How to parse a log file using java.regex.Matcher in Java

Question

I am trying to undersand regular expressions in java. I am playing with a log file in java so I can extract log fields. For example, I have the following line:

Apr 10 21:08:55 kali sshd[37727]: Failed password for root from 127.0.0.1 port 42035 ssh2"

And I want to have the output like this:

"Date&Time" = Apr 10 21:08:55
"Hostname" = kali
"Program Name" = sshd
"Log" = Failed password for root from 127.0.0.1 port 42035 ssh2

Here is my java code so far:

public class LogRegExp{

public static void main(String argv[]) {
    String logEntryLine = "Apr 10 21:08:55 kali sshd[37727]: Failed password for root from 127.0.0.1 port 42035 ssh2";
    String logEntryPattern = "(\\w.+) (\\d.+) (\\w.+) (\\w.+)";

    Pattern p = Pattern.compile(logEntryPattern);
    Matcher matcher = p.matcher(logEntryLine);
    if (!matcher.matches()) {
        System.err.println("Bad log entry (or problem with RE?):");
        System.err.println(logEntryLine);
        return;
    }
    System.out.println("Date&Time: " + matcher.group(1));
        System.out.println("Hostname: " + matcher.group(2));
    System.out.println("Program Name: " + matcher.group(3));
        System.out.println("Log: " + matcher.group(4));

}

I tried following this example : http://www.java2s.com/Code/Java/Development-Class/ParseanApachelogfilewithRegularExpressions.htm

But I am unable to adapt it to my needs. I understand how to apply the esacape characters, digits, etc., but I do not know how to adapt it for my case. Can anyone help me please?

You shouldn't be parsing a log file at all. If you need the application to communicate with itself, or with other applications, use a database. — user207421
– user207421, Commented Apr 11, 2014 at 10:31
In this instance, you have very little criteria to parse your log file, so your regular expression will be prone to defects. That is, regardless of whether parsing a log file with regex is right or wrong in the first place. — Mena
– Mena, Commented Apr 11, 2014 at 10:37

Andynedine · Accepted Answer · 2014-04-11 11:37:47Z

Use this code:

public class LogRegExp {

    public static void main(String argv[]) {
        String logEntryLine = "Apr 10 21:08:55 kali sshd[37727]: Failed password for root from 127.0.0.1 port 42035 ssh2";
        String logEntryPattern = "([\\w]+\\s[\\d]+\\s[\\d:]+)\\s([\\w]+)\\s([\\w]+)\\[.+\\]:\\s(.+)";

        Pattern p = Pattern.compile(logEntryPattern);
        Matcher matcher = p.matcher(logEntryLine);
        if (!matcher.matches()) {
            System.err.println("Bad log entry (or problem with RE?):");
            System.err.println(logEntryLine);
            return;
        }
        System.out.println("Date&Time: " + matcher.group(1));
        System.out.println("Hostname: " + matcher.group(2));
        System.out.println("Program Name: " + matcher.group(3));
        System.out.println("Log: " + matcher.group(4));

    }
}

user2881767 · Accepted Answer · 2014-04-11 11:27:20Z

You can make the following modifications to your code:

public class LogRegExp {

    public static void main(String argv[]) {
        String logEntryLine = "Apr 10 21:08:55 kali sshd[37727]: Failed password for root from 127.0.0.1 port 42035 ssh2";
        String logEntryPattern = "([\\w]+\\s[\\d]+\\s[\\d:]+) (\\w+) (\\w{4})(\\[\\d{5}\\]:) (\\w.+)";

        Pattern p = Pattern.compile(logEntryPattern);
        Matcher matcher = p.matcher(logEntryLine);
        if (!matcher.matches()) {
            System.err.println("Bad log entry (or problem with RE?):");
            System.err.println(logEntryLine);
            return;
        }
        System.out.println("Date&Time: " + matcher.group(1));
        System.out.println("Hostname: " + matcher.group(2));
        System.out.println("Program Name: " + matcher.group(3));
        System.out.println("Log: " + matcher.group(5));

    }
}

The output of this program is:

Date&Time: Apr 10 21:08:55
Hostname: kali
Program Name: sshd
Log: Failed password for root from 127.0.0.1 port 42035 ssh2

Sabuj Hassan · Accepted Answer · 2014-04-11 11:28:58Z

0

Try with this pattern:

String logEntryPattern = "(.+\\d\\d?:\\d\\d?:\\d\\d?) (\\S+) ([^\\[]+)\\S+ (.+)";
                                   hh::mm::ss

answered Apr 11, 2014 at 11:28

Sabuj Hassan

39.7k14 gold badges83 silver badges88 bronze badges

Collectives™ on Stack Overflow

How to parse a log file using java.regex.Matcher in Java

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related