private void ParseStructuredData(ParserContext ctx)
{
ctx.SkipSpaces();
if (ctx.Current == SyslogChars.NilChar)
{
ctx.Position++;
return;
}
var data = ctx.Entry.StructuredData;
try
{
if (ctx.Current != SyslogChars.Lbr)
{
// do not report it as an error, some messages out there are a bit malformed
// ctx.AddError("Expected [ for structured data.");
return;
}
// start parsing elements
while (!ctx.Eof())
{
var elem = ParseElement(ctx);
if (elem == null)
{
return;
}
data[elem.Item1] = elem.Item2;
}
} catch (Exception ex)
{
ctx.AddError(ex.Message);
}
}
public bool TryParse(ParserContext ctx)
{
if (!ctx.Reset())
{
return(false);
}
if (!ctx.Match("1 "))
{
return(false);
}
// It is RFC-5424 entry
var entry = ctx.Entry;
entry.PayloadType = PayloadType.Rfc5424;
try
{
entry.Header = this.ParseHeader(ctx);
this.ParseStructuredData(ctx);
entry.Message = this.ParseMessage(ctx);
return(true);
}
catch (Exception ex)
{
ctx.AddError(ex.Message);
return(false);
}
}
public static void AssignFacilitySeverity(this ParserContext ctx)
{
var priStr = ctx.Prefix.Replace("<", string.Empty).Replace(">", string.Empty).Replace("?", string.Empty);
if (!int.TryParse(priStr, out var pri))
{
ctx.AddError($"Invalid priiority value '{priStr}', expected '<?>' where ? is int.");
return;
}
// parse priority -> facility + severity
var intFacility = pri / 8;
var intSeverity = pri % 8;
ctx.Entry.Facility = (Facility)intFacility;
ctx.Entry.Severity = (Severity)intSeverity;
}
public static DateTime?ParseStandardTimestamp(this ParserContext ctx)
{
var ts = ctx.ReadWord();
if (ts == null)
{
return(null);
}
if (DateTime.TryParse(ts, out var dt))
{
// by default TryParse produces local time
return(dt.ToUniversalTime());
}
ctx.AddError($"Invalid timestamp '{ts}'.");
return(DateTime.MinValue);
}
