logparser plugin panics with integer divide by zero error

[russorat]

Bug report

System info:

Telegraf v1.5.0~26ccc1f2
Mac OS X 10.13

Steps to reproduce:

1. Add config and start telegraf
2. Opening iTunes on my mac causes the log lines to error out. Not sure if you could manually send them.

telegraf.conf

[[inputs.logparser]]
    files = ["/var/log/system.log"]
    from_beginning = false
    [inputs.logparser.grok]
        patterns = [
          '%{APPLE_SYSLOG_TIME_SHORT:timestamp:ts-"Jan 2 15:04:05"} %{HOSTNAME} %{APP_NAME:app_name}\[%{NUMBER:pid:int}\]%{GREEDYDATA:message}']
        measurement = "apple_syslog"
        ## Custom patterns can also be defined here. Put one pattern per line.
        custom_patterns = '''
          APPLE_SYSLOG_TIME_SHORT %{MONTH} +%{MONTHDAY} %{TIME}
          APP_NAME [a-zA-Z0-9\.]+
        '''

log lines trying to parse

Nov  6 13:56:52 --- last message repeated 1 time ---
Nov  6 13:56:57 rsavage com.apple.xpc.launchd[1] (com.apple.WebKit.Networking.5690FB7B-ED1E-46A0-8D0E-BC3F1CDF5191[6467]): Service exited with abnormal code: 1
Nov  6 13:57:03 rsavage iTunes[6504]: objc[6504]: Class AMSupportURLConnectionDelegate is implemented in both /System/Library/PrivateFrameworks/EmbeddedOSInstall.framework/Versions/A/EmbeddedOSInstall (0x7fffa594e748) and /System/Library/PrivateFrameworks/MobileDevice.framework/MobileDevice (0x107e67008). One of the two will be used. Which one is undefined.
Nov  6 13:57:03 rsavage iTunes[6504]: info> Scale factor of main display = 2.0
Nov  6 13:57:05 rsavage com.apple.WebKit.WebContent[6554]: iTunes WebBundle - Object descriptor was null.

error message

panic: runtime error: integer divide by zero

goroutine 16 [running]:
github.com/influxdata/telegraf/plugins/inputs/logparser/grok.(*tsModder).tsMod(0xc420116230, 0x0, 0xffffffffffb6f02f, 0x0, 0x0, 0x0, 0x0)
	/Users/rsavage/go/src/github.com/influxdata/telegraf/plugins/inputs/logparser/grok/grok.go:458 +0x67d
github.com/influxdata/telegraf/plugins/inputs/logparser/grok.(*Parser).ParseLine(0xc4201260c0, 0xc42001ba40, 0x4e, 0x0, 0xc42076a090, 0xc4201364c0, 0x1)
	/Users/rsavage/go/src/github.com/influxdata/telegraf/plugins/inputs/logparser/grok/grok.go:329 +0x1dda
github.com/influxdata/telegraf/plugins/inputs/logparser.(*LogParserPlugin).parser(0xc4201f1c20)
	/Users/rsavage/go/src/github.com/influxdata/telegraf/plugins/inputs/logparser/logparser.go:270 +0x25e
created by github.com/influxdata/telegraf/plugins/inputs/logparser.(*LogParserPlugin).Start
	/Users/rsavage/go/src/github.com/influxdata/telegraf/plugins/inputs/logparser/logparser.go:164 +0x581

[danielnelson]

This is related to #3379. Since there is no year in syslog the default year in Go is used (year 1), and the timestamp incrementer for duplicate points does not handle times before the epoch correctly.