key value解析

1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
@Test
public void logparseTest() {
    String desStr = "<190>May 18 11:20:10 2016 HLJ_S12508_1_FW %%10FILTER/6/ZONE_DP_FLT_EXECUTION_TCP_LOG(l): -DEV_TYPE=SECPATH-PN=210231A0H6010C000002; " +
            "srcZoneName(1034)=serveruntrust;" +
            "destZoneName(1035)=servertrust;" +
            "rule_ID(1070)=90;" +
            "policyActType(1071)=denied;" +
            "protType(1001)=TCP(6);" +
            "srcIPAddr(1017)=10.167.77.99;" +
            "destIPAddr(1019)=10.166.5.70;" +
            "srcPortNum(1018)=49362;" +
            "destPortNum(1020)=1521;" +
            "beginTime_e(1013)=05182016112009;" +
            "endTime_e(1014)=05182016112009;"+
            "Content=[HTTP_SQL_注入攻击(1&1)]red_begin URL::1=1%20or%202=2 red_end ;" +
            "HOST=web.chacuo.net;" +
            "URL=/formatxml?1=1%20or%202=2;REF=;";

    /**  注释       <190>May              May 18 11:20:10 2016      HLJ_S12508_1_FW       10FILTER(供应商)  6(严重程度)    ZONE_DP_FLT_EXECUTION_TCP_LOG(l):(助记码)**/
    String regex = "<[\S]+>(?<timestamp>\S+\s+\S+\s+\S+\s+\S+\s+)\S+ \%\%(?<vendor>[^/]*)/(?<severity>[^/]*)/(?<MNEMONIC>[^:]*): -DEV_TYPE=SECPATH-PN=210231A0H6010C000002; (?<message>.*)";
    System.out.println(desStr);
    System.out.println(regex);
    Pattern mPattern = Pattern.compile(regex);
    Matcher mMatcher = mPattern.matcher(desStr);
    String kvSeparator = "=";
    String keyRegular = "[^=;]+";
    String valueRegular = "[^;]+";
    String regep = keyRegular + kvSeparator + valueRegular;
    while (mMatcher.find()) {
        System.out.println("timestamp" + "=" + mMatcher.group("timestamp"));
        System.out.println("vendor" + "=" + mMatcher.group("vendor"));
        System.out.println("severity" + "=" + mMatcher.group("severity"));
        System.out.println("MNEMONIC" + "=" + mMatcher.group("MNEMONIC"));
        System.out.println("message" + "=" + mMatcher.group("message"));
        String message = mMatcher.group("message");
        Pattern pattern = Pattern.compile(regep);
        Matcher matcher = pattern.matcher(message);
        while (matcher.find()) {
            System.out.println(matcher.group());
        }
    }
}