Gregory Machin wrote:
> Hi
> I need to parse the logs for my named server. i'm having difficulty getting
> my mind around the regex to break the data up .. i want the break it up and
> store it in a data base then maniptulate the data from there ...
> | date | time |catagory|severity|client |ip
> |port |view | |query
> |
> 28-Sep-2006 10:10:57.266update: info: client 192.168.1.170#33364: view
> internal: updating zone 'lan.linserv.co.za/IN': adding an RR at '
> greg.lan.linserv.co.za' A"
>
> any ideas ?
Hi Gregory
It looks like your data fields are separated by a colon and a space, except for
the first three. Is there really nothing at all between the milliseconds and the
'category' field?
Anyway, assuming the data I have is correct (it's difficult to tell with the
wrapping that the various email systems apply) the code below should do what you
want. It works by splitting on, as I said, colon and whitespace, and then
pulling off the first field and splitting it again into three based on the
contents of these fields' data. You also seem to want the client field split
into 'client', IP address and port number, so I've pulled that field out and
split it up as well.
Hope it helps,
Rob
use strict;
use warnings;
while (<DATA>) {
chomp;
my @data = split /:\s+/;
my $prefix = $data[0];
splice @data, 0, 1, $prefix =~ /(\S+)\s+([0-9:.]+)(.+)/;
my $client = $data[-4];
splice @data, -4, 1, $client =~ /[^\s#]+/g;
print "$_\n" foreach @data;
}
__DATA__
28-Sep-2006 10:10:57.266update: info: client 192.168.1.170#33364: view internal:
updating zone 'lan.linserv.co.za/IN': adding an RR at 'greg.lan.linserv.co.za' A"
**OUTPUT**
28-Sep-2006
10:10:57.266
update
info
client
192.168.1.170
33364
view internal
updating zone 'lan.linserv.co.za/IN'
adding an RR at 'greg.lan.linserv.co.za' A"
--
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
<http://learn.perl.org/> <http://learn.perl.org/first-response>
