Hi everyone, I'm currently working on a way to parse out a web server log file and I've managed to put together the regular expression that pulls each field that is delimited by space.
I have however realized it would be much more helpful if I could pull out a single value with a 'key-value pair' in the cookie field.
Here's the current expression I'm using:
(?<ip>\S+)\s+(?<xrfc931>\S
+)\s+(?<us
ername>\S+
)\s+\[(?<d
ate>\S+)\:
+(?<time>\
S+\:+\S+\:
+\S+)\s+(?
<xTimezone
>[^\]]*)]\
s+"(?<xhtt
pmethod>\S
+)\s+(?:(?
<uristem>\
S+?)\?(?<u
ristemquer
y>\S+)|(?<
uristem>\S
+))\s+(?<x
httpprotoc
ol>\S+)"\s
+(?<viewst
atus>\S+)\
s+(?<xbyte
s>\S+)\s+\
"(?<refere
r>[^\"]*)\
"\s+\"(?<u
seragent>[
^\"]*)\"(?
:\s+\"(?<c
ookie>[^\"
]*)\"|\s)
To parse out a line within a log file such as:
205.188.116.5 - - [25/May/2006:03:00:05 -0700] "GET /main.do HTTP/1.1" 302 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.0; .NET CLR 1.1.4322; Hotbar 4.6.1)" "Beacon=hsareg.59808951.jd
w072559000
1.hsa0.114
8551020.Re
moveMe; __utma=175376801.187407112
7.11484522
43.1148452
243.114855
1027.2; __utmz=175376801.114845224
3.1.1.utmc
cn=(direct
)|utmcsr=(
direct)|ut
mcmd=(none
); ctc=on%5F3; cpa_ver3=249%2C898%2C2826%
2C71%2C-1%
2C11485510
98%3B247%2
C892%2C281
7%2C130431
%2C-1%2C11
48551188%3
B242%2C897
%2C2834%2C
130541%2C-
1%2C114845
2462%3B246
%2C890%2C2
816%2C1304
31%2C-1%2C
1148551123
; bht=24-13-0-0-0%3A45-18-0-
0-0; id=78773248; fci=891-0-2-1148452463-2%3
A892-0-2-1
148551188-
2; fcc=; __utmb=175376801; __utmc=175376801; JSESSIONID=DFEA5BD2A779EE4
5CC58145BD
8D20D9F"
Instead of parsing out the entire cookie value, I'm hoping to define cookie as only the value for JSESSIONID. So in the above example cookie would be only '
DFEA5BD2A779EE45CC58145BD8
D20D9F'
Is this possible using a regular expression?
Thanks!
Start Free Trial