Skip to content

Commit f7377b2

Browse files
moesterheldmoesterheld
authored
Merge pull request #41 from graylog-labs/syslog_input_configurable_timzone
Syslog input configurable timzone
2 parents 374bc20 + ce9572d commit f7377b2

File tree

8 files changed

+275
-46
lines changed

8 files changed

+275
-46
lines changed

‎src/main/java/org/graylog2/syslog4j/server/impl/event/CiscoSyslogServerEvent.java‎

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
package org.graylog2.syslog4j.server.impl.event;
22

3+
import org.joda.time.DateTimeZone;
4+
35
import java.net.InetAddress;
4-
import java.time.ZoneOffset;
56
import java.time.ZonedDateTime;
67
import java.time.format.DateTimeFormatter;
78
import java.time.format.DateTimeParseException;
@@ -19,21 +20,33 @@
1920
public class CiscoSyslogServerEvent extends SyslogServerEvent {
2021
private static final DateTimeFormatter DEFAULT_FORMATTER =
2122
DateTimeFormatter
22-
.ofPattern("yyyy MMM ppd HH:mm:ss[.SSS][ zzz]", Locale.ROOT)
23-
.withZone(ZoneOffset.UTC);
23+
.ofPattern("yyyy MMM ppd HH:mm:ss[.SSS][ zzz]", Locale.ROOT);
2424
private int sequenceNumber = 0;
2525

2626
public CiscoSyslogServerEvent(final byte[] message, int length, InetAddress inetAddress) {
2727
super();
2828

29-
initialize(message, length, inetAddress);
29+
initialize(message, length, inetAddress, null);
30+
parse();
31+
}
32+
public CiscoSyslogServerEvent(final byte[] message, int length, InetAddress inetAddress, DateTimeZone sysLogServerTimeZone) {
33+
super();
34+
35+
initialize(message, length, inetAddress, sysLogServerTimeZone);
3036
parse();
3137
}
3238

3339
public CiscoSyslogServerEvent(final String message, InetAddress inetAddress) {
3440
super();
3541

36-
initialize(message, inetAddress);
42+
initialize(message, inetAddress, null);
43+
parse();
44+
}
45+
46+
public CiscoSyslogServerEvent(final String message, InetAddress inetAddress, DateTimeZone sysLogServerTimeZone) {
47+
super();
48+
49+
initialize(message, inetAddress, sysLogServerTimeZone);
3750
parse();
3851
}
3952

@@ -117,7 +130,7 @@ protected void parseDate() {
117130
if (this.message.length() > dateLength) {
118131
boolean isYearMissing = Character.isLetter(message.charAt(0));
119132
String originalDate = this.message.substring(0, dateLength);
120-
DateTimeFormatter formatter = DEFAULT_FORMATTER;
133+
DateTimeFormatter formatter = DEFAULT_FORMATTER.withZone(getDefaultServerZoneId());
121134

122135
// Hacky override for: "Mar 06 2016 12:53:10 DEVICENAME :"
123136
if (Character.isDigit(message.charAt(7))
@@ -129,7 +142,7 @@ protected void parseDate() {
129142
originalDate = this.message.substring(0, dateLength);
130143
formatter = DateTimeFormatter
131144
.ofPattern("MMM ppd yyyy HH:mm:ss", Locale.ROOT)
132-
.withZone(ZoneOffset.UTC);
145+
.withZone(getDefaultServerZoneId());
133146
}
134147

135148
try {
@@ -154,4 +167,5 @@ protected void parseDate() {
154167
public int getSequenceNumber() {
155168
return sequenceNumber;
156169
}
170+
157171
}

‎src/main/java/org/graylog2/syslog4j/server/impl/event/FortiGateSyslogEvent.java‎

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,21 @@
11
package org.graylog2.syslog4j.server.impl.event;
22

33
import org.graylog2.syslog4j.server.SyslogServerEventIF;
4+
import org.joda.time.DateTimeZone;
45

