在cloudwatch中提取API請求日志

Question

我正在尋找在 Cloudwatch 中提取以下有效負載中的每個字段的方法。 此有效負載不是正確的 json 格式。 有什么建議將其轉換為正確的 json 格式嗎？ 或者使用正則表達式將每個字段存儲在單個變量中？

log = "{Date=Wed, 03 Mar 2021 01:33:41 GMT, Content-Type=application/json, Content-Length=11841, Connection=keep-alive, x-amzn-RequestId=427382d7-1234-5678-1234-a2022c4d0796, x-amzn-Remapped-Content-Length=0, X-Amz-Executed-Version=$LATEST, X-Amzn-Trace-Id=root=1-123ee774-1234c16635364cda21e42155;sampled=0}"

哪個可取的output：

{"Date": "Wed, 03 Mar 2021 01:33:41 GMT", "Content-Type": "application/json", "Content-Length": 11841, "Connection": "keep-alive", "x-amzn-RequestId": "427382d7-1234-5678-1234-a2022c4d0796", "x-amzn-Remapped-Content-Length": 0, "X-Amz-Executed-Version": "$LATEST", "X-Amzn-Trace-Id": "root=1-123ee774-1234c16635364cda21e42155;sampled=0"}

如果不能直接轉換，我想為每個字段使用正則表達式，例如

request_id = re.search(r'\bx-amzn-RequestId:\s+(\w+(?:-\w+)+)\s+', log).group(1)

Answer 1

由於 YAML 是 JSON 的超集，您可以這樣做：

import yaml
log = "{Date=Wed, 03 Mar 2021 01:33:41 GMT, Content-Type=application/json, Content-Length=11841, Connection=keep-alive, x-amzn-RequestId=427382d7-1234-5678-1234-a2022c4d0796, x-amzn-Remapped-Content-Length=0, X-Amz-Executed-Version=$LATEST, X-Amzn-Trace-Id=root=1-123ee774-1234c16635364cda21e42155;sampled=0}"
log = log.replace(","," ",1) #Replace first occurrence of a , in a string (Wed, 03 Mar 2021 01:33:41 GMT is Wed 03 Mar 2021 01:33:41 GMT)
json_data = yaml.load(log)
final_dict = {}
for key in json_data.keys():
    split_data= str(key).split("=")
    final_dict.update({split_data[0]: split_data[1]})
print(final_dict)