fix: JsonParser crash without dict config, EventID 0 without message

[viktorbeck98]

Task

Closes #357

Description

Two bugs in JsonParser, both from the issue.

1. AttributeError when the config is not a dictionary. The content parser was only created inside if isinstance(config, dict):. With JsonParser() or a JsonParserConfig object the attribute never existed, and the first log with a message field crashed.

• A non-dict config now gets a MatcherParser() without templates, so the message comes back as <Not Found> / -1.
• The issue allows either this or a clear error on creation. I chose this because a config object only holds the name of the content parser, and the basic docs example and the existing tests build the parser without a dict.

2. Logs without a message field got EventID 0. parse() started from a hardcoded 0, which is also the ID of the first template.

• The default is now -1 with the template <Not Found>, the same as a message that matches no template.

Things to check when reviewing:

• The template_not_found rule in rule_detector.py alerts on EventID == -1, so it now fires for every JSON log without a message field.
• A log without a message and a message that matches no template now share -1. If they should be told apart, that needs a separate ID.
• Not changed here: a message that is a number, object or list raises TypeError, and an empty, null or 0 message is treated as no message.

How Has This Been Tested?

• 2 new tests, and test_parse_json_without_message updated: it asserted the old EventID 0.
• The 3 tests fail without the source change and pass with it.
• Full suite passes (928 passed, 82 skipped).
• The reproduction script from the issue now prints no error, -1 for the log without a message and 0 for the first template.

Checklist

• This Pull-Request goes to the development branch.
• I have successfully run prek locally.
• I have added tests to cover my changes.
• I have linked the issue-id to the task-description.
• I have performed a self-review of my own code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[thorinaboenke]

@viktorbeck98 is that fine like this? "A log without a message and a message that matches no template now share -1"
-> json logs with out message alert will then trigger RuleDetector R001?
"A non-dict config now gets a MatcherParser() without templates" -> everything /with message and without message field) will come back indiscriminately with id -1? should there at least be a warning for the user?

[viktorbeck98]

@thorinaboenke we could also differentiate between the two cases. You're right, it's probably cleaner. We could use "-2" for when no message field is given

[viktorbeck98]

@thorinaboenke I addressed your comments