Skip to content

Instantly share code, notes, and snippets.

@rossigee
Last active August 24, 2023 03:27
Show Gist options
  • Save rossigee/7ce48ece0d0c2e28893235579bb48b68 to your computer and use it in GitHub Desktop.
Save rossigee/7ce48ece0d0c2e28893235579bb48b68 to your computer and use it in GitHub Desktop.
Lua hack for RFC3164 timestamps
-- Hack to workaround lack of precision in RFC3164 dates.
require "os"
function rfc3164_to_timestamp(rfc3164_log)
local month_names = {
Jan = "01", Feb = "02", Mar = "03", Apr = "04",
May = "05", Jun = "06", Jul = "07", Aug = "08",
Sep = "09", Oct = "10", Nov = "11", Dec = "12"
}
local month, day, time = string.match(rfc3164_log, "(%a%a%a) +(%d%d?) +(%d%d:%d%d:%d%d)")
if not (month and day and time) then
return nil
end
local year = os.date("%Y")
local formatted_time = string.format("%s-%s-%02d %s", year, month_names[month], tonumber(day), time)
return formatted_time
end
function parseTimestamp(timestamp)
local year, month, day, hour, min, sec = timestamp:match("(%d+)-(%d+)-(%d+) (%d+):(%d+):(%d+)")
local epochTime = os.time({
year = year,
month = month,
day = day,
hour = hour,
min = min,
sec = sec
})
return epochTime
end
function filter(tag, timestamp, record)
local input_time = record["time"] -- Already parsed
local parsed_timestamp = rfc3164_to_timestamp(input_time)
if parsed_timestamp then
-- record["rfc3164_timestamp"] = input_time
record["time"] = parsed_timestamp
timestamp = parseTimestamp(parsed_timestamp)
end
return 1, timestamp, record
end
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment