fluentd 1.19.3 → 1.20.0

data/lib/fluent/plugin/in_unix.rb

@@ -19,7 +19,7 @@ require 'fluent/plugin/input'
 require 'fluent/msgpack_factory'
 
 require 'cool.io'
-require 'yajl'
+require 'json'
 require 'fileutils'
 require 'socket'
 
@@ -158,8 +158,7 @@ module Fluent::Plugin
         first = data[0]
         if first == '{'.freeze || first == '['.freeze
           m = method(:on_read_json)
-          @parser = Yajl::Parser.new
-          @parser.on_parse_complete = @on_message
+          @parser = JSON::ResumableParser.new(**Fluent::DEFAULT_JSON_PARSE_OPTIONS)
         else
           m = method(:on_read_msgpack)
           @parser = Fluent::MessagePackFactory.msgpack_unpacker
@@ -173,6 +172,9 @@ module Fluent::Plugin
 
       def on_read_json(data)
         @parser << data
+        while @parser.parse
+          @on_message.call(@parser.value)
+        end
       rescue => e
         @log.error "unexpected error in json payload", error: e.to_s
         @log.error_backtrace

data/lib/fluent/plugin/out_exec_filter.rb

@@ -17,7 +17,7 @@ require 'fluent/plugin/output'
 require 'fluent/env'
 require 'fluent/config/error'
 
-require 'yajl'
+require 'json'
 
 module Fluent::Plugin
   class ExecFilterOutput < Output
@@ -309,7 +309,7 @@ module Fluent::Plugin
       router.emit(tag, time, record)
     rescue => e
       if @suppress_error_log_interval == 0 || Time.now.to_i > @next_log_time
-        log.error "exec_filter failed to emit", record: Yajl.dump(record), error: e
+        log.error "exec_filter failed to emit", record: JSON.generate(record), error: e
         log.error_backtrace e.backtrace
         @next_log_time = Time.now.to_i + @suppress_error_log_interval
       end

data/lib/fluent/plugin/out_file.rb

@@ -75,9 +75,8 @@ module Fluent::Plugin
       def metadata(timekey: nil, tag: nil, variables: nil)
         metadata = super
 
-        @latest_metadata ||= new_metadata(timekey: 0)
-        if metadata.timekey && (metadata.timekey >= @latest_metadata.timekey)
-          @latest_metadata = metadata
+        if newer_timekey?(metadata.timekey)
+          synchronize { @latest_timekey = metadata.timekey if newer_timekey?(metadata.timekey) }
         end
 
         metadata
@@ -97,7 +96,8 @@ module Fluent::Plugin
         # timekey will be appended into that file chunk. On the other side, resumed file chunks might NOT
         # have timekey, especially in the cases that resumed file chunks are generated by Fluentd v0.12.
         # These chunks will be enqueued immediately, and will be flushed soon.
-        if chunk.metadata == @latest_metadata
+        # Split chunks (seq > 0) are generated outside the buffer lock, so ln_sf would race between threads.
+        if chunk.metadata.timekey && chunk.metadata.seq == 0 && chunk.metadata.timekey == @latest_timekey
           sym_path = @_output_plugin_for_symlink.extract_placeholders(@_symlink_path, chunk)
           FileUtils.mkdir_p(File.dirname(sym_path), mode: @_output_plugin_for_symlink.dir_perm)
           if @_output_plugin_for_symlink.symlink_path_use_relative
@@ -109,6 +109,12 @@ module Fluent::Plugin
         end
         chunk
       end
+
+      private
+
+      def newer_timekey?(timekey)
+        timekey && (@latest_timekey.nil? || timekey > @latest_timekey)
+      end
     end
 
     def configure(conf)

