Fix in log date parsing at predecoding stage

[ncvicchi]

Related issue
#15772

Description

This pull request fixes an incorrect log date parsing reported by a community user, where a syslog-ng date format has a fraction of seconds with 3 digits instead of 6.

Along with the fix, several date format unit tests have been added to perform verifications.

Thanks to these unit tests, a problem in parsing proftpd 1.3.5 date format was also found and fixed.

ProFTPD 1.3.5 log fixed error

An error was found when a unit test was developed for this use case. The date format is similar to:
2015-04-16 21:51:02,805. But the parsed date missed the last character, resulting in 2015-04-16 21:51:02,80.

Tests

• Compilation without warnings in every supported platform
  • Linux
• Review logs syntax and correct language
• Added unit tests

Unit Tests Log

2/160 Testing: test_cleanevent
2/160 Test: test_cleanevent
Command: "/home/beto/wazuh/wazuh/src/unit_tests/build/analysisd/test_cleanevent"
Directory: /home/beto/wazuh/wazuh/src/unit_tests/build/analysisd
"test_cleanevent" start time: Jan 04 19:32 -03
Output:
----------------------------------------------------------
[==========] Running 25 test(s).
[ RUN      ] test_OS_CleanMSG_fail
[       OK ] test_OS_CleanMSG_fail
[ RUN      ] test_OS_CleanMSG_fail_short_msg
[       OK ] test_OS_CleanMSG_fail_short_msg
[ RUN      ] test_OS_CleanMSG_ossec_min_msg
[       OK ] test_OS_CleanMSG_ossec_min_msg
[ RUN      ] test_OS_CleanMSG_ossec_arrow_msg
[       OK ] test_OS_CleanMSG_ossec_arrow_msg
[ RUN      ] test_OS_CleanMSG_ossec_test_msg
[       OK ] test_OS_CleanMSG_ossec_test_msg
[ RUN      ] test_OS_CleanMSG_ossec_syslog_msg
[       OK ] test_OS_CleanMSG_ossec_syslog_msg
[ RUN      ] test_OS_CleanMSG_syslog_ipv4_msg
[       OK ] test_OS_CleanMSG_syslog_ipv4_msg
[ RUN      ] test_OS_CleanMSG_syslog_ipv6_msg
[       OK ] test_OS_CleanMSG_syslog_ipv6_msg
[ RUN      ] test_OS_CleanMSG_syslog_isodate_timestamp
[       OK ] test_OS_CleanMSG_syslog_isodate_timestamp
[ RUN      ] test_OS_CleanMSG_rsyslog_timestamp
[       OK ] test_OS_CleanMSG_rsyslog_timestamp
[ RUN      ] test_OS_CleanMSG_syslog_ng_isodate_timestamp
[       OK ] test_OS_CleanMSG_syslog_ng_isodate_timestamp
[ RUN      ] test_OS_CleanMSG_proftpd_1_3_5_timestamp
[       OK ] test_OS_CleanMSG_proftpd_1_3_5_timestamp
[ RUN      ] test_OS_CleanMSG_macos_ULS_syslog_timestamp
[       OK ] test_OS_CleanMSG_macos_ULS_syslog_timestamp
[ RUN      ] test_OS_CleanMSG_timestamp
[       OK ] test_OS_CleanMSG_timestamp
[ RUN      ] test_OS_CleanMSG_osx_asl_timestamp
[       OK ] test_OS_CleanMSG_osx_asl_timestamp
[ RUN      ] test_OS_CleanMSG_apache_timestamp
[       OK ] test_OS_CleanMSG_apache_timestamp
[ RUN      ] test_OS_CleanMSG_suricata_timestamp
[       OK ] test_OS_CleanMSG_suricata_timestamp
[ RUN      ] test_OS_CleanMSG_snort_timestamp
[       OK ] test_OS_CleanMSG_snort_timestamp
[ RUN      ] test_OS_CleanMSG_xferlog_timestamp
[       OK ] test_OS_CleanMSG_xferlog_timestamp
[ RUN      ] test_extract_module_from_message
[       OK ] test_extract_module_from_message
[ RUN      ] test_extract_module_from_message_arrow
[       OK ] test_extract_module_from_message_arrow
[ RUN      ] test_extract_module_from_message_end_error
[       OK ] test_extract_module_from_message_end_error
[ RUN      ] test_extract_module_from_message_arrow_error
[       OK ] test_extract_module_from_message_arrow_error
[ RUN      ] test_extract_module_from_location
[       OK ] test_extract_module_from_location
[ RUN      ] test_extract_module_from_location_arrow
[       OK ] test_extract_module_from_location_arrow
[==========] 25 test(s) run.
[  PASSED  ] 25 test(s).
<end of output>
Test time =   0.15 sec
----------------------------------------------------------
Test Passed.
"test_cleanevent" end time: Jan 04 19:32 -03
"test_cleanevent" time elapsed: 00:00:00
----------------------------------------------------------

[chemamartinez]

LGTM!

[jmv74211]

QA review

• Type: Manual testing.
• Status: Approved 🟢
• Testing issue: Test Analysisd timestamp granularity support fix wazuh-qa#3728
• Comments: Test Analysisd timestamp granularity support fix wazuh-qa#3728 (comment)

Note: The development has been approved even though the Solaris build checks are 🔴. The node where these checks are launched is under maintenance.

The base branch was changed.