Apacheログパーサー

Apache logs (combined format) have a precise structure:

127.0.0.1 - - [10/Oct/2024:13:55:36 +0000] "GET /index.html HTTP/1.1" 200 1234

A pattern with named groups extracts every field in one shot:

^(?<ip>\d+\.\d+\.\d+\.\d+)\s+\S+\s+\S+\s+\[[^\]]+\]\s+"(?<metodo>\w+)\s+(?<path>\S+)\s+\S+"\s+(?<status>\d+)\s+(?<size>\d+)

It looks monstrous, but it's the concatenation of simple patterns:

• (?<ip>\d+\.\d+\.\d+\.\d+) -- the source IPv4.
• \s+\S+\s+\S+ -- the user IDs (usually -).
• \[[^\]]+\] -- the date in square brackets.
• "(?<metodo>\w+)\s+(?<path>\S+)\s+\S+" -- the request in quotes, with HTTP method, path and version.
• (?<status>\d+)\s+(?<size>\d+) -- status code and bytes sent.

General strategy

1. Start from the real line and pin the delimiters: spaces, quotes, brackets.
2. Between delimiters, identify the type of token (IP, word, number).
3. Wrap in named groups only what you need to extract.

Parsing complex logs

In log parsing, fields are usually space-separated except when they contain quoted strings or brackets (e.g. the user-agent). Using excluding character classes instead of the wildcard dot prevents merging multiple columns incorrectly.

Try it

Review exercise

Additional challenge