its been a while

agent/internal/logs/collector_parser_test.go

@@ -0,0 +1,60 @@
+package logs
+
+import (
+	"testing"
+	"time"
+)
+
+func TestApplyNginxAccessParserSetsParsedTimestamp(t *testing.T) {
+	event := NewEvent(time.Date(2026, time.April, 15, 18, 43, 7, 0, time.UTC))
+	event.SourceKind = "file"
+	event.Message = `192.168.2.40 - - [28/Jan/2026:17:43:43 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/8.0"`
+
+	if !applyNginxAccessParser(&event) {
+		t.Fatalf("expected nginx parser to match log line")
+	}
+
+	expected := "2026-01-28T17:43:43Z"
+	if event.Timestamp != expected {
+		t.Fatalf("expected parsed timestamp %s, got %s", expected, event.Timestamp)
+	}
+}
+
+func TestParseJSONTimestampSupportsEpochMillis(t *testing.T) {
+	event := NewEvent(time.Date(2026, time.April, 15, 18, 43, 7, 0, time.UTC))
+	event.SourceKind = "file"
+	event.Message = `{"timestamp":1700000000000,"message":"login event"}`
+
+	if !applyJSONParser(&event) {
+		t.Fatalf("expected json parser to parse payload")
+	}
+
+	expected := time.Unix(1700000000, 0).UTC().Format(time.RFC3339Nano)
+	if event.Timestamp != expected {
+		t.Fatalf("expected parsed timestamp %s, got %s", expected, event.Timestamp)
+	}
+}
+
+func TestParseSyslogTimestampHandlesYearRollover(t *testing.T) {
+	now := time.Date(2026, time.January, 1, 0, 0, 30, 0, time.UTC)
+	parsed, ok := parseSyslogTimestamp("Dec 31 23:59:59", now)
+	if !ok {
+		t.Fatalf("expected syslog timestamp to parse")
+	}
+	if parsed.Year() != 2025 {
+		t.Fatalf("expected year rollover to previous year, got %d", parsed.Year())
+	}
+}
+
+func TestMaybeSetParsedTimestampSkipsJournalAndServiceSources(t *testing.T) {
+	original := "2026-04-15T18:43:07Z"
+	event := Event{
+		Timestamp:  original,
+		SourceKind: "service",
+	}
+
+	maybeSetParsedTimestamp(&event, time.Date(2026, time.January, 1, 0, 0, 0, 0, time.UTC))
+	if event.Timestamp != original {
+		t.Fatalf("expected service timestamp to remain unchanged")
+	}
+}