Square Bracket timeshift drops bracket fields and message

[Hirogen]

Square Bracket timeshift drops bracket fields and message

When a Square Bracket Columnizer with a detected timestamp layout applies a nonzero time offset, it returns the shifted date/time but loses the bracket fields and message. The underlying log line is unchanged.

Reproduction through the public columnizer API

Run this in a console/test project referencing LogExpert.Core and ColumnizerLib:

using System;
using System.Linq;

using ColumnizerLib;

using LogExpert.Core.Classes.Columnizer;
using LogExpert.Core.Entities;

var line = new LogLine("2022-03-21 11:34:34.505[INFO][Worker]Message", 0);
var columnizer = new SquareBracketColumnizer();
_ = columnizer.GetPriority("square.log", new ILogLineMemory[] { line });

foreach (var offset in new[] { 0, 123, 0 })
{
    columnizer.SetTimeOffset(offset);
    var columns = columnizer.SplitLine(null, line).ColumnValues;
    Console.WriteLine(string.Join(" | ", columns.Select(column => column.FullValue.ToString())));
}

Expected columns when the offset is 123 milliseconds:

2022-03-21 | 11:34:34.628 | [INFO] | [Worker] | Message

The current implementation produces empty fields after the time:

2022-03-21 | 11:34:34.628 |  |  |

At zero offset, all five values are present. Resetting the offset to zero restores them. The snapshot regression test verifies the shifted timestamp, but does not cover preservation of the remaining fields.

Cause

In SquareBracketColumnizer.SplitLine, the nonzero-offset branch formats only the adjusted timestamp into newDate and passes newDate.AsMemory() to SquareSplit. The original suffix beginning at endPos is discarded. SquareSplit then pads the missing columns with empty values. The zero-offset branch passes the complete original line instead.

This predates snapshot cloning and also affects the active columnizer directly. Any consumer of its parsed columns can therefore receive empty field/message values while timeshift is enabled, including the grid and marker matching.

Proposed fix and regression coverage

Preserve the original suffix when replacing the timestamp, then parse the full shifted line. Add a failing test against public SplitLine before changing the implementation. Verify all columns with zero, positive and negative offsets, including a date rollover and a return to zero offset. Run the existing Square Bracket tests and the full suite afterward.