Trim leading whitespaces after trimming timestamp from Logs (#1574)

plugins/inputs/logfile/fileconfig.go

@@ -211,8 +211,9 @@ func (config *FileConfig) timestampFromLogLine(logValue string) (time.Time, stri
 			}
 		}
 		if config.TrimTimestamp {
-			// Trim the entire timestamp portion (from start to end of the match)
-			return timestamp, logValue[:index[0]] + logValue[index[1]:]
+			// Trim the entire timestamp portion and leading whitespaces
+			// The whitespace characters being removed are: space, tab, newline, and carriage return ( " \t\n\r")
+			return timestamp, strings.TrimLeft(logValue[:index[0]]+logValue[index[1]:], " \t\n\r")
 		}
 		return timestamp, logValue
 	}

plugins/inputs/logfile/fileconfig_test.go

@@ -145,15 +145,15 @@ func TestTimestampParser(t *testing.T) {
 	// Test TrimTimeStamp for single line
 	fileConfig.TrimTimestamp = true
 	logEntry = fmt.Sprintf("%s [INFO] This is a test message.", timestampString)
-	trimmedTimestampString := " [INFO] This is a test message."
+	trimmedTimestampString := "[INFO] This is a test message."
 	timestamp, modifiedLogEntry = fileConfig.timestampFromLogLine(logEntry)
 	assert.Equal(t, expectedTimestamp.UnixNano(), timestamp.UnixNano(),
 		fmt.Sprintf("The timestampFromLogLine value %v is not the same as expected %v.", timestamp, expectedTimestamp))
 	assert.Equal(t, trimmedTimestampString, modifiedLogEntry)
 
 	// Test TrimTimeStamp for multiline, the first timestamp in multiline should be matched
 	logEntry = fmt.Sprintf("%s [INFO] This is the first line.\n19 Jun 2017 14:25:19 [INFO] This is the second line.\n", timestampString)
-	trimmedTimestampString = " [INFO] This is the first line.\n19 Jun 2017 14:25:19 [INFO] This is the second line.\n"
+	trimmedTimestampString = "[INFO] This is the first line.\n19 Jun 2017 14:25:19 [INFO] This is the second line.\n"
 	timestamp, modifiedLogEntry = fileConfig.timestampFromLogLine(logEntry)
 	assert.Equal(t, expectedTimestamp.UnixNano(), timestamp.UnixNano(),
 		fmt.Sprintf("The timestampFromLogLine value %v is not the same as expected %v.", timestamp, expectedTimestamp))
@@ -189,14 +189,20 @@ func TestTimestampParserWithPadding(t *testing.T) {
 	//Test when TrimTimeStamp is enabled
 	fileConfig.TrimTimestamp = true
 	logEntry = " 2 1 07:10:06 instance-id: i-02fce21a425a2efb3"
-	trimmedTimestampString := "  instance-id: i-02fce21a425a2efb3"
+	trimmedTimestampString := "instance-id: i-02fce21a425a2efb3"
 	timestamp, modifiedLogEntry = fileConfig.timestampFromLogLine(logEntry)
 	assert.Equal(t, 7, timestamp.Hour(), fmt.Sprintf("Timestamp does not match: %v, act: %v", "7", timestamp.Hour()))
 	assert.Equal(t, 10, timestamp.Minute(), fmt.Sprintf("Timestamp does not match: %v, act: %v", "10", timestamp.Minute()))
 	assert.Equal(t, trimmedTimestampString, modifiedLogEntry)
 
 	logEntry = "2 1 07:10:06 instance-id: i-02fce21a425a2efb3"
-	trimmedTimestampString = " instance-id: i-02fce21a425a2efb3"
+	timestamp, modifiedLogEntry = fileConfig.timestampFromLogLine(logEntry)
+	assert.Equal(t, 7, timestamp.Hour(), fmt.Sprintf("Timestamp does not match: %v, act: %v", "7", timestamp.Hour()))
+	assert.Equal(t, 10, timestamp.Minute(), fmt.Sprintf("Timestamp does not match: %v, act: %v", "10", timestamp.Minute()))
+	assert.Equal(t, trimmedTimestampString, modifiedLogEntry)
+
+	logEntry = " instance-id: i-02fce21a425a2efb3 2 1 07:10:06"
+	trimmedTimestampString = "instance-id: i-02fce21a425a2efb3 "
 	timestamp, modifiedLogEntry = fileConfig.timestampFromLogLine(logEntry)
 	assert.Equal(t, 7, timestamp.Hour(), fmt.Sprintf("Timestamp does not match: %v, act: %v", "7", timestamp.Hour()))
 	assert.Equal(t, 10, timestamp.Minute(), fmt.Sprintf("Timestamp does not match: %v, act: %v", "10", timestamp.Minute()))
@@ -247,7 +253,7 @@ func TestTimestampParserDefault(t *testing.T) {
 	// When TrimTimestamp is enabled, make sure layout is compatible for "Sep 9", "Sep  9" , "Sep 09", "Sep  09" options and log value is trimmed correctly
 	fileConfig.TrimTimestamp = true
 	logEntry = "Sep 9 02:00:43  ip-10-4-213-132 \n"
-	trimmedTimestampString := "  ip-10-4-213-132 \n"
+	trimmedTimestampString := "ip-10-4-213-132 \n"
 	timestamp, modifiedLogEntry = fileConfig.timestampFromLogLine(logEntry)
 	assert.Equal(t, 02, timestamp.Hour())
 	assert.Equal(t, 00, timestamp.Minute())
@@ -304,15 +310,15 @@ func TestTimestampParserWithFracSeconds(t *testing.T) {
 	// Test TrimTimeStamp for single line
 	fileConfig.TrimTimestamp = true
 	logEntry = fmt.Sprintf("%s [INFO] This is a test message.", timestampString)
-	trimmedTimestampString := " [INFO] This is a test message."
+	trimmedTimestampString := "[INFO] This is a test message."
 	timestamp, modifiedLogEntry = fileConfig.timestampFromLogLine(logEntry)
 	assert.Equal(t, expectedTimestamp.UnixNano(), timestamp.UnixNano(),
 		fmt.Sprintf("The timestampFromLogLine value %v is not the same as expected %v.", timestamp, expectedTimestamp))
 	assert.Equal(t, trimmedTimestampString, modifiedLogEntry)
 
 	// Test TrimTimeStamp for multiline, the first timestamp in multiline should be matched
 	logEntry = fmt.Sprintf("%s [INFO] This is the first line.\n19 Jun 2017 14:25:19,123456 UTC [INFO] This is the second line.\n", timestampString)
-	trimmedTimestampString = " [INFO] This is the first line.\n19 Jun 2017 14:25:19,123456 UTC [INFO] This is the second line.\n"
+	trimmedTimestampString = "[INFO] This is the first line.\n19 Jun 2017 14:25:19,123456 UTC [INFO] This is the second line.\n"
 	timestamp, modifiedLogEntry = fileConfig.timestampFromLogLine(logEntry)
 	assert.Equal(t, expectedTimestamp.UnixNano(), timestamp.UnixNano(),
 		fmt.Sprintf("The timestampFromLogLine value %v is not the same as expected %v.", timestamp, expectedTimestamp))