data/lib/fluent/plugin/out_forward/connection_manager.rb

@@ -78,6 +78,24 @@ module Fluent::Plugin
         end
       end
 
+      # Drop a socket instead of returning it to the keepalive reuse pool.
+      #
+      # Used when a chunk's ack timed out or came back with a mismatched chunk
+      # id: such a connection may still carry an in-flight/stale ack for a
+      # previous chunk. Reusing it would let that stale ack be read against a
+      # chunk sent on the reused socket, permanently offsetting every following
+      # ack and flooding the log with 'ack in response and chunk id in sent data
+      # are different' warnings (see #4057). Revoking removes it from the pool so
+      # the next chunk uses a fresh connection with a clean ack stream.
+      def discard(sock)
+        if @socket_cache
+          @socket_cache.revoke(sock)
+        else
+          sock.close_write rescue nil
+          sock.close rescue nil
+        end
+      end
+
       private
 
       def connect_keepalive(host:, port:, hostname:, ack: nil)

data/lib/fluent/plugin/out_forward.rb

@@ -119,6 +119,8 @@ module Fluent::Plugin
     config_param :keepalive, :bool, default: false
     desc "Expired time of keepalive. Default value is nil, which means to keep connection as long as possible"
     config_param :keepalive_timeout, :time, default: nil
+    desc 'Check the remote connection is still available by sending a keepalive packet if this value is true.'
+    config_param :send_keepalive_packet, :bool, default: false
 
     config_section :security, required: false, multi: false do
       desc 'The hostname'
@@ -270,6 +272,10 @@ module Fluent::Plugin
         log.warn('The value of keepalive_timeout is ignored. if you want to use keepalive, please add `keepalive true` to your conf.')
       end
 
+      if @send_keepalive_packet && !@keepalive
+        raise Fluent::ConfigError, "'send_keepalive_packet' is enabled but 'keepalive' is not. Enable 'keepalive' to use TCP keepalive."
+      end
+
       raise Fluent::ConfigError, "ack_response_timeout must be a positive integer" if @ack_response_timeout < 1
 
       if @compress == :zstd
@@ -414,6 +420,7 @@ module Fluent::Plugin
           send_timeout: @send_timeout,
           recv_timeout: @ack_response_timeout,
           connect_timeout: @connect_timeout,
+          send_keepalive_packet: @send_keepalive_packet,
           &block
         )
       when :tcp
@@ -423,6 +430,7 @@ module Fluent::Plugin
           send_timeout: @send_timeout,
           recv_timeout: @ack_response_timeout,
           connect_timeout: @connect_timeout,
+          send_keepalive_packet: @send_keepalive_packet,
           &block
         )
       else
@@ -525,17 +533,28 @@ module Fluent::Plugin
 
     def ack_check(select_interval)
       @ack_handler.collect_response(select_interval) do |chunk_id, node, sock, result|
-        @connection_manager.close(sock)
-
         case result
         when AckHandler::Result::SUCCESS
+          @connection_manager.close(sock)
           commit_write(chunk_id)
         when AckHandler::Result::FAILED
+          # The ack timed out or the peer closed the connection. A keepalive
+          # socket may still have an in-flight ack for this chunk, so drop it
+          # instead of returning it to the reuse pool; otherwise a late ack
+          # could later be read against a chunk sent on the reused socket (#4057).
+          @connection_manager.discard(sock)
           node&.disable!
           rollback_write(chunk_id, update_retry: false) if chunk_id
         when AckHandler::Result::CHUNKID_UNMATCHED
+          # The ack read from this socket belongs to a different chunk than the
+          # one tracked for it: the keepalive connection's ack stream is out of
+          # sync (e.g. a stale ack left over from before an aggregator restart).
+          # Discard the socket so the following acks are not each offset by one,
+          # which would otherwise flood the log with mismatch warnings (#4057).
+          @connection_manager.discard(sock)
           rollback_write(chunk_id, update_retry: false)
         else
+          @connection_manager.close(sock)
           log.warn("BUG: invalid status #{result} #{chunk_id}")
 
           if chunk_id

data/lib/fluent/plugin/out_http.rb

@@ -22,16 +22,6 @@ require 'fluent/tls'
 require 'fluent/plugin/output'
 require 'fluent/plugin_helper/socket'
 