56
import java.nio.charset.Charset;
67
import java.nio.charset.StandardCharsets;
78
import java.time.LocalDate;
89
import java.time.LocalTime;
10+
import java.time.ZoneId;
911
import java.time.ZoneOffset;
1012
import java.time.ZonedDateTime;
1113
import java.time.format.DateTimeFormatter;
1214
import java.util.Collections;
1315
import java.util.Date;
1416
import java.util.HashMap;
1517
import java.util.Map;
18+
import java.util.Objects;
1619
import java.util.regex.Matcher;
1720
import java.util.regex.Pattern;
1821

@@ -30,7 +33,8 @@ public class FortiGateSyslogEvent implements SyslogServerEventIF {
3033
private static final Pattern KV_PATTERN = Pattern.compile("(\\w+)=([^\\s\"]*)");
3134
private static final Pattern QUOTED_KV_PATTERN = Pattern.compile("(\\w+)=\"([^\"]*)\"");
3235

33-
private final String rawEvent;
36+
private String rawEvent;
37+
private ZoneId defaultZoneId;
3438
private Date date;
3539
private int facility;
3640
private int level;
@@ -40,7 +44,16 @@ public class FortiGateSyslogEvent implements SyslogServerEventIF {
4044
private Map<String, String> fields = Collections.emptyMap();
4145

4246
public FortiGateSyslogEvent(final String rawEvent) {
47+
initialize(rawEvent, null);
48+
}
49+
50+
public FortiGateSyslogEvent(final String rawEvent, DateTimeZone sysLogServerTimeZone) {
51+
initialize(rawEvent, sysLogServerTimeZone);
52+
}
53+
54+
private void initialize(final String rawEvent, DateTimeZone sysLogServerTimeZone) {
4355
this.rawEvent = requireNonNull(rawEvent, "rawEvent");
56+
this.defaultZoneId = Objects.isNull(sysLogServerTimeZone) ? ZoneOffset.UTC : sysLogServerTimeZone.toTimeZone().toZoneId();
4457
parse(rawEvent);
4558
}
4659

@@ -55,7 +68,7 @@ private void parse(String event) {
5568
parsePriority(priority);
5669
setMessage(message);
5770
parseFields(message);
58-
parseDate(fields.get("date"), fields.get("time"));
71+
parseDate(fields.get("date"), fields.get("time"), fields.get("tz"));
5972
setHost(fields.get("devname"));
6073
}
6174
}
@@ -83,12 +96,18 @@ private void parseFields(String event) {
8396
setFields(fields);
8497
}
8598

86-
private void parseDate(String date, String time) {
99+
private void parseDate(String date, String time, String timeZone) {
87100
if (date != null && time != null) {
101+
ZoneId zone = defaultZoneId;
102+
103+
if (timeZone != null) {
104+
zone = ZoneOffset.of(timeZone);
105+
}
106+
88107
final ZonedDateTime dateTime = ZonedDateTime.of(
89-
LocalDate.parse(date, DateTimeFormatter.ISO_LOCAL_DATE.withZone(ZoneOffset.UTC)),
90-
LocalTime.parse(time, DateTimeFormatter.ISO_LOCAL_TIME.withZone(ZoneOffset.UTC)),
91-
ZoneOffset.UTC);
108+
LocalDate.parse(date, DateTimeFormatter.ISO_LOCAL_DATE.withZone(zone)),
109+
LocalTime.parse(time, DateTimeFormatter.ISO_LOCAL_TIME.withZone(zone)),
110+
zone);
92111
setDate(Date.from(dateTime.toInstant()));
93112

94113
} else {

‎src/main/java/org/graylog2/syslog4j/server/impl/event/SyslogServerEvent.java‎

Lines changed: 56 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,19 @@
44
import org.graylog2.syslog4j.server.SyslogServerEventIF;
55
import org.graylog2.syslog4j.util.SyslogUtility;
66
import org.joda.time.DateTime;
7+
import org.joda.time.DateTimeZone;
8+
import org.joda.time.format.ISODateTimeFormat;
79

