syslog_loose 0.23.0

A loose parser for syslog messages.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108

//! Parsers for rfc 5424 specific formats.
use crate::{
    message::{Message, Protocol},
    parsers::{appname, digits, hostname, msgid, procid},
    pri::pri,
    structured_data::structured_data,
    timestamp::timestamp_3339,
};
use nom::{
    IResult, Parser as _,
    character::complete::{space0, space1},
    combinator::{map, rest},
};

/// Parse the version number - just a simple integer.
fn version(input: &str) -> IResult<&str, u32> {
    digits(input)
}

/// Parse the message as per RFC5424
pub(crate) fn parse(input: &str) -> IResult<&str, Message<&str>> {
    map(
        (
            pri,
            version,
            space1,
            timestamp_3339,
            space1,
            hostname,
            space1,
            appname,
            space1,
            procid,
            space1,
            msgid,
            space0,
            structured_data,
            space0,
            rest,
        ),
        |(
            pri,
            version,
            _,
            timestamp,
            _,
            hostname,
            _,
            appname,
            _,
            procid,
            _,
            msgid,
            _,
            structured_data,
            _,
            msg,
        )| Message {
            protocol: Protocol::RFC5424(version),
            facility: pri.0,
            severity: pri.1,
            timestamp,
            hostname,
            appname,
            procid: procid.map(|p| p.into()),
            msgid,
            structured_data,
            msg,
        },
    )
    .parse(input)
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::pri::{SyslogFacility, SyslogSeverity};
    use chrono::{Duration, prelude::*};

    #[test]
    fn parse_5424() {
        assert_eq!(
            parse("<34>1 2003-10-11T22:14:15.003Z mymachine.example.com su - ID47 - message")
                .unwrap(),
            (
                "",
                Message {
                    protocol: Protocol::RFC5424(1),
                    facility: Some(SyslogFacility::LOG_AUTH),
                    severity: Some(SyslogSeverity::SEV_CRIT),
                    timestamp: Some(
                        FixedOffset::west_opt(0)
                            .unwrap()
                            .with_ymd_and_hms(2003, 10, 11, 22, 14, 15,)
                            .unwrap()
                            + Duration::milliseconds(3)
                    ),
                    hostname: Some("mymachine.example.com"),
                    appname: Some("su"),
                    procid: None,
                    msgid: Some("ID47"),
                    structured_data: vec![],
                    msg: "message",
                }
            )
        )
    }
}