-# patch Net::HTTP to support extra_chain_cert which was added in Ruby feature #9758.
-# see: https://github.com/ruby/ruby/commit/31af0dafba6d3769d2a39617c0dddedb97883712
-unless Net::HTTP::SSL_IVNAMES.include?(:@extra_chain_cert)
-  class Net::HTTP
-    SSL_IVNAMES << :@extra_chain_cert
-    SSL_ATTRIBUTES << :extra_chain_cert
-    attr_accessor :extra_chain_cert
-  end
-end
-
 module Fluent::Plugin
   class HTTPOutput < Output
     Fluent::Plugin.register_output('http', self)

data/lib/fluent/plugin/output.rb

@@ -28,6 +28,7 @@ require 'fluent/unique_id'
 require 'fluent/clock'
 require 'fluent/ext_monitor_require'
 
+require 'json'
 require 'time'
 
 module Fluent
@@ -44,8 +45,21 @@ module Fluent
       CHUNK_KEY_PLACEHOLDER_PATTERN = /\$\{([-_.@$a-zA-Z0-9]+)\}/
       CHUNK_TAG_PLACEHOLDER_PATTERN = /\$\{(tag(?:\[-?\d+\])?)\}/
       CHUNK_ID_PLACEHOLDER_PATTERN = /\$\{chunk_id\}/
-      INVALID_PATH_COMPONENT_PATTERN = %r{\.\.[/\\]|^[/\\]}
-      PARENT_DIRECTORY_PATTERN = %r{\.\.[/\\]}
+
+      # Matches absolute paths, including the POSIX root, Windows drive roots, and UNC paths (e.g., \\host\share).
+      # It also accounts for forward slashes used as directory separators in Windows.
+      ABSOLUTE_PATH_PATTERN = %r{\A[/\\]}
+      # Matches Windows drive specifications.
+      # A trailing separator after the colon is not required, because a drive-relative path like C:Windows can still escape a relative path template.
+      WINDOWS_DRIVE_PATTERN = %r{\A[a-zA-Z]:}
+      # Matches .. only when it acts as an independent path component (e.g., ../etc or foo/..),
+      # ignoring dots embedded within strings like app..web or a..b/c.
+      # It uses zero-width negative lookarounds to avoid consuming characters.
+      # This ensures that adjacent components like /a/../../b are accurately detected and counted without missing any.
+      PARENT_DIRECTORY_PATTERN = %r{(?<![^/\\])\.\.(?![^/\\])}
+
+      INVALID_PATH_COMPONENT_PATTERN =
+        Regexp.union(ABSOLUTE_PATH_PATTERN, WINDOWS_DRIVE_PATTERN, PARENT_DIRECTORY_PATTERN)
 
       CHUNKING_FIELD_WARN_NUM = 4
 
@@ -878,12 +892,13 @@ module Fluent
 
               replace
             end
-            # Check if the number of parent directory components (../) has increased due to variable substitution
-            if rvalue.match?(PARENT_DIRECTORY_PATTERN)
-              if rvalue.scan(PARENT_DIRECTORY_PATTERN).size > str.scan(PARENT_DIRECTORY_PATTERN).size
-                raise Fluent::UnrecoverableError, "Invalid path component detected, replaced to: #{rvalue}"
-              end
-            end
+          end
+
+          # Verifies that the number of parent directory traversals (..) has not increased after variable substitution.
+          # While each replaced value is validated individually, this step prevents harmless values from concatenating into a dangerous path (e.g., ${tag}${key}/ becoming ../ if both tag and key are .).
+          if rvalue.match?(PARENT_DIRECTORY_PATTERN) &&
+             rvalue.scan(PARENT_DIRECTORY_PATTERN).size > str.scan(PARENT_DIRECTORY_PATTERN).size
+            raise Fluent::UnrecoverableError, "Invalid path component detected, replaced to: #{rvalue}"
           end
 
           if rvalue =~ CHUNK_KEY_PLACEHOLDER_PATTERN
@@ -943,39 +958,47 @@ module Fluent
           return Struct.new(:timekey, :tag, :variables).new
         end
 
