From f71498ceff32c37228dd20a108f26078dee72885 Mon Sep 17 00:00:00 2001
From: Martin Vierula <martin.vierula@trustwave.com>
Date: Fri, 27 May 2022 11:05:37 -0700
Subject: [PATCH] mlogc log-line parsing fails due to enhanced timestamp

---
 CHANGES       | 2 ++
 mlogc/mlogc.c | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 225b6adf..7ba9e74d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,8 @@
 DD mmm YYYY - 2.9.x (to be released)
 -------------------
 
+ * mlogc log-line parsing fails due to enhanced timestamp
+   [Issue #2682 - @bozhinov, @ABrauer-CPT, @martinhsv]
  * Allow no-key, single-value JSON body
    [Issue #2735 - @marcstern, @martinhsv]
  * Set SecStatusEngine Off in modsecurity.conf-recommended
diff --git a/mlogc/mlogc.c b/mlogc/mlogc.c
index e650452d..ab0c0653 100644
--- a/mlogc/mlogc.c
+++ b/mlogc/mlogc.c
@@ -96,7 +96,7 @@ do { \
 static const char logline_pattern[] =
     "^(\\S+)"
     "\\ (\\S+)\\ (\\S+)\\ (\\S+)"
-    "\\ \\[([^:]+):(\\d+:\\d+:\\d+)\\ ([^\\]]+)\\]"
+    "\\ \\[([^:]+):(\\d+:\\d+:\\d+(?:[.]\\d+)?)\\ ([^\\]]+)\\]"
     "\\ \"(.*)\""
     "\\ (\\d+)\\ (\\S+)"
     "\\ \"(.*)\"\\ \"(.*)\""