parse_iptables_logs.py

#!/usr/bin/python3

import re
import json

fw_lines = []

def make_dict(str_value):
    d = {}
    for item in str_value.split():
        if re.match(r'.*=.*', item):
            d[item.split("=")[0]] = item.split("=")[1]
    return d

with open("/var/log/syslog") as syslog:
    for line in syslog.readlines():
        if re.match(r'.*IN=.*OUT.*MAC=.*SRC=.*', line):
            fw_lines.append(make_dict(("IN={}".format(line.split('IN=')[1]))))

print(json.dumps(fw_lines))