Syslog Parser

Paste syslog lines, one per line. A line that starts with a PRI followed by something shaped like a VERSION is judged against the RFC 5424 grammar and nothing else: VERSION must be one to three digits with no leading zero; TIMESTAMP must be the RFC 3339 profile RFC 5424 defines, with an upper-case T and Z, at most six fractional digits, no leap second, and an offset of Z or ±HH:MM; HOSTNAME, APP-NAME, PROCID, and MSGID must be printable US-ASCII within their length limits; and STRUCTURED-DATA is mandatory, so a line that stops after MSGID is not a complete message. A line that misses any of those is reported as unparsed with a note — it is never reshaped into a BSD line by the more forgiving timestamp matcher the other tools use. Everything else is read as the BSD form of RFC 3164: timestamp, host, tag[pid], message, which stays deliberately lenient because RFC 3164 records what implementations did rather than what they must do. RFC 5424 STRUCTURED-DATA is split into elements and parameters against its own ABNF: an SD-ID or PARAM-NAME is at most 32 printable US-ASCII characters and may not contain a space, =, ] or a quote; a parameter value must be quoted; and inside it only the three escapes the RFC defines (\" \\ and \]) are unescaped, so an unescaped ] is a defect rather than a value character. A MSG must be separated from the structured data by a space. Structured data that breaks any of that is reported with a note, while the rest of the line — whose header did parse — is still shown. The severity shown is the one encoded in PRI — the tool never derives severity, a cause, or an actor from the message text. RFC 3164 carries no year and no time zone, so no ISO 8601 timestamp is shown for those lines and the gap is reported instead of filled. A line the parser cannot read is listed as unparsed rather than reshaped. Input is capped at 400,000 characters and 2,000 lines. Everything runs locally; nothing is uploaded, stored, or written into the URL.