Fix rfc5464 date parsing in the syslog input (#26419) (#26453)

(cherry picked from commit 0ae157e) Co-authored-by: Fae Charlton <fae.charlton@elastic.co>
elastic · Jun 24, 2021 · 8fe3d21 · 8fe3d21
1 parent d93e9bd
commit 8fe3d21
Show file tree

Hide file tree

Showing 5 changed files with 204 additions and 150 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -217,6 +217,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix default config template values for paths on oracle module: {pull}26276[26276]
 - Fix bug in aws-s3 input where the end of gzipped log files might have been discarded. {pull}26260[26260]
 - Fix bug in `httpjson` that prevented `first_event` getting updated. {pull}26407[26407]
+- Fix bug in the Syslog input that misparsed rfc5424 days starting with 0. {pull}26419[26419]
 
 *Filebeat*
 

diff --git a/filebeat/input/syslog/event.go b/filebeat/input/syslog/event.go
@@ -417,7 +417,7 @@ func bytesToInt(b []byte) int {
 
 func skipLeadZero(b []byte) []byte {
 	if len(b) > 1 && b[0] == '0' {
-		return b[1:len(b)]
+		return b[1:]
 	}
 	return b
 }
diff --git a/filebeat/input/syslog/parser/syslog_rfc5424.rl b/filebeat/input/syslog/parser/syslog_rfc5424.rl
@@ -18,7 +18,7 @@
   # timestamp
   DATE_FULLYEAR   = digit{4}>tok %year;
   DATE_MONTH      = (("0"[1-9]) | ("1"[0-2]))>tok %month_numeric;
-  DATE_MDAY       = (([12][0-9]) | ("3"[01]))>tok %day;
+  DATE_MDAY       = (("0"[1-9]) | ([12][0-9]) | ("3"[01]))>tok %day;
   FULL_DATE       = DATE_FULLYEAR "-" DATE_MONTH "-" DATE_MDAY;
 
   TIME_HOUR       = ([01][0-9] | "2"[0-3])>tok %hour;