Skip to content

parser_syslog: Optimize RFC5424 regex #5367

Description

@Watson1978

Describe the bug

The current regular expression used for parsing RFC5424 syslog messages
(RFC5424_WITHOUT_TIME_AND_PRI_REGEXP in lib/fluent/plugin/parser_syslog.rb)
contains an inefficient quantifier.

This is only observed on Ruby 3.2 and older.

To Reproduce

Receive RFC5424 formatted packet in in_syslog.

Expected behavior

Better performance.

Your Environment

- Fluentd version:
- Package version:
- Operating system:
- Kernel version:

Your Configuration

none

Your Error Log

none

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions