[format] tweaks to postgres

tstack · tstack · commit 408e9cb429ca · 2025-08-13T11:25:00.000-07:00
diff --git a/src/formats/postgres_log.json b/src/formats/postgres_log.json
@@ -4,15 +4,24 @@
         "description": "Format file generated from regex101 entry -- https://regex101.com/r/pwVch2/1",
         "regex": {
             "std": {
-                "pattern": "(?<timestamp>^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}\\.\\d{3} \\S+) \\[(?<pid>\\d+)\\] (?<level>DEBUG\\d|INFO|NOTICE|WARNING|ERROR|LOG|FATAL|PANIC|STATEMENT):\\s+(?<body>.*)$"
+                "pattern": "(?<timestamp>^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}(\\.\\d{3})? \\S+) \\[(?<pid>[\\d\\-]+)\\](?<host>\\s+\\[[^\\]]+\\])?(?<user>\\s+\\S+)? (?<level>DEBUG\\d?|DETAIL|CONTEXT|INFO|NOTICE|WARNING|ERROR|LOG|FATAL|PANIC|STATEMENT):\\s+(?<body>.*)$"
             }
         },
         "value": {
             "level": {
                 "kind": "string"
             },
             "pid": {
-                "kind": "string"
+                "kind": "string",
+                "identifier": true
+            },
+            "host": {
+                "kind": "string",
+                "identifier": true
+            },
+            "user": {
+                "kind": "string",
+                "identifier": true
             },
             "timestamp": {
                 "kind": "string"
@@ -21,6 +30,9 @@
         "sample": [
             {
                 "line": "2025-08-13 01:45:01.127 PDT [12347] LOG:  database system was shut down at 2025-08-13 01:44:58 PDT"
+            },
+            {
+                "line": "2025-06-05 17:10:04 MSK [608647-3] [local] postgres@postgres WARNING: terminating connection because of crash of another server process"
             }
         ]
     }
diff --git a/src/ptimec.hh b/src/ptimec.hh
@@ -66,6 +66,7 @@
     off_inout += 1;
 
 #define ABR_TO_INT(a, b, c) (((a) << 24) | ((b) << 16) | ((c) << 8))
+#define ABR_TO_INT4(a, b, c, d) (((a) << 24) | ((b) << 16) | ((c) << 8) | ((d)))
 
 inline bool
 ptime_upto(char ch, const char* str, off_t& off_inout, ssize_t len)
diff --git a/src/ptimec_rt.cc b/src/ptimec_rt.cc
@@ -64,9 +64,10 @@ ptime_Z_to_gmtoff(exttm* dst, const char* str, off_t& off_inout, ssize_t len)
     }
 
     auto zone_start = (unsigned char*) &str[off_inout];
-    uint32_t zone_int = ABR_TO_INT(zone_start[0] & ~0x20UL,
-                                   zone_start[1] & ~0x20UL,
-                                   zone_start[2] & ~0x20UL);
+    uint32_t zone_int = ABR_TO_INT4(zone_start[0] & ~0x20UL,
+                                    zone_start[1] & ~0x20UL,
+                                    zone_start[2] & ~0x20UL,
+                                    avail >= 4 ? zone_start[3] & ~0x20UL : 0);
     switch (zone_int) {
         case ABR_TO_INT('U', 'T', 'C'):
             PTIME_CONSUME(3, { dst->et_flags |= ETF_ZONE_SET | ETF_Z_IS_UTC; });
@@ -89,9 +90,15 @@ ptime_Z_to_gmtoff(exttm* dst, const char* str, off_t& off_inout, ssize_t len)
             dst->et_gmtoff = 1 * 60 * 60;
             break;
         case ABR_TO_INT('C', 'A', 'T'):
+        case ABR_TO_INT4('C', 'E', 'D', 'T'):
+        case ABR_TO_INT4('C', 'E', 'S', 'T'):
             PTIME_CONSUME(3, { dst->et_flags |= ETF_ZONE_SET; });
             dst->et_gmtoff = 2 * 60 * 60;
             break;
+        case ABR_TO_INT('M', 'S', 'K'):
+            PTIME_CONSUME(3, { dst->et_flags |= ETF_ZONE_SET; });
+            dst->et_gmtoff = 3 * 60 * 60;
+            break;
         case ABR_TO_INT('I', 'S', 'T'):
             PTIME_CONSUME(3, { dst->et_flags |= ETF_ZONE_SET; });
             dst->et_gmtoff = 5 * 60 * 60 + 30 * 60;