+        timekey = @chunk_key_time ? calculate_timekey(time) : nil
+        @_metadata_cache ||= MetadataCache.new
+
         # timekey is int from epoch, and `timekey - timekey % 60` is assumed to mach with 0s of each minutes.
         # it's wrong if timezone is configured as one which supports leap second, but it's very rare and
         # we can ignore it (especially in production systems).
         if @chunk_keys.empty?
-          if !@chunk_key_time && !@chunk_key_tag
-            @buffer.metadata()
-          elsif @chunk_key_time && @chunk_key_tag
-            timekey = calculate_timekey(time)
-            @buffer.metadata(timekey: timekey, tag: tag)
-          elsif @chunk_key_time
-            timekey = calculate_timekey(time)
-            @buffer.metadata(timekey: timekey)
-          else
-            @buffer.metadata(tag: tag)
-          end
+          return @_metadata_cache.metadata if @_metadata_cache.cached?(timekey: timekey, tag: tag)
+
+          meta = if @chunk_key_time && @chunk_key_tag
+                   @buffer.metadata(timekey: timekey, tag: tag)
+                 elsif @chunk_key_time
+                   @buffer.metadata(timekey: timekey)
+                 elsif @chunk_key_tag
+                   @buffer.metadata(tag: tag)
+                 else
+                   @buffer.metadata()
+                 end
+
+          @_metadata_cache.update(timekey: timekey, tag: tag, metadata: meta)
+          meta
         else
-          timekey = if @chunk_key_time
-                      calculate_timekey(time)
-                    else
-                      nil
-                    end
           pairs = Hash[@chunk_key_accessors.map { |k, a| [k, a.call(record)] }]
-          @buffer.metadata(timekey: timekey, tag: (@chunk_key_tag ? tag : nil), variables: pairs)
+          return @_metadata_cache.metadata if @_metadata_cache.cached?(timekey: timekey, tag: tag, variables: pairs)
+
+          meta = @buffer.metadata(timekey: timekey, tag: (@chunk_key_tag ? tag : nil), variables: pairs)
+          @_metadata_cache.update(timekey: timekey, tag: tag, variables: pairs, metadata: meta)
+          meta
         end
       end
 
       def calculate_timekey(time)
         time_int = time.to_i
+        return @calculate_timekey_last_timekey if @calculate_timekey_last_time_int == time_int
+
+        @calculate_timekey_last_time_int = time_int
         if @timekey_use_utc
-          (time_int - (time_int % @timekey)).to_i
+          @calculate_timekey_last_timekey = (time_int - (time_int % @timekey)).to_i
         else
           offset = @calculate_offset ? @calculate_offset.call(time) : @offset
-          (time_int - ((time_int + offset)% @timekey)).to_i
+          @calculate_timekey_last_timekey = (time_int - ((time_int + offset) % @timekey)).to_i
         end
       end
 
@@ -1212,7 +1235,7 @@ module Fluent
         end
       end
 
-      UNRECOVERABLE_ERRORS = [Fluent::UnrecoverableError, TypeError, ArgumentError, NoMethodError, MessagePack::UnpackError, EncodingError]
+      UNRECOVERABLE_ERRORS = [Fluent::UnrecoverableError, TypeError, ArgumentError, NoMethodError, MessagePack::UnpackError, EncodingError, JSON::GeneratorError]
 
       def try_flush
         chunk = @buffer.dequeue_chunk
@@ -1319,9 +1342,14 @@ module Fluent
         if @buffer.disable_chunk_backup
           log.warn "disable_chunk_backup is true. #{dump_unique_id_hex(chunk.unique_id)} chunk is thrown away"
         else
-          @buffer.backup(chunk.unique_id) { |f|
-            chunk.write_to(f)
-          }
+          begin
+            @buffer.backup(chunk.unique_id) { |f|
+              chunk.write_to(f)
+            }
+          rescue => e
+            log.warn "failed to back up #{dump_unique_id_hex(chunk.unique_id)} chunk. it is thrown away", error: e
+            log.warn_backtrace
+          end
         end
         commit_write(chunk.unique_id, secondary: using_secondary, delayed: delayed_commit)
       end
@@ -1634,5 +1662,27 @@ module Fluent
         { 'output' => stats }
       end
     end
+
+    class MetadataCache
+      attr_reader :metadata
+
+      def initialize
+        @timekey = nil
+        @tag = nil
+        @variables = nil
+        @metadata = nil
+      end
+
+      def cached?(timekey:, tag:, variables: nil)
+        @metadata && @timekey == timekey && @tag == tag && @variables == variables
+      end
+
+      def update(timekey:, tag:, variables: nil, metadata:)
+        @timekey = timekey
+        @tag = tag
+        @variables = variables
+        @metadata = metadata
+      end
+    end
   end
 end

