public bool TryParse(ParserContext ctx) { if (!ctx.Reset()) { return(false); } if (!ctx.Match("1 ")) { return(false); } // It is RFC-5424 entry var entry = ctx.Entry; entry.PayloadType = PayloadType.Rfc5424; try { entry.Header = this.ParseHeader(ctx); this.ParseStructuredData(ctx); entry.Message = this.ParseMessage(ctx); return(true); } catch (Exception ex) { ctx.AddError(ex.Message); return(false); } }
public bool TryParse(ParserContext context) { if (!context.ReadSyslogPrefix()) { return(false); } context.Entry = new SyslogEntry(); context.AssignFacilitySeverity(); foreach (var parser in _versionParsers) { context.Reset(); try { if (parser.TryParse(context)) { ExtractDataFromMessage(context); return(context.ErrorMessages.Count == 0); } } catch (Exception ex) { context.ErrorMessages.Add(ex.ToString()); ex.Data["SyslogMessage"] = context.Text; throw; } } return(false); }
// match entry like // <134> 03/04/2020:17:20:58 GMT ams07.... public static bool TryParseIfStartsWithSpace(ParserContext ctx) { ctx.Reset(); if (ctx.Current != SyslogChars.Space) { return(false); } var prefix = ctx.Text.Substring(ctx.Position, 25); var year = DateTime.UtcNow.Year; if (prefix.Contains($"/{year}:") || prefix.Contains($"/{year - 1}:")) //(also check prior year) { ctx.Position++; var spPos = ctx.Text.IndexOf(" ", ctx.Position); if (spPos > 0) { var dtStr = ctx.Text.Substring(ctx.Position, spPos - ctx.Position); ctx.Position = spPos + 1; ctx.Match("GMT"); //skip also GMT if (DateTime.TryParse(dtStr, out var dt) || DateTime.TryParseExact(dtStr, "MM/dd/yyyy:HH:mm:ss", CultureInfo.InvariantCulture, DateTimeStyles.AssumeUniversal, out dt)) { ctx.Entry.Header.Timestamp = dt.ToUniversalTime(); } } return(true); } return(false); }
public bool TryParse(ParserContext ctx) { if (ctx.Current == SyslogChars.Space) { ctx.SkipSpaces(); } // typically entries start with 'device=' or 'date=' var match = ctx.Match("device=") || ctx.Match("date="); if (!match) { match = TryMatchAnyKey(ctx); } if (!match) { return(false); } // It is the format for this parser ctx.Reset(); // Match(...) moved the position, so return to the start ctx.Entry.PayloadType = PayloadType.KeyValuePairs; var kvList = ReadKeyValuePairs(ctx); ctx.Entry.ExtractedData.AddRange(kvList); // try some known values and put them in the header var hdr = ctx.Entry.Header; hdr.HostName = kvList.GetValue("device_id"); var date = kvList.GetValue("date"); var time = kvList.GetValue("time"); if (date != null) { var dateTimeStr = $"{date}T{time}"; if (DateTime.TryParse(dateTimeStr, out var dt)) { hdr.Timestamp = dt; } } return(true); } //method