beenull/crowdsec
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Add parse unix to dateparse enricher (#1958)

Browse source 
Add parse unix is we do have a strTime but wasnt parsed using convential golang time
This commit is contained in:
Laurence Jones 2022-12-30 12:47:14 +00:00 committed by GitHub
parent 59f6610721
commit fd1c38811e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 16 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
pkg/parser/enrich_date.go
View file

@ -3,6 +3,7 @@ package parser
import ( import (
"time" "time"
expr "github.com/crowdsecurity/crowdsec/pkg/exprhelpers"
"github.com/crowdsecurity/crowdsec/pkg/types" "github.com/crowdsecurity/crowdsec/pkg/types"
log "github.com/sirupsen/logrus" log "github.com/sirupsen/logrus"
) )
@ -59,20 +60,25 @@ func ParseDate(in string, p *types.Event, x interface{}, plog *log.Entry) (map[s
var ret map[string]string = make(map[string]string) var ret map[string]string = make(map[string]string)
var strDate string var strDate string
var parsedDate time.Time var parsedDate time.Time
if in != "" {
if p.StrTimeFormat != "" { if p.StrTimeFormat != "" {
strDate, parsedDate = parseDateWithFormat(in, p.StrTimeFormat) strDate, parsedDate = parseDateWithFormat(in, p.StrTimeFormat)
if !parsedDate.IsZero() {
ret["MarshaledTime"] = strDate
return ret, nil
}
plog.Debugf("unable to parse '%s' with layout '%s'", in, p.StrTimeFormat)
}
strDate, parsedDate = GenDateParse(in)
if !parsedDate.IsZero() { if !parsedDate.IsZero() {
ret["MarshaledTime"] = strDate ret["MarshaledTime"] = strDate
return ret, nil return ret, nil
} else {
plog.Debugf("unable to parse '%s' with layout '%s'", in, p.StrTimeFormat)
} }
} strDate = expr.ParseUnix(in)
strDate, parsedDate = GenDateParse(in) if strDate != "" {
if !parsedDate.IsZero() { ret["MarshaledTime"] = strDate
ret["MarshaledTime"] = strDate return ret, nil
return ret, nil }
} }
plog.Debugf("no suitable date format found for '%s', falling back to now", in) plog.Debugf("no suitable date format found for '%s', falling back to now", in)
now := time.Now().UTC() now := time.Now().UTC()