模式匹配以進行日志分析

Question

我的程序將發出grep命令，以根據時間范圍和唯一關鍵字搜索日志。 我的程序能夠成功發出grep命令，並返回幾行匹配的日志，如下所示

22:41.9 INFO    SSHD    SSHD-TRANSFER-1 [accountName=root] [remoteAddress=/172.16.8.1:64931]:Logout agent success [accountName=null remoteAddress=STEDGE/172.16.8.3]    AuthenticationProviderImpl.java com.tumbleweed.st.server.sshd.AuthenticationProviderImpl    executeLogoutAgent  429 UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN
21:45.9 INFO    SSHD    SSHD-TRANSFER-1 [accountName=root] [remoteAddress=/172.16.8.1:64931]:Invoking logout agent [accountName=null remoteAddress=STEDGE/172.16.8.3]   AuthenticationProviderImpl.java com.tumbleweed.st.server.sshd.AuthenticationProviderImpl    executeLogoutAgent  425 UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN
21:45.9 INFO    SSHD    SSHD-TRANSFER-1 [accountName=root] [remoteAddress=/172.16.8.1:64931]:SSH: User "null" logged out from [172.16.8.1]. AuthenticationProviderImpl.java com.tumbleweed.st.server.sshd.AuthenticationProviderImpl    executeLogoutAgent  422 UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN

但是我不需要所有這些，我感興趣的是[remoteAddress=/172.16.8.1:64931] 。 這行代碼Pattern pat1 = Pattern.compile("remoteAddress=/(\\d)"); 賦予非法逃生角色。 我可以知道如何僅提取沒有任何端口號的IP地址並將其存儲到String變量中嗎，我已經在Google上搜索了一些信息，但是它無法正常工作？ 供您參考，這是我的源代碼

import java.io.*;
import java.util.regex.*;
class blockIP
{
   public static void main(String [] args)
   {
     String command1 = "date +%R";
     String time = null;
     String arguement2 = null;
     String arguement1 = ".*java";
     try
       {
             Process p1 = Runtime.getRuntime().exec(command1);
             BufferedReader br1 = new BufferedReader(new InputStreamReader(p1.getInputStream()));

             String line1;
             while((line1 = br1.readLine()) != null )
              {
                  System.out.println(line1);
                  time = line1;
                  arguement2 =time.concat(arguement1);
              }
           br1.close();
           String command2 = "grep "+arguement2+" stlog.txt";
           System.out.println("the command2 is :"+command2);
           Process p2 = Runtime.getRuntime().exec(command2);
           BufferedReader br2 = new BufferedReader(new InputStreamReader(p2.getInputStream()));
           String line2;
           while((line2 = br2.readLine()) != null)
           { 
              System.out.println(line2);
              Pattern pat1 = Pattern.compile("remoteAddress=/(\d)");
              Matcher matcher1 = pat1.matcher(line2);
              while(matcher1.find())
                   {
                     System.out.println(matcher1.group(1));
                   }
           }

        }
      catch(IOException e)
      {
        e.printStackTrace();
      }

   }
}

Answer 1

此正則表達式匹配remoteAddress=/短語后的數字和點。

public static void main(String[] args) {
        String s = "21:45.9 INFO    SSHD    SSHD-TRANSFER-1 [accountName=root] [remoteAddress=/172.16.8.1:64931]:Invoking logout agent [accountName=null remoteAddress=STEDGE/172.16.8.3]   AuthenticationProviderImpl.java com.tumbleweed.st.server.sshd.AuthenticationProviderImpl    executeLogoutAgent  425 UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN\r\n";
        Pattern pattern = Pattern.compile("(?<=remoteAddress=/)[\\d.]+");
        Matcher matcher = pattern.matcher(s);
        while (matcher.find()) {
            String group = matcher.group();
            System.out.println(group);
        }

    }

它與remoteAddress=STEDGE/172.16.8.3不匹配。

它使用正向后置斷言(?<=remoteAddress=/)在172.16.8.1之前

圖案：

(?<=remoteAddress=/)正向后看（零長度斷言）。 僅當[\\\\d.]+前面加確切的短語remoteAddress=/它才匹配。

[\\\\d.]+匹配數字或句點。 1次或更多次。 與其他任何內容都不匹配。

Answer 2

嘗試在grep之后使用cut命令。 就像是：

grep argument stlog.txt | cut -d ' ' -f 6

請參閱https://shapeshed.com/unix-cut/