Question

您好我需要RegEx来解析以下日志文件行：

2015-07-06 11:07:29 +0950 [ERROR] index=heal-legacy host=imb.asp.com 
com.iml.Keplas.collector.CollectorException: Could not process additional data, connection lost to data collector service
Expected result is :
Time   2015-07-06 11:07:29
Type   ERROR
Index  heal-legacy
Host   imb.asp.com 
Message Could not process additional data, connection lost to data collector service

请帮助我获取这些字段时间，类型（[错误]），索引，主机，消息。

Answer 1

您可以尝试使用此正则表达式：

(?<date>\d{4}-\d{2}-\d{2})\s+(?<time>\d{2}:\d{2}:\d{2})\s+\+\d{4}\s+(?<error>\S+)\s+index=(?<index>\S+)\s+host=(?<host>\S+)\s+(?<message>.*)

请参阅demo

Answer 2

s = "2015-07-06 11:07:29 +0950 [ERROR] index=heal-legacy host=imb.asp.com 
com.iml.Keplas.collector.CollectorException: Could not process additional data, connection lost to data collector service"
a = s.split(" ", 7)
# => ["2015-07-06", "11:07:29", "+0950", "[ERROR]", "index=heal-legacy", "host=imb.asp.com", "com.iml.Keplas.collector.CollectorException: Could not process additional data, connection lost to data collector service"]
[a.first(3).join(" "), a[3], a[4][/(?<==).+/], a[5][/(?<==).+/], a[6]]
# => ["2015-07-06 11:07:29 +0950", "[ERROR]", "heal-legacy", "imb.asp.com", "\ncom.iml.Keplas.collector.CollectorException: Could not process additional data, connection lost to data collector service"]

给定日志文件的正则表达式

2 个答案: