diff --git a/lib/fluent/plugin/parser_syslog.rb b/lib/fluent/plugin/parser_syslog.rb index 2b6fcca479..7e424d231d 100644 --- a/lib/fluent/plugin/parser_syslog.rb +++ b/lib/fluent/plugin/parser_syslog.rb @@ -314,7 +314,7 @@ def parse_rfc3164(text, &block) i = text.index(SPLIT_CHAR, i + 1) end - time_str = sq ? text.slice(idx, i - cursor).squeeze(SPLIT_CHAR) : text.slice(cursor, i - cursor) + time_str = sq ? text.slice(cursor, i - cursor).squeeze(SPLIT_CHAR) : text.slice(cursor, i - cursor) cursor = i + 1 end diff --git a/test/plugin/test_parser_syslog.rb b/test/plugin/test_parser_syslog.rb index dcdbca8388..bbd7fb42f6 100644 --- a/test/plugin/test_parser_syslog.rb +++ b/test/plugin/test_parser_syslog.rb @@ -75,6 +75,23 @@ def test_parse_with_priority(param) assert_equal("%b %d %H:%M:%S", @parser.instance.patterns['time_format']) end + def test_parse_with_space_padded_rfc3164_timestamp + @parser.configure( + 'parser_engine' => 'string', + 'with_priority' => true, + 'time_format' => '%Y-%m-%d %H:%M:%S', + ) + + result = nil + @parser.instance.parse('<6>2020-02-28 12:00:00 192.168.0.1 fluentd[11111]: [error] Syslog test') do |time, record| + result = [time, record] + end + + time, record = result + assert_equal(event_time('2020-02-28 12:00:00', format: '%Y-%m-%d %H:%M:%S'), time) + assert_equal(@expected.merge('pri' => 6), record) + end + data('regexp' => 'regexp', 'string' => 'string') def test_parse_rfc5452_with_priority(param) @parser.configure('with_priority' => true, 'parser_type' => param, 'message_format' => 'rfc5424')