ftsyslog

README

Fortigate Syslog Parser

Author: HansenH

This module efficiently parses Fortigate syslogs. It only traverse the byte slice once without using regular expressions.

Fortigate syslog format: DATETIME HOST <PRI>k=v k=v ...

Benchmarks

goos: windows
goarch: amd64
cpu: AMD Ryzen 7 PRO 4750U with Radeon Graphics
BenchmarkParse 1640402
7332 ns/op
5613 B/op
81 allocs/op

Documentation

Overview

Author: HansenH

This module parses Fortigate syslogs. (format: `DATETIME HOST <PRI>k=v k=v ...`). It only traverse the byte slice once without using regular expressions.

Author: HansenH

This module parses Fortigate syslogs. (format: `DATETIME HOST <PRI>k=v k=v ...`). It only traverse the byte slice once without using regular expressions.

Index

• type FtSyslog
  • func Parse(logBytes []byte) (*FtSyslog, error)
• type SyslogFormatError
  • func (e *SyslogFormatError) Error() string

Types

type FtSyslog

type FtSyslog struct {
	Datetime string
	Host     string
	PRI      string
	Msg      map[string]string // string values contain raw escaped chars with backslash.
}

func Parse

func Parse(logBytes []byte) (*FtSyslog, error)

When the parser believe the log format is incomplete or invalid it will return nil and SyslogFormatError (with specific position info).

Trivial deviations like different number of headers may not stop the parsing, but some of the parsed headers and K-Vs may be unaligned or missing.

type SyslogFormatError

type SyslogFormatError struct {
	// contains filtered or unexported fields
}

func (*SyslogFormatError) Error

func (e *SyslogFormatError) Error() string