Perl中的正则表达式任务

Question

I have a simple question around a regex problem.

Given the following example string:

Apr 2 13:42:32 sandbox izxp[12000]: Received disconnect from 10.11.106.14: 10: disconnected by user

I need to separate this string into 4 different strings. As you can see: date ( Apr 2 ), time ( 13:42:32 ), server name ( sandbox ) and other data ( izxp[12000]: Received disconnect from 10.11.106.14: 10: disconnected by user ).

These will be variable values after.

I would be very happy someone can help me out!

Thx!

Answer 1

It's a little easier to use split for this task.

my ($date1, $date2, $time, $host, $data) = split(' ', $str, 5);
my $date = "$date1 $date2";

Answer 2

I always use what I call "scan patterns" for this type of thing. The format for the date is pretty easy:

/((?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+\d+)

The expression for the time isn't much harder

/(\d\d:\d\d:\d\d)/

Once you've got that out of the way, I think it's easy enough to specify the server like so:

/(\w+)/

The next part is just everything else, so the pattern can be concatenated together as:

/((?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+\d+)\s+(\d\d:\d\d:\d\d)\s+(\w+)\s+(.*)/

And you can store that data in Perl by this expression:

my ( $date, $time, $host, $desc ) 
    = $str =~ m/((?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+\d+)
                \s+(\d\d:\d\d:\d\d)\s+(\w+)\s+(.*)
               /x
    ;

Answer 3

Note that performance comparison between split or prepared regexps (in output below: re1 is from Axeman and re2 is simplified as /(\\S+ \\S+) (\\S+) (\\S+) (.*)/ ) confirms that split is winning but the difference is tiny, you won't even notice it on less than a million lines parsed. Axeman regexp could be improved further to help you prove validity of your input which is very important thing.

10mln iterations comparison:

        Rate  re1  re2  spl
re1 250000/s   -- -28% -57%
re2 344828/s  38%   -- -41%
spl 584795/s 134%  70%   --

Here is rundown on 100 mln calls on ancient Core Duo:

re1: 40 wallclock secs (39.84usr+0.00sys=39.84CPU) @ 251004.02/s (n=10000000)
re2: 29 wallclock secs (29.04usr+0.01sys=29.05CPU) @ 344234.08/s (n=10000000)
spl: 18 wallclock secs (16.77usr+0.00sys=16.77CPU) @ 596302.92/s (n=10000000)

It looks significant at this amount of records. But if you will check validity of say rest of data string somewhere, you are better to check it once in parsing stage.