diff --git a/docs/v1.X/docs/references/expressions.md b/docs/v1.X/docs/references/expressions.md index c708d1f64..68f925009 100644 --- a/docs/v1.X/docs/references/expressions.md +++ b/docs/v1.X/docs/references/expressions.md @@ -60,3 +60,9 @@ Returns the uppercase version of the string Returns true if the IP `IPStr` is contained in the IP range `RangeStr` (uses `net.ParseCIDR`) > IpInRange("1.2.3.4", "1.2.3.0/24") + +## `TimeNow() string` + +Return RFC3339 formatted time + +> TimeNow() diff --git a/pkg/exprhelpers/exprlib.go b/pkg/exprhelpers/exprlib.go index cb468b2f0..510980528 100644 --- a/pkg/exprhelpers/exprlib.go +++ b/pkg/exprhelpers/exprlib.go @@ -9,6 +9,7 @@ import ( "regexp" "strconv" "strings" + "time" "github.com/davecgh/go-spew/spew" log "github.com/sirupsen/logrus" @@ -39,6 +40,7 @@ func GetExprEnv(ctx map[string]interface{}) map[string]interface{} { "RegexpInFile": RegexpInFile, "Upper": Upper, "IpInRange": IpInRange, + "TimeNow": TimeNow, } for k, v := range ctx { ExprLib[k] = v @@ -134,3 +136,7 @@ func IpInRange(ip string, ipRange string) bool { } return false } + +func TimeNow() string { + return time.Now().Format(time.RFC3339) +} diff --git a/pkg/exprhelpers/exprlib_test.go b/pkg/exprhelpers/exprlib_test.go index 9de65a23e..907d33312 100644 --- a/pkg/exprhelpers/exprlib_test.go +++ b/pkg/exprhelpers/exprlib_test.go @@ -2,6 +2,7 @@ package exprhelpers import ( "fmt" + "time" log "github.com/sirupsen/logrus" @@ -367,8 +368,20 @@ func TestUpper(t *testing.T) { expectedStr := "TEST" if Upper(testStr) != expectedStr { - t.Fatalf("Upper() should returned 1.5 as a float") + t.Fatalf("Upper() should returned test in upper case") } log.Printf("test 'Upper()' : OK") } + +func TestTimeNow(t *testing.T) { + ti, err := time.Parse(time.RFC3339, TimeNow()) + if err != nil { + t.Fatalf("Error parsing the return value of TimeNow: %s", err) + } + + if -1*time.Until(ti) > time.Second { + t.Fatalf("TimeNow func should return time.Now()") + } + log.Printf("test 'TimeNow()' : OK") +} diff --git a/pkg/parser/enrich.go b/pkg/parser/enrich.go index 76641ac71..f18909bbc 100644 --- a/pkg/parser/enrich.go +++ b/pkg/parser/enrich.go @@ -50,25 +50,26 @@ func Loadplugin(path string) ([]EnricherCtx, error) { } func GenDateParse(date string) (string, time.Time) { - var retstr string - var layouts = [...]string{ - time.RFC3339, - "02/Jan/2006:15:04:05 -0700", - "Mon Jan 2 15:04:05 2006", - "02-Jan-2006 15:04:05 europe/paris", - "01/02/2006 15:04:05", - "2006-01-02 15:04:05.999999999 -0700 MST", - //Jan 5 06:25:11 - "Jan 2 15:04:05", - "Mon Jan 02 15:04:05.000000 2006", - "2006-01-02T15:04:05Z07:00", - "2006/01/02", - "2006/01/02 15:04", - "2006-01-02", - "2006-01-02 15:04", - "2006/01/02 15:04:05", - "2006-01-02 15:04:05", - } + var ( + layouts = [...]string{ + time.RFC3339, + "02/Jan/2006:15:04:05 -0700", + "Mon Jan 2 15:04:05 2006", + "02-Jan-2006 15:04:05 europe/paris", + "01/02/2006 15:04:05", + "2006-01-02 15:04:05.999999999 -0700 MST", + //Jan 5 06:25:11 + "Jan 2 15:04:05", + "Mon Jan 02 15:04:05.000000 2006", + "2006-01-02T15:04:05Z07:00", + "2006/01/02", + "2006/01/02 15:04", + "2006-01-02", + "2006-01-02 15:04", + "2006/01/02 15:04:05", + "2006-01-02 15:04:05", + } + ) for _, dateFormat := range layouts { t, err := time.Parse(dateFormat, date) @@ -85,17 +86,24 @@ func GenDateParse(date string) (string, time.Time) { return string(retstr), t } } - return retstr, time.Time{} + + now := time.Now() + retstr, err := now.MarshalText() + if err != nil { + log.Warningf("Failed marshaling current time") + return "", time.Time{} + } + return string(retstr), now } func ParseDate(in string, p *types.Event, x interface{}) (map[string]string, error) { var ret map[string]string = make(map[string]string) - tstr, tbin := GenDateParse(in) if !tbin.IsZero() { ret["MarshaledTime"] = string(tstr) return ret, nil } + return nil, nil } diff --git a/pkg/parser/runtime.go b/pkg/parser/runtime.go index a701ff270..4c387173a 100644 --- a/pkg/parser/runtime.go +++ b/pkg/parser/runtime.go @@ -133,8 +133,11 @@ func (n *Node) ProcessStatics(statics []types.ExtraField, event *types.Event) er } if value == "" { - clog.Debugf("Empty value for %s, skip.", printStaticTarget(static)) - continue + //allow ParseDate to have empty input + if static.Method != "ParseDate" { + clog.Debugf("Empty value for %s, skip.", printStaticTarget(static)) + continue + } } if static.Method != "" {