add TimeNow in the exprlib helpers (#756)

* add TimeNow in the exprlib helpers
* add a default date when none is detected: when no date is recognised by ParseDate, then use time.Now()

docs/v1.X/docs/references/expressions.md

@@ -60,3 +60,9 @@ Returns the uppercase version of the string
 Returns true if the IP `IPStr` is contained in the IP range `RangeStr` (uses `net.ParseCIDR`)
 
 > IpInRange("1.2.3.4", "1.2.3.0/24")
+
+## `TimeNow() string`
+
+Return RFC3339 formatted time 
+
+> TimeNow()

pkg/exprhelpers/exprlib.go

@@ -9,6 +9,7 @@ import (
 	"regexp"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/davecgh/go-spew/spew"
 	log "github.com/sirupsen/logrus"
@@ -39,6 +40,7 @@ func GetExprEnv(ctx map[string]interface{}) map[string]interface{} {
 		"RegexpInFile":   RegexpInFile,
 		"Upper":          Upper,
 		"IpInRange":      IpInRange,
+		"TimeNow":        TimeNow,
 	}
 	for k, v := range ctx {
 		ExprLib[k] = v
@@ -134,3 +136,7 @@ func IpInRange(ip string, ipRange string) bool {
 	}
 	return false
 }
+
+func TimeNow() string {
+	return time.Now().Format(time.RFC3339)
+}

pkg/exprhelpers/exprlib_test.go

@@ -2,6 +2,7 @@ package exprhelpers
 
 import (
 	"fmt"
+	"time"
 
 	log "github.com/sirupsen/logrus"
 
@@ -367,8 +368,20 @@ func TestUpper(t *testing.T) {
 	expectedStr := "TEST"
 
 	if Upper(testStr) != expectedStr {
-		t.Fatalf("Upper() should returned 1.5 as a float")
+		t.Fatalf("Upper() should returned test in upper case")
 	}
 
 	log.Printf("test 'Upper()' : OK")
 }
+
+func TestTimeNow(t *testing.T) {
+	ti, err := time.Parse(time.RFC3339, TimeNow())
+	if err != nil {
+		t.Fatalf("Error parsing the return value of TimeNow: %s", err)
+	}
+
+	if -1*time.Until(ti) > time.Second {
+		t.Fatalf("TimeNow func should return time.Now()")
+	}
+	log.Printf("test 'TimeNow()' : OK")
+}

pkg/parser/enrich.go

@@ -50,25 +50,26 @@ func Loadplugin(path string) ([]EnricherCtx, error) {
 }
 
 func GenDateParse(date string) (string, time.Time) {
-	var retstr string
+	var (
-	var layouts = [...]string{
+		layouts = [...]string{
-		time.RFC3339,
+			time.RFC3339,
-		"02/Jan/2006:15:04:05 -0700",
+			"02/Jan/2006:15:04:05 -0700",
-		"Mon Jan 2 15:04:05 2006",
+			"Mon Jan 2 15:04:05 2006",
-		"02-Jan-2006 15:04:05 europe/paris",
+			"02-Jan-2006 15:04:05 europe/paris",
-		"01/02/2006 15:04:05",
+			"01/02/2006 15:04:05",
-		"2006-01-02 15:04:05.999999999 -0700 MST",
+			"2006-01-02 15:04:05.999999999 -0700 MST",
-		//Jan  5 06:25:11
+			//Jan  5 06:25:11
-		"Jan  2 15:04:05",
+			"Jan  2 15:04:05",
-		"Mon Jan 02 15:04:05.000000 2006",
+			"Mon Jan 02 15:04:05.000000 2006",
-		"2006-01-02T15:04:05Z07:00",
+			"2006-01-02T15:04:05Z07:00",
-		"2006/01/02",
+			"2006/01/02",
-		"2006/01/02 15:04",
+			"2006/01/02 15:04",
-		"2006-01-02",
+			"2006-01-02",
-		"2006-01-02 15:04",
+			"2006-01-02 15:04",
-		"2006/01/02 15:04:05",
+			"2006/01/02 15:04:05",
-		"2006-01-02 15:04:05",
+			"2006-01-02 15:04:05",
-	}
+		}
+	)
 
 	for _, dateFormat := range layouts {
 		t, err := time.Parse(dateFormat, date)
@@ -85,17 +86,24 @@ func GenDateParse(date string) (string, time.Time) {
 			return string(retstr), t
 		}
 	}
-	return retstr, time.Time{}
+
+	now := time.Now()
+	retstr, err := now.MarshalText()
+	if err != nil {
+		log.Warningf("Failed marshaling current time")
+		return "", time.Time{}
+	}
+	return string(retstr), now
 }
 
 func ParseDate(in string, p *types.Event, x interface{}) (map[string]string, error) {
 
 	var ret map[string]string = make(map[string]string)
-
 	tstr, tbin := GenDateParse(in)
 	if !tbin.IsZero() {
 		ret["MarshaledTime"] = string(tstr)
 		return ret, nil
 	}
+
 	return nil, nil
 }

pkg/parser/runtime.go

@@ -133,8 +133,11 @@ func (n *Node) ProcessStatics(statics []types.ExtraField, event *types.Event) er
 		}
 
 		if value == "" {
-			clog.Debugf("Empty value for %s, skip.", printStaticTarget(static))
+			//allow ParseDate to have empty input
-			continue
+			if static.Method != "ParseDate" {
+				clog.Debugf("Empty value for %s, skip.", printStaticTarget(static))
+				continue
+			}
 		}
 
 		if static.Method != "" {