810
import java.net.InetAddress;
911
import java.text.DateFormat;
1012
import java.text.ParseException;
1113
import java.text.SimpleDateFormat;
14+
import java.time.ZoneId;
15+
import java.time.ZoneOffset;
1216
import java.util.Calendar;
1317
import java.util.Date;
1418
import java.util.Locale;
19+
import java.util.Objects;
1520

1621
/**
1722
* SyslogServerEvent provides an implementation of the SyslogServerEventIF interface.
@@ -40,34 +45,49 @@ public class SyslogServerEvent implements SyslogServerEventIF {
4045
protected boolean isHostStrippedFromMessage = false;
4146
protected String message = null;
4247
protected InetAddress inetAddress = null;
48+
protected DateTimeZone sysLogServerTimeZone;
4349

4450
protected SyslogServerEvent() {
4551
}
4652

4753
public SyslogServerEvent(final String message, InetAddress inetAddress) {
48-
initialize(message, inetAddress);
54+
initialize(message, inetAddress, null);
55+
56+
parse();
57+
}
58+
59+
public SyslogServerEvent(final String message, InetAddress inetAddress, DateTimeZone sysLogServerTimeZone) {
60+
initialize(message, inetAddress, sysLogServerTimeZone);
4961

5062
parse();
5163
}
5264

5365
public SyslogServerEvent(final byte[] message, int length, InetAddress inetAddress) {
54-
initialize(message, length, inetAddress);
66+
initialize(message, length, inetAddress, null);
67+
68+
parse();
69+
}
70+
71+
public SyslogServerEvent(final byte[] message, int length, InetAddress inetAddress, DateTimeZone sysLogServerTimeZone) {
72+
initialize(message, length, inetAddress, sysLogServerTimeZone);
5573

5674
parse();
5775
}
5876

59-
protected void initialize(final String message, InetAddress inetAddress) {
77+
protected void initialize(final String message, InetAddress inetAddress, DateTimeZone sysLogServerTimeZone) {
6078
this.rawString = message;
6179
this.rawLength = message.length();
6280
this.inetAddress = inetAddress;
63-
6481
this.message = message;
82+
this.sysLogServerTimeZone = sysLogServerTimeZone;
6583
}
6684

67-
protected void initialize(final byte[] message, int length, InetAddress inetAddress) {
85+
86+
protected void initialize(final byte[] message, int length, InetAddress inetAddress, DateTimeZone sysLogServerTimeZone) {
6887
this.rawBytes = message;
6988
this.rawLength = length;
7089
this.inetAddress = inetAddress;
90+
this.sysLogServerTimeZone = sysLogServerTimeZone;
7191
}
7292

7393
protected void parseHost() {
@@ -96,16 +116,13 @@ protected void parseDate() {
96116
isDate8601 = true;
97117
}
98118

99-
String year = Integer.toString(Calendar.getInstance().get(Calendar.YEAR));
100119
String originalDate = this.message.substring(0, datelength - 1);
101-
String modifiedDate = originalDate + " " + year;
102120

103-
DateFormat dateFormat = new SimpleDateFormat(dateFormatS, Locale.ENGLISH);
104121
try {
105122
if (!isDate8601) {
106-
this.date = dateFormat.parse(modifiedDate);
123+
this.date = parseDateBasedOnFormat(originalDate, datelength, dateFormatS);
107124
} else {
108-
this.date = DateTime.parse(originalDate).toDate();
125+
this.date = parse8601Date(originalDate).toDate();
109126
}
110127

111128
this.message = this.message.substring(datelength);
@@ -118,6 +135,31 @@ protected void parseDate() {
118135
parseHost();
119136
}
120137

138+
private Date parseDateBasedOnFormat(String originalDate, int dateLength, String format) throws ParseException {
139+
String year = Integer.toString(Calendar.getInstance().get(Calendar.YEAR));
140+
String modifiedDate = originalDate + " " + year;
141+
DateFormat dateFormat = new SimpleDateFormat(format, Locale.ENGLISH);
142+
143+
if (Objects.nonNull(sysLogServerTimeZone)) {
144+
dateFormat.setTimeZone(sysLogServerTimeZone.toTimeZone());
145+
}
146+
147+
return dateFormat.parse(modifiedDate);
148+
}
149+
150+
private DateTime parse8601Date(String date) {
151+
152+
if (!hasTimeZone(date) && Objects.nonNull(sysLogServerTimeZone)) {
153+
return DateTime.parse(date, ISODateTimeFormat.dateTimeParser().withZone(sysLogServerTimeZone));
154+
}
155+
156+
return DateTime.parse(date);
157+
}
158+
159+
protected boolean hasTimeZone(String date) {
160+
return date.substring(date.length() - 6).matches(".*[Z+-].*");
161+
}
162+
121163
protected void parsePriority() {
122164
if (this.message.charAt(0) == '<') {
123165
int i = this.message.indexOf(">");
@@ -177,6 +219,10 @@ public byte[] getRaw() {
177219
}
178220
}
179221

222+
protected ZoneId getDefaultServerZoneId() {
223+
return Objects.isNull(sysLogServerTimeZone) ? ZoneOffset.UTC : sysLogServerTimeZone.toTimeZone().toZoneId();
224+
}
225+
180226
public int getRawLength() {
181227
return this.rawLength;
182228
}

‎src/main/java/org/graylog2/syslog4j/server/impl/event/structured/StructuredSyslogServerEvent.java‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,13 @@
44
import org.graylog2.syslog4j.impl.message.structured.StructuredSyslogMessage;
55
import org.graylog2.syslog4j.server.impl.event.SyslogServerEvent;
66
import org.joda.time.DateTime;
7+
import org.joda.time.DateTimeZone;
78
import org.joda.time.format.DateTimeFormatter;
89
import org.joda.time.format.ISODateTimeFormat;
910

1011
import java.net.InetAddress;
1112
import java.util.Locale;
13+
import java.util.Objects;
1214

1315
/**
1416
* SyslogServerStructuredEvent provides an implementation of the
@@ -39,14 +41,27 @@ public class StructuredSyslogServerEvent extends SyslogServerEvent {
3941
public StructuredSyslogServerEvent(final byte[] message, int length, InetAddress inetAddress) {
4042
super();
4143

42-
initialize(message, length, inetAddress);
44+
initialize(message, length, inetAddress, null);
45+
parse();
46+
}
47+
48+
public StructuredSyslogServerEvent(final byte[] message, int length, InetAddress inetAddres, DateTimeZone sysLogServerTimeZone) {
49+
super();
50+
51+
initialize(message, length, inetAddress, sysLogServerTimeZone);
4352
parse();
4453
}
4554

4655
public StructuredSyslogServerEvent(final String message, InetAddress inetAddress) {
4756
super();
4857

49-
initialize(message, inetAddress);
58+
initialize(message, inetAddress, null);
59+
parse();
60+
}
61+
public StructuredSyslogServerEvent(final String message, InetAddress inetAddress, DateTimeZone sysLogServerTimeZone) {
62+
super();
63+
64+
initialize(message, inetAddress, sysLogServerTimeZone);
5065
parse();
5166
}
5267

@@ -103,6 +118,10 @@ protected void parseDate() {
103118
try {
104119
DateTimeFormatter formatter = getDateTimeFormatter();
105120

121+
if (!hasTimeZone(dateString) && Objects.nonNull(sysLogServerTimeZone)) {
122+
formatter = formatter.withZone(sysLogServerTimeZone);
123+
}
124+
106125
this.dateTime = formatter.parseDateTime(dateString);
107126
this.date = this.dateTime.toDate();
108127

0 commit comments

Comments
 (0)