Last active
July 1, 2020 18:40
-
-
Save se1983/8667d59e5399bd0e0a14558c5695598e to your computer and use it in GitHub Desktop.
Extract fields from logline with regex in rust.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
use regex::{Regex, Captures}; | |
use strfmt::strfmt; | |
use std::collections::HashMap; | |
fn main() { | |
#[derive(Debug)] | |
struct LogSchema{ | |
datetime: String, | |
host: String, | |
service: String, | |
message: String, | |
line_pattern: String, | |
regex: Regex | |
} | |
impl LogSchema { | |
fn new(datetime_schema: &str, host_schema: &str, service_schema: &str, message_schema: &str, line_schema: &str ) -> LogSchema { | |
let mut vars = HashMap::new(); | |
vars.insert("d".to_string(), datetime_schema); | |
vars.insert("h".to_string(), host_schema); | |
vars.insert("s".to_string(), service_schema); | |
vars.insert("m".to_string(), message_schema); | |
let formated_log_pattern = strfmt(line_schema, &vars).unwrap(); | |
let re = Regex::new(&formated_log_pattern).unwrap(); | |
LogSchema{ | |
datetime: String::from(datetime_schema), | |
host: String::from(host_schema), | |
service: String::from(service_schema), | |
message: String::from(message_schema), | |
line_pattern: formated_log_pattern, | |
regex: re | |
} | |
} | |
pub fn get_fields<'t>(&self, logline: &'t str) -> Option<Captures<'t>> { | |
let captures = self.regex.captures(logline); | |
captures | |
} | |
} | |
let datetime = r"[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1]) (2[0-3]|[01][0-9]):[0-5][0-9]:[0-5][0-9],[0-9][0-9][0-9]"; | |
let host = r"([^\s]+)"; | |
let service = r"([^\s]+)"; | |
let message = r"(.*)"; | |
let log_pattern = "(?P<datetime>({d})) (?P<hostname>({h}))] (?P<service>({s})) (?P<message>({m}))"; | |
let schema = LogSchema::new(datetime, host, service, message, log_pattern); | |
let log_line = "[2006-02-08 22:20:02,165 192.168.0.1] fbloggs Protocol problem: connection reset"; | |
println!("{:?}", schema.get_fields(log_line).unwrap()) | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment