github.com/crowdsecurity/crowdsec@v1.6.1/pkg/parser/enrich_date.go (about)

     1  package parser
     2  
     3  import (
     4  	"time"
     5  
     6  	log "github.com/sirupsen/logrus"
     7  
     8  	expr "github.com/crowdsecurity/crowdsec/pkg/exprhelpers"
     9  	"github.com/crowdsecurity/crowdsec/pkg/types"
    10  )
    11  
    12  func parseDateWithFormat(date, format string) (string, time.Time) {
    13  	t, err := time.Parse(format, date)
    14  	if err == nil && !t.IsZero() {
    15  		//if the year isn't set, set it to current date :)
    16  		if t.Year() == 0 {
    17  			t = t.AddDate(time.Now().UTC().Year(), 0, 0)
    18  		}
    19  		retstr, err := t.MarshalText()
    20  		if err != nil {
    21  			log.Warningf("Failed marshaling '%v'", t)
    22  			return "", time.Time{}
    23  		}
    24  		return string(retstr), t
    25  	}
    26  	return "", time.Time{}
    27  }
    28  
    29  func GenDateParse(date string) (string, time.Time) {
    30  	var (
    31  		layouts = [...]string{
    32  			time.RFC3339,
    33  			"02/Jan/2006:15:04:05 -0700",
    34  			"Mon Jan 2 15:04:05 2006",
    35  			"02-Jan-2006 15:04:05 europe/paris",
    36  			"01/02/2006 15:04:05",
    37  			"2006-01-02 15:04:05.999999999 -0700 MST",
    38  			"Jan  2 15:04:05",
    39  			"Mon Jan 02 15:04:05.000000 2006",
    40  			"2006-01-02T15:04:05Z07:00",
    41  			"2006/01/02",
    42  			"2006/01/02 15:04",
    43  			"2006-01-02",
    44  			"2006-01-02 15:04",
    45  			"2006/01/02 15:04:05",
    46  			"2006-01-02 15:04:05",
    47  		}
    48  	)
    49  
    50  	for _, dateFormat := range layouts {
    51  		retstr, parsedDate := parseDateWithFormat(date, dateFormat)
    52  		if !parsedDate.IsZero() {
    53  			return retstr, parsedDate
    54  		}
    55  	}
    56  	return "", time.Time{}
    57  }
    58  
    59  func ParseDate(in string, p *types.Event, x interface{}, plog *log.Entry) (map[string]string, error) {
    60  
    61  	var ret = make(map[string]string)
    62  	var strDate string
    63  	var parsedDate time.Time
    64  	if in != "" {
    65  		if p.StrTimeFormat != "" {
    66  			strDate, parsedDate = parseDateWithFormat(in, p.StrTimeFormat)
    67  			if !parsedDate.IsZero() {
    68  				ret["MarshaledTime"] = strDate
    69  				//In time machine, we take the time parsed from the event. In live mode, we keep the timestamp collected at acquisition
    70  				if p.ExpectMode == types.TIMEMACHINE {
    71  					p.Time = parsedDate
    72  				}
    73  				return ret, nil
    74  			}
    75  			plog.Debugf("unable to parse '%s' with layout '%s'", in, p.StrTimeFormat)
    76  		}
    77  		strDate, parsedDate = GenDateParse(in)
    78  		if !parsedDate.IsZero() {
    79  			ret["MarshaledTime"] = strDate
    80  			//In time machine, we take the time parsed from the event. In live mode, we keep the timestamp collected at acquisition
    81  			if p.ExpectMode == types.TIMEMACHINE {
    82  				p.Time = parsedDate
    83  			}
    84  			return ret, nil
    85  		}
    86  		timeobj, err := expr.ParseUnixTime(in)
    87  		if err == nil {
    88  			ret["MarshaledTime"] = timeobj.(time.Time).Format(time.RFC3339)
    89  			//In time machine, we take the time parsed from the event. In live mode, we keep the timestamp collected at acquisition
    90  			if p.ExpectMode == types.TIMEMACHINE {
    91  				p.Time = timeobj.(time.Time)
    92  			}
    93  			return ret, nil
    94  		}
    95  
    96  	}
    97  	plog.Debugf("no suitable date format found for '%s', falling back to now", in)
    98  	now := time.Now().UTC()
    99  	retstr, err := now.MarshalText()
   100  	if err != nil {
   101  		plog.Warning("Failed marshaling current time")
   102  		return ret, err
   103  	}
   104  	ret["MarshaledTime"] = string(retstr)
   105  
   106  	return ret, nil
   107  }
   108  
   109  func parseDateInit(cfg map[string]string) (interface{}, error) {
   110  	return nil, nil
   111  }