changed

Lines changed: 383 additions & 343 deletions

File tree

‎CHANGELOG.next.asciidoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -740,6 +740,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
740740
- Update `tags` and `threatintel.indicator.provider` fields in `threatintel.anomali` ingest pipeline {issue}24746[24746] {pull}27141[27141]
741741
- Move AWS module and filesets to GA. {pull}27428[27428]
742742
- update ecs.version to ECS 1.11.0. {pull}27107[27107]
743+
- Added support for parsing syslog dates containing a leading 0 (e.g. `Sep 01`) rather than a space. {pull}27775[27775]
743744
- Add base64 Encode functionality to httpjson input. {pull}27681[27681]
744745
- Add `join` and `sprintf` functions to `httpjson` input. {pull}27735[27735]
745746

‎filebeat/input/syslog/parser/syslog_rfc3164.rl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
month = ( "Jan" ("uary")? | "Feb" "ruary"? | "Mar" "ch"? | "Apr" "il"? | "Ma" "y"? | "Jun" "e"? | "Jul" "y"? | "Aug" "ust"? | "Sep" ("tember")? | "Oct" "ober"? | "Nov" "ember"? | "Dec" "ember"?) >tok %month;
1818

1919
# Match: " 5" and "10" as the day
20-
multiple_digits_day = (([12][0-9]) | ("3"[01]))>tok %day;
20+
multiple_digits_day = (([012][0-9]) | ("3"[01]))>tok %day;
2121
single_digit_day = [1-9]>tok %day;
2222
day = (space? single_digit_day | multiple_digits_day);
2323

0 commit comments

Comments
 (0)