diff --git a/lib/fluent/plugin/parser_syslog.rb b/lib/fluent/plugin/parser_syslog.rb index 3938c13ed6..9eaa209786 100644 --- a/lib/fluent/plugin/parser_syslog.rb +++ b/lib/fluent/plugin/parser_syslog.rb @@ -453,7 +453,7 @@ def parse_rfc5424(text, &block) i = text.index(SPLIT_CHAR, i + 1) end - time_str = sq ? text.slice(idx, i - cursor).squeeze(SPLIT_CHAR) : text.slice(cursor, i - cursor) + time_str = sq ? text.slice(cursor, i - cursor).squeeze(SPLIT_CHAR) : text.slice(cursor, i - cursor) cursor = i + 1 end diff --git a/test/plugin/test_parser_syslog.rb b/test/plugin/test_parser_syslog.rb index f7e8655c45..c47ef67f25 100644 --- a/test/plugin/test_parser_syslog.rb +++ b/test/plugin/test_parser_syslog.rb @@ -385,6 +385,28 @@ def test_parse_does_not_accept_space_after_rfc5424_priority(data) assert_input_rejected(text, expectation) end + def test_parse_rfc5424_with_space_containing_time_format + @parser.configure( + 'parser_engine' => 'string', + 'message_format' => 'rfc5424', + 'with_priority' => true, + 'time_format' => '%b %d %H:%M:%S', + ) + + result = nil + @parser.instance.parse('<16>1 Feb 6 13:14:15 192.168.0.1 fluentd 11111 ID - Hi, from Fluentd!') do |time, record| + result = [time, record] + end + + time, record = result + assert_equal(event_time('Feb 6 13:14:15', format: '%b %d %H:%M:%S'), time) + assert_equal( + {'host' => '192.168.0.1', 'ident' => 'fluentd', 'pid' => '11111', 'msgid' => 'ID', + 'pri' => 16, 'extradata' => '-', 'message' => 'Hi, from Fluentd!'}, + record, + ) + end + data('regexp' => 'regexp', 'string' => 'string') def test_parse_rfc5452_with_priority(param) @parser.configure('with_priority' => true, 'parser_type' => param, 'message_format' => 'rfc5424')