61 lines
1.8 KiB
Go
61 lines
1.8 KiB
Go
package logs
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestApplyNginxAccessParserSetsParsedTimestamp(t *testing.T) {
|
|
event := NewEvent(time.Date(2026, time.April, 15, 18, 43, 7, 0, time.UTC))
|
|
event.SourceKind = "file"
|
|
event.Message = `192.168.2.40 - - [28/Jan/2026:17:43:43 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/8.0"`
|
|
|
|
if !applyNginxAccessParser(&event) {
|
|
t.Fatalf("expected nginx parser to match log line")
|
|
}
|
|
|
|
expected := "2026-01-28T17:43:43Z"
|
|
if event.Timestamp != expected {
|
|
t.Fatalf("expected parsed timestamp %s, got %s", expected, event.Timestamp)
|
|
}
|
|
}
|
|
|
|
func TestParseJSONTimestampSupportsEpochMillis(t *testing.T) {
|
|
event := NewEvent(time.Date(2026, time.April, 15, 18, 43, 7, 0, time.UTC))
|
|
event.SourceKind = "file"
|
|
event.Message = `{"timestamp":1700000000000,"message":"login event"}`
|
|
|
|
if !applyJSONParser(&event) {
|
|
t.Fatalf("expected json parser to parse payload")
|
|
}
|
|
|
|
expected := time.Unix(1700000000, 0).UTC().Format(time.RFC3339Nano)
|
|
if event.Timestamp != expected {
|
|
t.Fatalf("expected parsed timestamp %s, got %s", expected, event.Timestamp)
|
|
}
|
|
}
|
|
|
|
func TestParseSyslogTimestampHandlesYearRollover(t *testing.T) {
|
|
now := time.Date(2026, time.January, 1, 0, 0, 30, 0, time.UTC)
|
|
parsed, ok := parseSyslogTimestamp("Dec 31 23:59:59", now)
|
|
if !ok {
|
|
t.Fatalf("expected syslog timestamp to parse")
|
|
}
|
|
if parsed.Year() != 2025 {
|
|
t.Fatalf("expected year rollover to previous year, got %d", parsed.Year())
|
|
}
|
|
}
|
|
|
|
func TestMaybeSetParsedTimestampSkipsJournalAndServiceSources(t *testing.T) {
|
|
original := "2026-04-15T18:43:07Z"
|
|
event := Event{
|
|
Timestamp: original,
|
|
SourceKind: "service",
|
|
}
|
|
|
|
maybeSetParsedTimestamp(&event, time.Date(2026, time.January, 1, 0, 0, 0, 0, time.UTC))
|
|
if event.Timestamp != original {
|
|
t.Fatalf("expected service timestamp to remain unchanged")
|
|
}
|
|
}
|