import com.common.entity.*;
import com.common.util.SyslogParser;
import java.util.Locale;
import java.util.Optional;

public class SyslogParserDemo {
    public static void main(String[] args) {
        // RFC 5424 测试用例
        String[] rfc5424Logs = {
                "<4>2025-09-14T16:27:09+08:00 hcss-ecs-9dc5 HFish[2946163]: {\"title\":\"HFish Threat Alert\",\"client\":\"内置节点\"}",
                "<34>1 2023-10-27T14:30:15.123Z web-server-01 myapp 1234 ID47 - This is a test message",
                "<165>1 2023-10-27T15:45:30.000+08:00 firewall01 sshd 5678 - [event source=\"auth\" result=\"failure\"] Failed password for user",
                "<14>1 2023-10-27T16:20:45.789Z db-server-01 postgres 9012 DB01 [metrics query_time=\"150ms\" rows=100] SELECT completed",
                "<14>1 2025-09-24T11:52:26Z 5f46d3be75e1 supermario 128 honeypot_event - {\"source\":\"honeypot1\",\"id\":\"f6a13c35-bf9d-4da6-a181-50ce23e7ef6a\",\"start_time\":\"2023-09-03T11:07:02.50167643Z\",\"time\":\"2023-09-03T11:16:18.883885281Z\",\"risk_level\":4,\"connection\":\"b18f3fbe-3fbf-4495-815f-ff26f6fb0bdf\",\"file_info\":null,\"extra\":{\"payload\":{\"format\":\"line\",\"name\":{\"cn\":\"攻击载荷\",\"en\":\"payload\"},\"value\":\"\"},\"uid\":{\"format\":\"line\",\"name\":{\"cn\":\"\",\"en\":\"\"},\"uid\":\"b4cbc73c-25d0-4429-ae1b-a856cdf1a651\",\"value\":\"\"}},\"type\":\"WEB_ATTACK_SCANNER\",\"agent_sn\":\"caa7da42-0cca-4cb1-b501-1f1eb2b588d5\",\"agent_name\":\" 教育局蜜罐探针\",\"honeypot_id\":\"11a9ac6bdf38ae2aaa49ec4f1b4a921bff71952cb9f175bdd8ee1f0497057bc6\",\"honeypot_name\":\"茂名市中小学管理平台管理后台\",\"src_ip\":\"117.50.189.7\",\"src_port\":58512,\"src_mac\":\"\",\"dest_ip\":\"192.168.222.2\",\"dest_port\":9200,\"proxy_ip\":null,\"node\":\"WRx3\"}",
                "<4>2025-09-14T16:27:09+08:00 hcss-ecs-9dc5 HFish[2946163]: {\"title\":\"HFish Threat Alert\",\"client\":\"内置节点\",\"client_ip\":\"192.168.11.133\",\"attack_type\":\"attack\",\"scan_type\":\"\",\"scan_port\":\"\",\"class\":\"端口监听\",\"type\":\"TCP\",\"name\":\"TCP端口监听\",\"account\":\"\",\"src_ip\":\"36.154.189.226\",\"src_port\":\"29604\",\"dst_ip\":\"192.168.11.133\",\"dst_port\":\"445\",\"geo\":\"中国-江苏\",\"time\":\"2025-09-14 16:27:09\",\"threat_name\":\"\",\"threat_level\":\"other\",\"info\":\"36.154.189.226:29604 already connected.\",\"labels\":\"\",\"labels_cn\":\"\",\"AuthInfo\":null}"
        };

        // RFC 3164 测试用例
        String[] rfc3164Logs = {
                "<15>Oct 9 21:15:55 LAPTOP-ARDUR3N0  alan:  honeypot_event",
                "<34>Oct 27 14:30:15 web01 sshd[1234]: Failed password for root",
                "<13>Oct 27 15:45:30 firewall01 %ASA-6-302013: Built outbound TCP connection",
                "<7>Oct 27 16:20:45 appserver kernel: USB device disconnected"
        };


        System.out.println("=== RFC 5424 格式解析 ===");
        for (String log : rfc5424Logs) {

            try {
                SyslogMessage msg = SyslogParser.parse(log);
                System.out.println("原始日志: " + log);
                System.out.println("解析结果: " + msg);

                System.out.println("---");


            } catch (Exception e) {
                System.err.println("解析失败: " + log);
                System.err.println("错误: " + e.getMessage());
               //Optional msg1=SyslogParser.extractJsonString(log);
                // System.err.println("内容解析结果: " +   msg1.toString());
            }
        }

        System.out.println("\n=== RFC 3164 格式解析 ===");
        for (String log : rfc3164Logs) {
            try {
                SyslogMessage msg = SyslogParser.parse(log);
                System.out.println("原始日志: " + log);
                System.out.println("解析结果: " + msg);
                System.out.println("---");
            } catch (Exception e) {
                System.err.println("解析失败: " + log);
                System.err.println("错误: " + e.getMessage());
            }
        }

        // 测试自动检测
        System.out.println("\n=== 混合格式自动检测 ===");
        String[] mixedLogs = {
                "<34>1 2023-10-27T14:30:15.123Z web01 myapp 1234 - - Test RFC5424",
                "<13>Oct 27 15:45:30 web02 kernel: Test RFC3164"
        };

        for (String log : mixedLogs) {
            try {
                SyslogMessage msg = SyslogParser.parse(log);
                System.out.println("检测到格式: " + msg.getClass().getSimpleName());
                System.out.println("解析结果: " + msg);
                System.out.println("---");
            } catch (Exception e) {
                System.err.println("解析失败: " + log);
                System.err.println("错误: " + e.getMessage());
            }
        }
    }
}