data/lib/fluent/plugin/parser_csv.rb

@@ -32,7 +32,7 @@ module Fluent
 
       def configure(conf)
         super
-
+        @key_num = @keys.length
 
         if @parser_engine == :fast
           @quote_char = '"'
@@ -46,13 +46,18 @@ module Fluent
       end
 
       def parse(text, &block)
+        r = {}
+        i = 0
         values = CSV.parse_line(text, col_sep: @delimiter)
         unless values
           yield nil, nil
           return
         end
 
-        r = Hash[@keys.zip(values)]
+        while i < @key_num
+          r[@keys[i]] = values[i]
+          i += 1
+        end
         time, record = convert_values(parse_time(r), r)
         yield time, record
       end

data/lib/fluent/plugin/parser_json.rb

@@ -14,11 +14,11 @@
 #    limitations under the License.
 #
 
+require 'fluent/env'
 require 'fluent/plugin/parser'
 require 'fluent/time'
 require 'fluent/oj_options'
 
-require 'yajl'
 require 'json'
 
 module Fluent
@@ -28,16 +28,18 @@ module Fluent
 
       config_set_default :time_key, 'time'
       desc 'Set JSON parser'
+      # NOTE: Contains yajl for backward compatibility
       config_param :json_parser, :enum, list: [:oj, :yajl, :json], default: :oj
 
-      # The Yajl library defines a default buffer size of 8KiB when parsing
-      # from IO streams, so maintain this for backwards-compatibility.
-      # https://www.rubydoc.info/github/brianmario/yajl-ruby/Yajl%2FParser:parse
-      desc 'Set the buffer size that Yajl will use when parsing streaming input'
+      desc 'Set the buffer size that JSON parser will use when parsing streaming input'
       config_param :stream_buffer_size, :integer, default: 8192
 
       config_set_default :time_type, :float
 
+      # Use a shared proc rather than a per-call lambda so that
+      # configure_json_parser returns the same object every time.
+      JSON_PARSE_PROC = ->(text) { JSON.parse(text, **Fluent::DEFAULT_JSON_PARSE_OPTIONS) }
+
       def configure(conf)
         if conf.has_key?('time_format')
           conf['time_type'] ||= 'string'
@@ -54,8 +56,8 @@ module Fluent
 
           log&.info "Oj is not installed, and failing back to JSON for json parser"
           configure_json_parser(:json)
-        when :json then [JSON.method(:parse), JSON::ParserError]
-        when :yajl then [Yajl.method(:load), Yajl::ParseError]
+        when :yajl, :json # NOTE: Fallback yajl to json for backward compatibility
+          [JSON_PARSE_PROC, JSON::ParserError]
         else
           raise "BUG: unknown json parser specified: #{name}"
         end
@@ -94,11 +96,22 @@ module Fluent
       end
 
       def parse_io(io, &block)
-        y = Yajl::Parser.new
-        y.on_parse_complete = ->(record){
-          block.call(parse_time(record), record)
-        }
-        y.parse(io, @stream_buffer_size)
+        parser = JSON::ResumableParser.new(**Fluent::DEFAULT_JSON_PARSE_OPTIONS)
+        begin
+          chunk = +"".b
+          while io.readpartial(@stream_buffer_size, chunk)
+            parser << chunk
+            while parser.parse
+              record = parser.value
+              block.call(parse_time(record), record)
+            end
+          end
+        rescue EOFError
+          unless parser.empty?
+            log&.warn "JSON stream ended in the middle of a document; " \
+                      "discarding incomplete data"
+          end
+        end
       end
     end
   end

