我正在尝试解析syslog(或类似syslog)响应以仅提取JSON
<14>1 09 30 2019 15:34:37 UTC logsource {"somejson": "thejson", "details": {"detail1": detail, "detail2": detail"}}
<14>1 09 30 2019 15:34:37 UTC logsource {"somejson": "thejson", "details": {"detail1": detail, "detail2": detail"}}
<14>1 09 30 2019 15:34:37 UTC logsource {"somejson": "thejson", "details": {"detail1": detail, "detail2": detail"}}
我想删除“ <14> 1 09 30 2019 15:34:37 UTC日志源”前缀,以便剩余的数据是有效的JSON,因此我可以将每一行发送到数据库。我认为输出看起来像这样:
{
"body" [
{
"somejson": "thejson",
"details": {
"detail1": details,
"detail2": details.
}
},
{
"somejson": "thejson",
"details": {
"detail1": details,
"detail2": details.
}
},
{
"somejson": "thejson",
"details": {
"detail1": details,
"detail2": details.
}
}
]
}
也许我可以遍历原始数据并使用String替换字符串。以某种方式替换?我非常感谢您的帮助,即使它正指向正确的方向。
答案 0 :(得分:0)
一种方法是使用Newtonsoft.Json。切掉不需要的日志前缀后,可以将字符串解析为JObject
。我还继续删除了输入中的空白行。这是我用来执行此操作的代码:
using System;
using System.Linq;
using System.IO;
using Newtonsoft.Json.Linq;
namespace extractingJSONSyslogQuestion
{
class Program
{
static void Main(string[] args)
{
var input = File.ReadAllText("test.txt");
var lines = input.Split("\n");
// Remove blank lines
lines = lines.Where(l => !string.IsNullOrEmpty(l)).ToArray();
foreach(var line in lines) {
// Get rid of log prefix
var data = line.Substring(line.IndexOf("{"));
var json = JObject.Parse(data);
Console.WriteLine(json);
}
}
}
}
这是我使用的输入文件。注意,我在字符串“ detail”周围添加了双引号以使其有效为json:
<14>1 09 30 2019 15:34:37 UTC logsource {"somejson": "thejson", "details": {"detail1": "detail", "detail2": "detail"}}
<14>1 09 30 2019 15:34:37 UTC logsource {"somejson": "thejson", "details": {"detail1": "detail", "detail2": "detail"}}
<14>1 09 30 2019 15:34:37 UTC logsource {"somejson": "thejson", "details": {"detail1": "detail", "detail2": "detail"}
最后,这是我程序的输出:
{
"somejson": "thejson",
"details": {
"detail1": "detail",
"detail2": "detail"
}
}
{
"somejson": "thejson",
"details": {
"detail1": "detail",
"detail2": "detail"
}
}
{
"somejson": "thejson",
"details": {
"detail1": "detail",
"detail2": "detail"
}
}
如果您有任何评论,我很乐意回答有关代码的任何问题。