Add support for timestamp in RFC3339 format (#47)

Default Go log/syslog is sending syslog messages in that format:
https://github.com/golang/go/blob/9745eed4fd4160cfbf55e9dbbfa99aca5563b392/src/log/syslog/syslog.go#L294

That is not according to the standard:
"The TIMESTAMP field is the local time and is in the format of "Mmm dd hh:mm:ss" (without the quote marks)"
(https://tools.ietf.org/html/rfc3164#section-5.3)

But it is necessery if we want to parse lines sent by log/syslog.

One small fix, time.Stamp is same as those two formats:
-               "Jan 02 15:04:05",
-               "Jan  2 15:04:05",
+               time.Stamp,

Author: ianic

internal/syslogparser/rfc3164/rfc3164.go

@@ -142,8 +142,16 @@ func (p *Parser) parseTimestamp() (time.Time, error) {
 	var sub []byte
 
 	tsFmts := []string{
-		"Jan 02 15:04:05",
-		"Jan  2 15:04:05",
+		time.Stamp,
+		time.RFC3339,
+	}
+	// if timestamps starts with numeric try formats with different order
+	// it is more likely that timestamp is in RFC3339 format then
+	if c := p.buff[p.cursor]; c > '0' && c < '9' {
+		tsFmts = []string{
+			time.RFC3339,
+			time.Stamp,
+		}
 	}
 
 	found := false
@@ -163,7 +171,7 @@ func (p *Parser) parseTimestamp() (time.Time, error) {
 	}
 
 	if !found {
-		p.cursor = tsFmtLen
+		p.cursor = len(time.Stamp)
 
 		// XXX : If the timestamp is invalid we try to push the cursor one byte
 		// XXX : further, in case it is a space

internal/syslogparser/rfc3164/rfc3164_test.go

@@ -130,6 +130,46 @@ func (s *Rfc3164TestSuite) TestParseHeader_Valid(c *C) {
 	}
 
 	s.assertRfc3164Header(c, hdr, buff, 25, nil)
+
+	// expected header for next two tests
+	hdr = header{
+		timestamp: time.Date(now.Year(), time.October, 1, 22, 14, 15, 0, time.UTC),
+		hostname:  "mymachine",
+	}
+	// day with leading zero
+	buff = []byte("Oct 01 22:14:15 mymachine ")
+	s.assertRfc3164Header(c, hdr, buff, 25, nil)
+	// day with leading space
+	buff = []byte("Oct  1 22:14:15 mymachine ")
+	s.assertRfc3164Header(c, hdr, buff, 25, nil)
+
+}
+
+func (s *Rfc3164TestSuite) TestParseHeader_RFC3339Timestamp(c *C) {
+	buff := []byte("2018-01-12T22:14:15+00:00 mymachine app[101]: msg")
+	hdr := header{
+		timestamp: time.Date(2018, time.January, 12, 22, 14, 15, 0, time.UTC),
+		hostname:  "mymachine",
+	}
+	s.assertRfc3164Header(c, hdr, buff, 35, nil)
+}
+
+func (s *Rfc3164TestSuite) TestParser_ValidRFC3339Timestamp(c *C) {
+	buff := []byte("<34>2018-01-12T22:14:15+00:00 mymachine app[101]: msg")
+	p := NewParser(buff)
+	err := p.Parse()
+	c.Assert(err, IsNil)
+	obtained := p.Dump()
+	expected := syslogparser.LogParts{
+		"timestamp": time.Date(2018, time.January, 12, 22, 14, 15, 0, time.UTC),
+		"hostname":  "mymachine",
+		"tag":       "app",
+		"content":   "msg",
+		"priority":  34,
+		"facility":  4,
+		"severity":  2,
+	}
+	c.Assert(obtained, DeepEquals, expected)
 }
 
 func (s *Rfc3164TestSuite) TestParseHeader_InvalidTimestamp(c *C) {