Question

从JSON中的以下日志中，我需要解析＆＃34;域＆＃34;的日志行。其中有＆＃34; ADMIN_DOWN＆＃34;状态并没有改变或改为＆＃34; ONLINE＆＃34;从7天开始。

示例：

下面分享的日志的最后一行：

{user=abc,”lastUpdated":"2017-10-15 12:16:40.655569+00","id”:3201,”message”:”sub1.a1.com" new status = ADMIN_DOWN [asda:sdadada]”},

有一个域名：“sub1.a1.com＆＃34;在消息密钥和状态中，＆＃34; ADMIN_DOWN＆＃34;但它涉及＆＃34; ONLINE＆＃34;在第3行日志中。所以，我们可以忽略这一点，因为这个域已经来了＆＃34; ONLINE＆＃34;。

我必须得到所有日志行，其中包含＆＃34; ADMIN_DOWN＆＃34;从过去7天开始，相同的域名没有使用＆＃34; ONLINE＆＃34;生成的日志后面。

还有一个＆＃34; id＆＃34;这总是随着时间的推移而增加。不确定是否需要使用它。

我从下面的代码开始，但不确定如何将这些日志时间戳与过去7天与当前日期进行比较。我刚刚在最后一行代码中添加了注释，但需要添加逻辑。

我在考虑是否可以将两个定时器（当前和日志定时器）转换为在epoch中转换。如何继续使用代码。

我将不胜感激。

  #!/usr/bin/python
    import json 

    with open('file.json') as data_file:  
        data = json.load(data_file)
    for i in data[‘dump’]:
        if 'ADMIN_DOWN' in i['message'] and <older than 7 days from current timestamp with same hostname>:
            print “those log line”

JSON日志：

 {“dump”:[
    { user=abc,”lastUpdated":"2017-10-24 12:52:40.655569+00","id”:4354,”message”:”sub1.google.com new status = ONLINE [asda:sdadada]”},
    {user=abc,”lastUpdated":"2017-10-23 14:38:40.274873+00","id”:4200,”message”:”sub1.adsense.com new status = ADMIN_DOWN [asda:sdadada]”},
    {user=abc,”lastUpdated":"2017-10-23 12:16:40.652369+00","id”:4155,”message”:”sub1.a1.com new status = ONLINE [asda:sdadada]”},
    {user=abc,”lastUpdated":"2017-10-22 16:46:40.598569+00","id”:4110,”message”:”sub1.b1.com new status = ADMIN_DOWN [asda:sdadada]”},
    {user=abc,”lastUpdated":"2017-10-18 12:55:40.132569+00","id”:3599,”message”:”sub1.google.com new status = ONLINE [asda:sdadada]”},
    {user=abc,”lastUpdated":"2017-10-15 13:09:40.655569+00","id”:3598,”message”:”sub1.bbc.com new status = ADMIN_DOWN [asda:sdadada]”},
    { user=abc,”lastUpdated":"2017-10-24 12:16:40.655569+00","id”:3555,”message”:”sub1.b1.com new status = ONLINE [asda:sdadada]”},
    {user=abc,”lastUpdated":"2017-10-23 11:06:40.655569+00","id”:3544,”message”:”sub1.d1.com new status = ADMIN_DOWN [asda:sdadada]”},
    {user=abc,”lastUpdated":"2017-10-23 12:19:40.655569+00","id”:3414,”message”:”sub1.c1.com new status = ADMIN_DOWN [asda:sdadada]”},
    {user=abc,”lastUpdated":"2017-10-22 09:16:40.655569+00","id”:3311,”message”:”sub1.google.com new status = ONLINE [asda:sdadada]”},
    {user=abc,”lastUpdated":"2017-10-18 12:46:40.655569+00","id”:3303,”message”:”sub1.b1.com new status = ADMIN_DOWN [asda:sdadada]”},
    {user=abc,”lastUpdated":"2017-10-15 12:16:40.655569+00","id”:3201,”message”:”sub1.a1.com new status = ADMIN_DOWN [asda:sdadada]”},
]}

Answer 1

from datetime import date
TODAY = date(2017,10,25)
#Here data is the json
for i in data["dump"]:
    if "ADMIN_DOWN" in i["message"]:
        d = i["lastUpdated"].split()[0].split("-")
        DOWN_DATE = date(int(d[0]),int(d[1]),int(d[2]))
        if (TODAY - DOWN_DATE).days >= 7:
            print i

使用Python从服务器解析JSON日志

1 个答案: