Perl Parsing Apache Log

Question

I was trying to parse an apache log, but I am unable to figure out the exact regex for doing it

use strict;
use warnings;

my $log_line =
'178.255.215.79 - - [14/Jul/2013:03:27:51 -0400] 
"GET /~hines/ringworld_config/lilo.conf HTTP/1.1" 304 - "-" 
"Mozilla/5.0 (compatible; Exabot/3.0; +http://www.exabot.com/go/robot)';
#to find out IP address
print( $log_line =~ /(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/ );
#to find out Timestamp
print( $log_line =~ /\[[\d]{2}\/.*\/[\d]{4}\:[\d]{2}\:[\d]{2}\]*/ );

#Third regex for getting the complete link here :/~hines/ringworld_config/lilo.conf

What am I doing wrong in second regex cause I keep getting only 1 in it? How to create an regex for the third requirement?

Finally I want to convert the Timestamp after retrieval to some values which I can compare and subtract . Like the Timestamp to seconfs from epoch conversion.

Looking closer, Apache::ParseLog hasn't been updated since 1998, gets poor reviews, and fails most of its tests on CPAN testers. Ignore my previous comment, that was a poor recommendation. — ThisSuitIsBlackNot
– ThisSuitIsBlackNot, Commented Feb 21, 2014 at 22:11

score 1 · Accepted Answer · 2014-02-21 22:33:23Z

1

The second regex (timestamp) looks to be something like this:

m~\[\d{2}/[^/]*/\d{4}:\d{2}:\d{2}:\d{2}\s*-\d+\]~

expanded:

m~\[ \d{2} / [^/]* / \d{4} : \d{2} : \d{2} : \d{2} \s* - \d+ \]~x

with capture groups

m~\[ (\d{2}) / ([^/]*) / (\d{4}) : (\d{2}) : (\d{2}) : (\d{2}) \s* - (\d+) \]~x

The third regeex (link) maybe something like this:

modified link regex

m/"GET\s+([^"\s]*)\s*"/ where capture group 1 contains the link.

edited Feb 21, 2014 at 22:33

answered Feb 21, 2014 at 22:14

user557597

Sign up to request clarification or add additional context in comments.

4 Comments

chettyharish Over a year ago

both of the match to 1

user557597 Over a year ago

print is returning the result of the match (number of matches), not what matched. Try if ($log_line =~ m//) {print $&;}

user557597 Over a year ago

You would have to coerce a print item to list context to print capture groups. It a little too much work to just print the match data, so I wouldn't do it like that anyway.

chettyharish Over a year ago

Oh, now I understand . That's why its always one!

Collectives™ on Stack Overflow

Perl Parsing Apache Log

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related