From 8087dbf670ba0a003d01aaf6c948c2faf853a7bf Mon Sep 17 00:00:00 2001
From: Kenji Okimoto <okimoto@clear-code.com>
Date: Fri, 29 Mar 2019 10:42:18 +0900
Subject: [PATCH] Fix regular expression to parse grok

Signed-off-by: Kenji Okimoto <okimoto@clear-code.com>
---
 lib/fluent/plugin/grok.rb |  2 +-
 test/test_grok_parser.rb  | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/lib/fluent/plugin/grok.rb b/lib/fluent/plugin/grok.rb
index f493503..2635ea3 100644
--- a/lib/fluent/plugin/grok.rb
+++ b/lib/fluent/plugin/grok.rb
@@ -13,7 +13,7 @@ class GrokPatternNotFoundError < StandardError
              (?<pattern>[A-z0-9]+)
              (?::(?<subname>[@\[\]A-z0-9_:.-]+?)
                   (?::(?<type>(?:string|bool|integer|float|
-                                 time(?::.+)?|
+                                 time(?::.+?)?|
                                  array(?::.)?)))?)?
            )
          \}/x
diff --git a/test/test_grok_parser.rb b/test/test_grok_parser.rb
index a9abf46..d309928 100644
--- a/test/test_grok_parser.rb
+++ b/test/test_grok_parser.rb
@@ -359,6 +359,21 @@ class GrokParserTest < ::Test::Unit::TestCase
         assert_equal(event_time("28/Feb/2013:12:00:00 +0900", format: "%d/%b/%Y:%H:%M:%S %z"), time)
       end
     end
+
+    test "leading time type with following other type" do
+      d = create_driver(%[
+        <grok>
+          pattern \\[%{HTTPDATE:log_timestamp:time:%d/%b/%Y:%H:%M:%S %z}\\] %{GREEDYDATA:message}
+        </grok>
+      ])
+      expected_record = {
+        "log_timestamp" => event_time("03/Feb/2019:06:47:21 +0530", format: "%d/%b/%Y:%H:%M:%S %z"),
+        "message" => "Python-urllib/2.7"
+      }
+      d.instance.parse('[03/Feb/2019:06:47:21 +0530] Python-urllib/2.7') do |time, record|
+        assert_equal(expected_record, record)
+      end
+    end
   end
 
   private