public bool TryParse(ParserContext ctx)
{
if (!ctx.Reset())
{
return(false);
}
if (!ctx.Match("1 "))
{
return(false);
}
// It is RFC-5424 entry
var entry = ctx.Entry;
entry.PayloadType = PayloadType.Rfc5424;
try
{
entry.Header = this.ParseHeader(ctx);
this.ParseStructuredData(ctx);
entry.Message = this.ParseMessage(ctx);
return(true);
}
catch (Exception ex)
{
ctx.AddError(ex.Message);
return(false);
}
}
public bool TryParse(ParserContext context)
{
if (!context.ReadSyslogPrefix())
{
return(false);
}
context.Entry = new SyslogEntry();
context.AssignFacilitySeverity();
foreach (var parser in _versionParsers)
{
context.Reset();
try
{
if (parser.TryParse(context))
{
ExtractDataFromMessage(context);
return(context.ErrorMessages.Count == 0);
}
}
catch (Exception ex)
{
context.ErrorMessages.Add(ex.ToString());
ex.Data["SyslogMessage"] = context.Text;
throw;
}
}
return(false);
}
// match entry like
// <134> 03/04/2020:17:20:58 GMT ams07....
public static bool TryParseIfStartsWithSpace(ParserContext ctx)
{
ctx.Reset();
if (ctx.Current != SyslogChars.Space)
{
return(false);
}
var prefix = ctx.Text.Substring(ctx.Position, 25);
var year = DateTime.UtcNow.Year;
if (prefix.Contains($"/{year}:") || prefix.Contains($"/{year - 1}:")) //(also check prior year)
{
ctx.Position++;
var spPos = ctx.Text.IndexOf(" ", ctx.Position);
if (spPos > 0)
{
var dtStr = ctx.Text.Substring(ctx.Position, spPos - ctx.Position);
ctx.Position = spPos + 1;
ctx.Match("GMT"); //skip also GMT
if (DateTime.TryParse(dtStr, out var dt) ||
DateTime.TryParseExact(dtStr, "MM/dd/yyyy:HH:mm:ss", CultureInfo.InvariantCulture, DateTimeStyles.AssumeUniversal, out dt))
{
ctx.Entry.Header.Timestamp = dt.ToUniversalTime();
}
}
return(true);
}
return(false);
}
public bool TryParse(ParserContext ctx)
{
if (ctx.Current == SyslogChars.Space)
{
ctx.SkipSpaces();
}
// typically entries start with 'device=' or 'date='
var match = ctx.Match("device=") || ctx.Match("date=");
if (!match)
{
match = TryMatchAnyKey(ctx);
}
if (!match)
{
return(false);
}
// It is the format for this parser
ctx.Reset(); // Match(...) moved the position, so return to the start
ctx.Entry.PayloadType = PayloadType.KeyValuePairs;
var kvList = ReadKeyValuePairs(ctx);
ctx.Entry.ExtractedData.AddRange(kvList);
// try some known values and put them in the header
var hdr = ctx.Entry.Header;
hdr.HostName = kvList.GetValue("device_id");
var date = kvList.GetValue("date");
var time = kvList.GetValue("time");
if (date != null)
{
var dateTimeStr = $"{date}T{time}";
if (DateTime.TryParse(dateTimeStr, out var dt))
{
hdr.Timestamp = dt;
}
}
return(true);
} //method