data/lib/fluent/plugin/parser_ltsv.rb

@@ -38,10 +38,8 @@ module Fluent
       def parse(text)
         r = {}
         text.split(@delimiter).each do |pair|
-          if pair.include? @label_delimiter
-            key, value = pair.split(@label_delimiter, 2)
-            r[key] = value
-          end
+          key, value = pair.split(@label_delimiter, 2)
+          r[key] = value if value
         end
         time, record = convert_values(parse_time(r), r)
         yield time, record

data/lib/fluent/plugin/parser_msgpack.rb

@@ -22,21 +22,22 @@ module Fluent
     class MessagePackParser < Parser
       Plugin.register_parser('msgpack', self)
 
-      def configure(conf)
-        super
-        @unpacker = Fluent::MessagePackFactory.engine_factory.unpacker
-      end
-
       def parser_type
         :binary
       end
 
       def parse(data, &block)
+        Fluent::MessagePackFactory.engine_factory.unpacker.feed_each(data) do |obj|
+          parse_unpacked_data(obj, &block)
+        end
+      end
+
+      def parse_partial_data(data, &block)
+        @unpacker ||= Fluent::MessagePackFactory.engine_factory.unpacker
         @unpacker.feed_each(data) do |obj|
           parse_unpacked_data(obj, &block)
         end
       end
-      alias parse_partial_data parse
 
       def parse_io(io, &block)
         u = Fluent::MessagePackFactory.engine_factory.unpacker(io)

data/lib/fluent/plugin/parser_syslog.rb

@@ -44,7 +44,7 @@ module Fluent
       RFC3164_CAPTURES = RFC3164_WITHOUT_TIME_AND_PRI_REGEXP.names.freeze
       RFC3164_PRI_REGEXP = /^<(?<pri>[0-9]{1,3})>/
 
-      RFC5424_WITHOUT_TIME_AND_PRI_REGEXP = /(?<host>[!-~]{1,255}) (?<ident>[!-~]{1,48}) (?<pid>[!-~]{1,128}) (?<msgid>[!-~]{1,32}) (?<extradata>(?:\-|(?:\[.*?(?<!\\)\])+))(?: (?<message>.+))?\z/m
+      RFC5424_WITHOUT_TIME_AND_PRI_REGEXP = /(?<host>[!-~]{1,255}) (?<ident>[!-~]{1,48}) (?<pid>[!-~]{1,128}) (?<msgid>[!-~]{1,32}) (?<extradata>(?:\-|(?:\[.*?(?<!\\)\])))(?: (?<message>.+))?\z/m
       RFC5424_CAPTURES = RFC5424_WITHOUT_TIME_AND_PRI_REGEXP.names.freeze
       RFC5424_PRI_REGEXP = /^<(?<pri>\d{1,3})>\d\d{0,2}\s/
 
@@ -71,6 +71,7 @@ module Fluent
         @time_parser_rfc5424 = nil
         @space_count_rfc3164 = nil
         @space_count_rfc5424 = nil
+        @time_format_starts_with_space_rfc3164 = false
         @skip_space_count_rfc3164 = false
         @skip_space_count_rfc5424 = false
         @time_parser_rfc5424_without_subseconds = nil
@@ -123,10 +124,12 @@ module Fluent
 
       def setup_time_parser_3164(time_fmt)
         @time_parser_rfc3164 = time_parser_create(format: time_fmt)
+        @time_format_starts_with_space_rfc3164 = time_fmt.start_with?(SPLIT_CHAR)
         if ['%b %d %H:%M:%S', '%b %d %H:%M:%S.%N'].include?(time_fmt)
           @skip_space_count_rfc3164 = true
         end
         @space_count_rfc3164 = time_fmt.squeeze(' ').count(' ') + 1
+        @space_count_rfc3164 -= 1 if @time_format_starts_with_space_rfc3164
       end
 
       def setup_time_parser_5424(time_fmt)
@@ -162,6 +165,8 @@ module Fluent
       end
 
