Beefy Boxes and Bandwidth Generously Provided by pair Networks
Keep It Simple, Stupid
 
PerlMonks  

Re: Log regexp

by Athanasius (Prior)
on Aug 03, 2012 at 16:23 UTC ( #985278=note: print w/ replies, xml ) Need Help??


in reply to Log regexp

Hello kazak,

As you’ve no doubt discovered, the difficulty with a complex regex is that a single error can cause the whole match to fail, producing no output. One way to attack this kind of problem is to use a divide-and-conquer strategy by breaking down the regex into smaller, more manageable chunks. The split function can be useful here. Looking at your example log lines, it appears that each line can be usefully split on spaces:

#! perl use strict; use warnings; use Data::Dumper; for ('133.133.133.133, 87.87.87.87 127.0.0.1 - - [21/Apr/2012:04:35:01 + +0200] "GET /seo/vbseocp.php HTTP/1.0" 404 300 "-" "Internet Explore +r 6.0"', '95.95.95.95, 87.87.87.87 127.0.0.1 - - [22/Apr/2012:04:00:43 +02 +00] "GET / HTTP/1.0" 200 10211 "http://yandex.ru/yandsearch?text=exam +ple.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;)"') { my @parts = split; my %terms; $terms{ip1} = $parts[0] =~ s/ , $ //rx; $terms{ip2} = $parts[1]; $terms{ip3} = $parts[2]; # $parts[3] eq '-': discard # $parts[4] eq '-': discard @terms{qw(day month year hour min sec)} = $parts[5] =~ m! ^ \[ (\d{2}) / (\w+) / (\d{4}) : + (\d{2}) : (\d{2}) : (\d{2}) $ !x; ($terms{offset}) = $parts[6] =~ m! ^ \+ (\d{4}) \] $ !x; # $parts[7] eq '"GET': discard # $parts[8] eq '/...': discard # $parts[9] eq 'HTTP/1.0': discard $terms{int1} = $parts[10]; $terms{int2} = $parts[11]; my $rest = join(' ', @parts[12 .. $#parts]); $terms{strs} = []; push @{ $terms{strs} }, $1 while $rest =~ / ( \" [^\"]*? \" ) /gx; print Dumper(\%terms), "\n"; }

Output:

$VAR1 = { 'hour' => '04', 'int1' => '404', 'min' => '35', 'month' => 'Apr', 'ip2' => '87.87.87.87', 'sec' => '01', 'strs' => [ '"-"', '"Internet Explorer 6.0"' ], 'ip1' => '133.133.133.133', 'ip3' => '127.0.0.1', 'day' => '21', 'int2' => '300', 'offset' => '0200', 'year' => '2012' }; $VAR1 = { 'hour' => '04', 'int1' => '200', 'min' => '00', 'month' => 'Apr', 'ip2' => '87.87.87.87', 'sec' => '43', 'strs' => [ '"http://yandex.ru/yandsearch?text=example.com"' +, '"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT +5.1; SV1;)"' ], 'ip1' => '95.95.95.95', 'day' => '22', 'ip3' => '127.0.0.1', 'int2' => '10211', 'offset' => '0200', 'year' => '2012' };

Once you have this working, you can convert it back into a single regex if you really want to. But I don’t see that this would gain you anything.

HTH,

Athanasius <°(((><contra mundum


Comment on Re: Log regexp
Select or Download Code
Re^2: Log regexp
by kazak (Beadle) on Aug 06, 2012 at 09:17 UTC
    Thx it helped.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://985278]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others lurking in the Monastery: (4)
As of 2014-07-13 01:05 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    When choosing user names for websites, I prefer to use:








    Results (244 votes), past polls