Skip to content

Instantly share code, notes, and snippets.

@se1983
Last active July 1, 2020 18:40
Show Gist options
  • Save se1983/8667d59e5399bd0e0a14558c5695598e to your computer and use it in GitHub Desktop.
Save se1983/8667d59e5399bd0e0a14558c5695598e to your computer and use it in GitHub Desktop.
Extract fields from logline with regex in rust.
use regex::{Regex, Captures};
use strfmt::strfmt;
use std::collections::HashMap;
fn main() {
#[derive(Debug)]
struct LogSchema{
datetime: String,
host: String,
service: String,
message: String,
line_pattern: String,
regex: Regex
}
impl LogSchema {
fn new(datetime_schema: &str, host_schema: &str, service_schema: &str, message_schema: &str, line_schema: &str ) -> LogSchema {
let mut vars = HashMap::new();
vars.insert("d".to_string(), datetime_schema);
vars.insert("h".to_string(), host_schema);
vars.insert("s".to_string(), service_schema);
vars.insert("m".to_string(), message_schema);
let formated_log_pattern = strfmt(line_schema, &vars).unwrap();
let re = Regex::new(&formated_log_pattern).unwrap();
LogSchema{
datetime: String::from(datetime_schema),
host: String::from(host_schema),
service: String::from(service_schema),
message: String::from(message_schema),
line_pattern: formated_log_pattern,
regex: re
}
}
pub fn get_fields<'t>(&self, logline: &'t str) -> Option<Captures<'t>> {
let captures = self.regex.captures(logline);
captures
}
}
let datetime = r"[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1]) (2[0-3]|[01][0-9]):[0-5][0-9]:[0-5][0-9],[0-9][0-9][0-9]";
let host = r"([^\s]+)";
let service = r"([^\s]+)";
let message = r"(.*)";
let log_pattern = "(?P<datetime>({d})) (?P<hostname>({h}))] (?P<service>({s})) (?P<message>({m}))";
let schema = LogSchema::new(datetime, host, service, message, log_pattern);
let log_line = "[2006-02-08 22:20:02,165 192.168.0.1] fbloggs Protocol problem: connection reset";
println!("{:?}", schema.get_fields(log_line).unwrap())
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment