Add DetectRFC()

README.md

@@ -78,6 +78,26 @@ You should see
     proc_id : -
     structured_data : [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"]
 
+Detecting message format
+------------------------
+
+You can use the `WhichRFC()` function. Like this:
+
+	b := []byte(`<165>1 2003-10-11T22:14:15.003Z ...`)
+	rfc, err := syslogparser.DetectRFC(b)
+	if err != nil {
+		panic(err)
+	}
+
+	switch rfc {
+	case RFC_UNKNOWN:
+		fmt.Println("unknown")
+	case RFC_3164:
+		fmt.Println("3164")
+	case RFC_5424:
+		fmt.Println("5424")
+	}
+
 Running tests
 -------------
 

syslogparser.go

@@ -30,6 +30,14 @@ var (
 	ErrTimestampUnknownFormat = &ParserError{"Timestamp format unknown"}
 )
 
+type RFC uint8
+
+const (
+	RFC_UNKNOWN = iota
+	RFC_3164
+	RFC_5424
+)
+
 type LogParser interface {
 	Parse() error
 	Dump() LogParts
@@ -204,3 +212,27 @@ func ShowCursorPos(buff []byte, cursor int) {
 func (err *ParserError) Error() string {
 	return err.ErrorString
 }
+
+func DetectRFC(buff []byte) (RFC, error) {
+	max := 10
+	var v int
+	var err error
+
+	for i := 0; i < max; i++ {
+		if buff[i] == '>' && i < max {
+			x := i + 1
+			v, err = ParseVersion(buff, &x, max)
+			break
+		}
+	}
+
+	if err != nil {
+		return RFC_UNKNOWN, err
+	}
+
+	if v == NO_VERSION {
+		return RFC_3164, nil
+	}
+
+	return RFC_5424, nil
+}

syslogparser_test.go

@@ -1,8 +1,9 @@
 package syslogparser
 
 import (
-	. "gopkg.in/check.v1"
 	"testing"
+
+	. "gopkg.in/check.v1"
 )
 
 // Hooks up gocheck into the gotest runner.
@@ -122,6 +123,20 @@ func (s *CommonTestSuite) TestParseHostname_Valid(c *C) {
 	s.assertHostname(c, hostname, buff, start, len(hostname), nil)
 }
 
+func (s *CommonTestSuite) TestDetectRFC_3164(c *C) {
+	p, err := DetectRFC([]byte("<34>Oct 11 22:14:15 ..."))
+
+	c.Assert(err, Equals, nil)
+	c.Assert(p, Equals, RFC(RFC_3164))
+}
+
+func (s *CommonTestSuite) TestDetectRFC_5424(c *C) {
+	p, err := DetectRFC([]byte("<165>1 2003-10-11T22:14:15.003Z ..."))
+
+	c.Assert(err, Equals, nil)
+	c.Assert(p, Equals, RFC(RFC_5424))
+}
+
 func (s *CommonTestSuite) BenchmarkParsePriority(c *C) {
 	buff := []byte("<190>")
 	var start int
@@ -150,6 +165,17 @@ func (s *CommonTestSuite) BenchmarkParseVersion(c *C) {
 	}
 }
 
+func (s *CommonTestSuite) BenchmarkDetectRFC(c *C) {
+	buff := []byte("<165>1 2003-10-11T22:14:15.003Z ...")
+
+	for i := 0; i < c.N; i++ {
+		_, err := DetectRFC(buff)
+		if err != nil {
+			panic(err)
+		}
+	}
+}
+
 func (s *CommonTestSuite) assertPriority(c *C, p Priority, b []byte, cursor int, expC int, e error) {
 	obtained, err := ParsePriority(b, &cursor, len(b))
 	c.Assert(obtained, DeepEquals, p)