如何用Java解析日志文件？

Question

I have a file that has this two rows of data.

Jan 1 22:54:17 drop   %LOGSOURCE% >eth1 rule: 7; rule_uid: {C1336766-9489-  4049-9817-50584D83A245}; src: 70.77.116.190; dst: %DSTIP%; proto: tcp; product: VPN-1 & FireWall-1; service: 445; s_port: 2612;
Jan 1 23:02:56 accept %LOGSOURCE% >eth1 inzone: External; outzone: Local; rule: 3; rule_uid: {723F81EF-75C9-4CBB-8913-0EBB3686E0F7}; service_id: icmp-proto; ICMP: Echo Request; src: 24.188.22.101; dst: %DSTIP%; proto: icmp; ICMP Type: 8; ICMP Code: 0; product: VPN-1 & FireWall-1;

May I really know what's the code to parse them into different columns? One problem is

eth1 rule:7;
eth1 inzone: External; outzone: Local;

I want to let them fall under the same column. I really need some desperate help as I have no knowledge of programming and I'm tasked to do this ><

Answer 1

You'd probably start with Java's split function for strings:

Oracle Doc

Look at example 3

I assume you could lump your first column as everything from the start to '>' after %LOGSOURCE%. I'm also guessing there are other columns that would be lumped together and that in the end you'd only expect a certain amount of columns per row.

You could use code like this:

//a line of the log can be split on '>' and ';' for the other columns of interest
//logLine is a line off the your log, I'm assuming it's a string object
string[] splitLine = logLine.split("[>;]+");
//I'm pretending there are 7 columns, for simplicity sake I'm using an ArrayList
// of string arrays (ArraList<string[]>) that would get declared
//above all this called logList
string[] logEntry = new string[7];
//Save the time stamp of the log entry by iterating through splitLine
for(int counter1 = 0; counter1 < splitLine.length; counter1++)
{
   //Timestamp column
   if(counter1 == 0)
      logEntry[0] = splitLine[counter1];

   //First column
   if(counter1 == 1)
      logEntry[1] = splitLine[counter1];
   //Logic to determine what needs to get appended to second column, 
   //could be many if statements
   if(...)
      logEntry[1] += splitLine[counter1];

   //Logic to determine what starts third column
   if(...)
      logEntry[2] = splitLine[counter1];
   //Logic to determine what needs to get appended to third column,
   //could be many if statements
   if(...)
      logEntry[2] += splitLine[counter1];
   //And so on... till you fill all your columns up or as much as you want
}
//Add your columned log to your list for use after you've parsed up the file
logList.add(logEntry);

You'd probably stick all this logic in a for loop that continually grabs a line off your log into the logLine string used at the top of the code sample. It's not the most efficient way, but it's pretty straightforward. Hopefully this gives you a start to approaching your problem.