Hi, I am basically done with cleaning up the stuff. You can find my latest version at https://github.com/balabit/syslog-ng/tree/f/date-parser I still have to clean up the branch, it is currently just a dump of patches, but the final state should be pretty close that I'd try to push for integration. There's one issue that is still open: strptime() at least as implemented in various libc versions is unusable, so we should probably roll our own implementation. Reasons: 1) tm_gmtoff is not portable 2) %z as a parsing format is not portable 3) %z doesn't accept ISO8601 standard zone offsets when there's a colon between hours and minutes Also, it can be affected by locale settings (which is not good for the syslog-ng case) and is probably very slow. (at one point syslog-ng used strptime for normal log traffic and I remember replacing it with hand-coded routines increased performance a lot). I'll try to get an strptime implementation from somewhere and tailor it to our needs. Any feedback is appreciated. Bazsi -- Bazsi On Sun, Oct 25, 2015 at 4:44 PM, Scheidler, Balázs < balazs.scheidler@balabit.com> wrote:
Hi,
As I see you assume a date is from UTC if there's no timezone information. I would think that using the local timezone is more intuitive in this case:
testcase("Tue, 27 Jan 2015 11:48:46", NULL, "%a, %d %b %Y %T", "2015-01-27T11:48:46+00:00");
What do you think?
-- Bazsi
On Sun, Oct 25, 2015 at 12:36 PM, Scheidler, Balázs < balazs.scheidler@balabit.com> wrote:
thanks for the quick reply.
-- Bazsi
On Sun, Oct 25, 2015 at 12:35 PM, Vincent Bernat <vincent@bernat.im> wrote:
❦ 25 octobre 2015 12:32 +0100, "Scheidler, Balázs" < balazs.scheidler@balabit.com> :
I'd have a question though: I can see the date-offset() option for date parser, which seems to skip the specified number of characters in the input.
Can you please describe the usecase behind that? I'd be reluctant to add such an option to a parser (as none of the other have such an option), and it should be possible to do the same using template functions, e.g. something like this:
date-parser(template("$(substr $MSG 5)"));
This would similarly skip the first 5 characters.
If this addresses your original use-case, I'd drop the date-offset() option.
Yes, this would cover my use case. -- Use library functions. - The Elements of Programming Style (Kernighan & Plauger)