       SPLIT_CHAR = ' '.freeze
+      DOT_CHAR = '.'.freeze
+      RFC3164_PRI_DIGITS_REGEXP = /\A[0-9]{1,3}\z/
 
       def parse_rfc3164_regex(text, &block)
         idx = 0
@@ -180,13 +185,26 @@ module Fluent
 
         i = idx - 1
         sq = false
+        first_time_field = true
         @space_count_rfc3164.times do
           while text[i + 1] == SPLIT_CHAR
+            if first_time_field
+              unless @time_format_starts_with_space_rfc3164
+                idx += 1
+                i += 1
+                break
+              end
+            end
             sq = true
             i += 1
           end
 
+          first_time_field = false
           i = text.index(SPLIT_CHAR, i + 1)
+          unless i
+            yield nil, nil
+            return
+          end
         end
 
         time_str = sq ? text.slice(idx, i - idx).squeeze(SPLIT_CHAR) : text.slice(idx, i - idx)
@@ -287,16 +305,30 @@ module Fluent
           end
         end
 
+        if text[cursor] == SPLIT_CHAR
+          cursor = rfc3164_space_cursor(text, cursor)
+          unless cursor
+            yield nil, nil
+            return
+          end
+        end
+
         if @skip_space_count_rfc3164
           # header part
           time_size = 15 # skip Mmm dd hh:mm:ss
-          time_end = text[cursor + time_size]
+          time_end_index = cursor + time_size
+          time_end = text[time_end_index]
+
           if time_end == SPLIT_CHAR
             time_str = text.slice(cursor, time_size)
             cursor += 16 # time + ' '
-          elsif time_end == '.'.freeze
+          elsif time_end == DOT_CHAR
             # support subsecond time
-            i = text.index(SPLIT_CHAR, time_size)
+            i = text.index(SPLIT_CHAR, time_end_index)
+            unless i
+              yield nil, nil
+              return
+            end
             time_str = text.slice(cursor, i - cursor)
             cursor = i + 1
           else
@@ -312,14 +344,18 @@ module Fluent
               i += 1
             end
             i = text.index(SPLIT_CHAR, i + 1)
+            unless i
+              yield nil, nil
+              return
+            end
           end
 
-          time_str = sq ? text.slice(idx, i - cursor).squeeze(SPLIT_CHAR) : text.slice(cursor, i - cursor)
+          time_str = sq ? text.slice(cursor, i - cursor).squeeze(SPLIT_CHAR) : text.slice(cursor, i - cursor)
           cursor = i + 1
         end
 
         i = text.index(SPLIT_CHAR, cursor)
-        if i.nil?
+        unless i
           yield nil, nil
           return
         end
@@ -363,12 +399,23 @@ module Fluent
         msg.chomp!
         record['message'] = msg
 
-        time = @time_parser_rfc3164.parse(time_str)
+        begin
+          time = @time_parser_rfc3164.parse(time_str)
+        rescue Fluent::TimeParser::TimeParseError
+          yield nil, nil
+          return
+        end
         record['time'] = time_str if @keep_time_key
 
         yield time, record
       end
 
+      def rfc3164_space_cursor(text, cursor)
+        return if @with_priority && !RFC3164_PRI_DIGITS_REGEXP.match?(text.slice(1, cursor - 2))
+
+        @time_format_starts_with_space_rfc3164 ? cursor : cursor + 1
+      end
+
       NILVALUE = '-'.freeze
 
       def parse_rfc5424(text, &block)
@@ -406,7 +453,7 @@ module Fluent
             i = text.index(SPLIT_CHAR, i + 1)
           end
 
-          time_str = sq ? text.slice(idx, i - cursor).squeeze(SPLIT_CHAR) : text.slice(cursor, i - cursor)
+          time_str = sq ? text.slice(cursor, i - cursor).squeeze(SPLIT_CHAR) : text.slice(cursor, i - cursor)
           cursor = i + 1
         end