filebeat syslog input: permit space after <PRI>

[candlerb]

Describe the enhancement:

Netgear switches send a space between the <PRI> and the timestamp fields in a syslog message. This is a violation of the standard, but it would be easy to accept.

Test case, based on packet captured using tcpdump from GS724Tv4:

echo -ne "<13> Aug 16 12:25:24 10.12.255.2-1 TRAPMGR[53034492]: traputil.c(696) 135956 %% Link Up: g5.\000" | nc -w0 -u localhost 5514

Current results:

  "message": "<13> Aug 16 12:25:24 10.12.255.2-1 TRAPMGR[53034492]: traputil.c(696) 135956 %% Link Up: g5.\u0000",

If the space was skipped, then the priority/facility, timestamp, program/pid could all be parsed.

(Aside: the messages also include a trailing null. This could also be stripped, but I don't object to retaining it)

Describe a specific use case for the enhancement or feature:

Networks with Netgear switches.

[candlerb]

Additional info:

Cisco can add a magic character before the timestamp - asterisk or dot - to indicate the clock sync status. It's possible Netgear interpreted this as needing a space when the clock is normal.

In any case, it may be worth extending this FR to silently skip a space, dot or asterisk immediately preceeding the timestamp field.