(logging-flume) branch towards17 updated: Fix: allow arbitrary precision in RFC 5424 timestamps

[pkarwasz]

This is an automated email from the ASF dual-hosted git repository.

ppkarwasz pushed a commit to branch towards17
in repository https://gitbox.apache.org/repos/asf/logging-flume.git


The following commit(s) were added to refs/heads/towards17 by this push:
     new d29894462 Fix: allow arbitrary precision in RFC 5424 timestamps
d29894462 is described below

commit d29894462128155b5b83765c51afde792443cd08
Author: Piotr P. Karwasz <pkarwasz-git...@apache.org>
AuthorDate: Fri May 29 19:47:58 2026 +0200

    Fix: allow arbitrary precision in RFC 5424 timestamps
    
    Modifies the regex in SyslogUtils to allow up to 9 digits of precision in 
timestamps.
    
    This level of precision does not exist on Java 8, but since Java 9 
nanosecond precision is available at least on Linux.
---
 .../main/java/org/apache/flume/source/SyslogUtils.java    |  2 +-
 .../java/org/apache/flume/source/TestSyslogUtils.java     | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git 
a/flume-ng-core/src/main/java/org/apache/flume/source/SyslogUtils.java 
b/flume-ng-core/src/main/java/org/apache/flume/source/SyslogUtils.java
index ea379237c..39f0122cf 100644
--- a/flume-ng-core/src/main/java/org/apache/flume/source/SyslogUtils.java
+++ b/flume-ng-core/src/main/java/org/apache/flume/source/SyslogUtils.java
@@ -64,7 +64,7 @@ public class SyslogUtils {
           /* yyyy-MM-dd'T'HH:mm:ss.SZ or yyyy-MM-dd'T'HH:mm:ss.S+hh:mm or - 
(null stamp) */
           "(?:" +
           "(\\d{4}[-]\\d{2}[-]\\d{2}[T]\\d{2}[:]\\d{2}[:]\\d{2}" +
-          "(?:\\.\\d{1,6})?(?:[+-]\\d{2}[:]\\d{2}|Z)?)|-)" + // stamp
+          "(?:\\.\\d{1,9})?(?:[+-]\\d{2}[:]\\d{2}|Z)?)|-)" + // stamp
           "\\s" + // separator
           "(?:([\\w][\\w\\d\\.@\\-]*)|-)" + // host name or - (null)
           "\\s" + // separator
diff --git 
a/flume-ng-core/src/test/java/org/apache/flume/source/TestSyslogUtils.java 
b/flume-ng-core/src/test/java/org/apache/flume/source/TestSyslogUtils.java
index f162697e4..73c587603 100644
--- a/flume-ng-core/src/test/java/org/apache/flume/source/TestSyslogUtils.java
+++ b/flume-ng-core/src/test/java/org/apache/flume/source/TestSyslogUtils.java
@@ -183,6 +183,21 @@ public class TestSyslogUtils {
     checkHeader(msg1, outputStamp, format1, host1, data1);
   }
 
+  @Test
+  public void TestHeader12() throws ParseException {
+    // RFC 5424 allows arbitrary precision in the timestamp.
+    // The regex must accept it; SyslogUtils still truncates the fraction to 3 
digits.
+    String inputStamp  = "2014-10-03T17:20:01.123456789-07:00";
+    String outputStamp = "2014-10-03T17:20:01.123-07:00";
+
+    String format1 = "yyyy-MM-dd'T'HH:mm:ss.S";
+    String host1 = "ubuntu-11.cloudera.com";
+    String data1 = "some msg";
+
+    String msg1 = "<10>" + inputStamp + " " + host1 + " " + data1 + "\n";
+    checkHeader(msg1, outputStamp, format1, host1, data1);
+  }
+
   @Test
   public void TestRfc3164HeaderApacheLogWithNulls() throws ParseException {
     SimpleDateFormat sdf = new SimpleDateFormat("MMM  d hh:MM:ss", 
Locale.ENGLISH);