Github user simonellistonball commented on a diff in the pull request:
https://github.com/apache/incubator-metron/pull/451#discussion_r100941897
--- Diff:
metron-platform/metron-parsers/src/main/java/org/apache/metron/parsers/utils/DateUtils.java
---
@@ -0,0 +1,78 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.metron.parsers.utils;
+
+import java.text.ParseException;
+import java.text.SimpleDateFormat;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.List;
+
+/**
+ * Various utilities for parsing and extracting dates
+ *
+ */
+public class DateUtils {
+
+ public static List<SimpleDateFormat> DATE_FORMATS_CEF = new
ArrayList<SimpleDateFormat>() {
+ {
+ // as per CEF Spec
+ add(new SimpleDateFormat("MMM dd HH:mm:ss.SSS zzz"));
+ add(new SimpleDateFormat("MMM dd HH:mm:ss.SSS"));
--- End diff --
So, the default at present in the case of no year is the default for SDF,
which is 1970. Probably not what we're after. I'll fix that to present year. In
the case of no timezone, I would trend to prefer we assumed UTC (I would
actually prefer it if all dates anywhere in Metron were assumed to be UTC
targeted, but that's a bigger debate). At present it would assume TZ for the
locale, which is not passed, ergo defaults to UTC. This feels like an easy
option, though there is an argument for pulling TZ fields out of CEF. Of course
the spec doesn't specify anything on TZ, or indeed any fields that would
indicate the local TZ of the log source, which means we can't really do
anything but assume UTC.
Please let me know if you're aware of anything that might make this
clearer, or if you have anything from HPE on this.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
