syslog parser regexp is not working when message contains ] character

[rainoko]

• fluentd or td-agent version - v1.2.3 but exists in ealier versions also

fluentd/lib/fluent/plugin/parser_syslog.rb

Line 30 in 815e513

REGEXP_RFC5424 = /\A^(?<time>[^ ]+) (?<host>[^ ]+) (?<ident>[^ ]+) (?<pid>.{1,128}) (?<msgid>[^ ]+) (?<extradata>(\[(.*)\]|[^ ])) (?<message>.+)$\z/

1. regular expressions extradata part is little-bit too greedy. If message contains ] part of message is considered as extradata.
2. regular expression not accept empty message - causing parse error logs.
3. Pid is too greedy

Should be something like that

\A^\<(?<pri>[0-9]{1,3})\>[1-9]\d{0,2} (?<time>[^ ]+) (?<host>[^ ]+) (?<ident>[^ ]+) (?<pid>[^ ]+) (?<msgid>[^ ]+) (?<extradata>(\[([^\]]*)\]|[^ ])).?(?<message>.*)$\z

(?<pid>.{1,128})   -> (?<pid>[^ ]+)   pid should be anything until next space
(?<extradata>(\[(.*)\]|[^ ]))  ->  (?<extradata>(\[([^\]]*)\]|[^ ])) extradata may not contain ]
(?<message>.+)  ->  .?(?<message>.*) message should be optional

[okkez]

Could you show me the failed logs?

[okkez]

No response. Closing.
Feel free to reopen this issue or create a new issue, if you find a problem related to this issue.