<HTML><BODY><p>Lets look into this example:<br><br>$ cat test.php<br><?php</p><p>$json_wrong = '{ "answer": "42" }';<br>$json_correct = '{ "answer": 42 }';</p><p>var_dump(json_decode($json_wrong));</p><p>var_dump(json_decode($json_correct));</p><p>?><br><br>$ php test.php<br>object(stdClass)#1 (1) {<br> ["answer"]=><br> string(2) "42"<br>}<br>object(stdClass)#1 (1) {<br> ["answer"]=><br> int(42)<br>}<br><br>Среда, 10 июня 2015, 10:03 +03:00 от Фадеев Виталий Львович <fvl@mail.ru>:<br>
</p><blockquote style="margin: 10px; padding: 0px 0px 0px 10px; border-left-color: rgb(8, 87, 166); border-left-width: 1px; border-left-style: solid;">
<div>
<div class="js-helper js-readmsg-msg">
<style type="text/css"></style>
<div>
<base href="https://e.mail.ru/" target="_self">
<div id="style_14339198430000000905_BODY">
I think this is wrong. For example: unix timestamp. This is always number.<br><br><br>Среда, 10 июня 2015, 7:00 UTC от Chris Schafer <chrisp.schafer@gmail.com>:<br>
<blockquote style="margin: 10px; padding: 0px 0px 0px 10px; border-left-color: rgb(8, 87, 166); border-left-width: 1px; border-left-style: solid;">
<div>
<div>
<div>
<div>I believe it ends up taking everything as a string, but I could be wrong. <br><div>On Tue, Jun 9, 2015 at 11:59 PM Фадеев Виталий Львович <<a href="//e.mail.ru/compose/?mailto=mailto%3afvl@mail.ru" target="_blank">fvl@mail.ru</a>> wrote:<br><blockquote style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;">
<div>And, probably, there is mismatch:<br><br>$ cat num.txt <br>num: 42<br><br>$ cat num.rb<br>rule=:num: %answer:number%<br><br>$lognormalizer -r num.rb -e json < num.txt <br>{ "answer": "42" }<br><br>But if i read on <a href="https://en.wikipedia.org/wiki/JSON" target="_blank"><a href="https://en.wikipedia.org/wiki/JSON" target="_blank">https://en.wikipedia.org/wiki/JSON</a><br><br><p>JSON's basic types are:</p><ul><li>Number: a signed decimal number that may contain a fractional part and may use exponential <a title="E notation" href="https://en.wikipedia.org/wiki/E_notation" target="_blank"><font color="#0066cc">E notation</font></a>. JSON does not allow non-numbers like <a title="NaN" href="https://en.wikipedia.org/wiki/NaN" target="_blank"><font color="#0066cc">NaN</font></a>, nor does it make any distinction between integer and floating-point. (Even though JavaScript uses a <a title="Double-precision floating-point format" href="https://en.wikipedia.org/wiki/Double-precision_floating-point_format" target="_blank"><font color="#0066cc">double-precision floating-point format</font></a> for all its numeric values, other languages implementing JSON may encode numbers differently)</li><li><a title="String (computer science)" href="https://en.wikipedia.org/wiki/String_(computer_science)" target="_blank"><font color="#0066cc">String</font></a>: a sequence of zero or more <a title="Unicode" href="https://en.wikipedia.org/wiki/Unicode" target="_blank"><font color="#0066cc">Unicode</font></a> characters. Strings are delimited with double-quotation marks and support a backslash <a title="Escape character" href="https://en.wikipedia.org/wiki/Escape_character" target="_blank"><font color="#0066cc">escaping</font></a> syntax.<br><br></li></ul><p>So, i think lognorm return wrong JSON. This is must be without double quotes:<br>{ "answer": 42 }<br><br>Is this expected behavior?<br><br></p></div><div><a href="https://en.wikipedia.org/wiki/JSON" target="_blank">
</a><blockquote style="margin: 10px; padding: 0px 0px 0px 10px; border-left-color: rgb(8, 87, 166); border-left-width: 1px; border-left-style: solid;"><a href="https://en.wikipedia.org/wiki/JSON" target="_blank">
</a><div><a href="https://en.wikipedia.org/wiki/JSON" target="_blank">
</a><div><a href="https://en.wikipedia.org/wiki/JSON" target="_blank">
</a><div><a href="https://en.wikipedia.org/wiki/JSON" target="_blank">
</a><div><a href="https://en.wikipedia.org/wiki/JSON" target="_blank">
Also, i did not find how to get IPv6 and IPv4 string<br>For example:<br><br>IP: 2607:f8b0:4000:807::1006:<br>IP: 64.233.160.106<br><br>This all of google.com<br><br><br>Среда, 10 июня 2015, 6:15 UTC от Chris Schafer <chrisp.schafer@gmail.com>:<br>
</a><blockquote style="margin: 10px; padding: 0px 0px 0px 10px; border-left-color: rgb(8, 87, 166); border-left-width: 1px; border-left-style: solid;"><a href="https://en.wikipedia.org/wiki/JSON" target="_blank">
</a><div><a href="https://en.wikipedia.org/wiki/JSON" target="_blank">
</a><div><a href="https://en.wikipedia.org/wiki/JSON" target="_blank">
</a><div><a href="https://en.wikipedia.org/wiki/JSON" target="_blank">
</a><div><a href="https://en.wikipedia.org/wiki/JSON" target="_blank">Glad I can help. I spent way too much time learning this stuff and I don't get to use it often enough :)<br></a><div><a href="https://en.wikipedia.org/wiki/JSON" target="_blank">On Tue, Jun 9, 2015 at 11:13 PM David Lang <<a href="//e.mail.ru/compose/?mailto=mailto%3adavid@lang.hm" target="_blank">david@lang.hm</a>> wrote:<br><blockquote style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;"><a href="https://en.wikipedia.org/wiki/JSON" target="_blank">On Wed, 10 Jun 2015, Фадеев Виталий Львович wrote:<br>
<br>
><br>
> Hi!<br>
> I want to log all from apache. I use custom log in apache that looks like:<br>
><br>
> [2015-06-09 18:27:07 197 NOVT] [192.168.1.67] [192.168.1.67] [192.168.1.254] [818] [/var/www/host/css/button.css] [192.168.1.67] [HTTP/1.1] [1] [-] [GET] [5064] [?v=0] [GET /css/button.css?v=0 HTTP/1.1] [-] [200] [200] [0] [/css/button.css] [hostname.domain] [hostname.domain] [+] [1540] [1138] [" <a href="http://hostname.domain/index.html" target="_blank" rel="noreferrer">http://hostname.domain/index.html</a> "] ["Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0"]<br>
><br>
> For example, i create test.log that contains:<br>
> [2015-06-09 16:47:34 830 NOVT]<br>
><br>
> and test.rb:<br>
> rule=:[%date:date-iso% %time:time-24hr% %microsec:number% %timezone:char-to:]%<br>
><br>
> If i try i get:<br>
> $ lognormalizer -r test.rb -e json < test.log<br>
> { "originalmsg": "[2015-06-09 16:47:34 830 NOVT]", "unparsed-data": "]" }<br>
><br>
> How to parse data between [ and ] ?<br>
<br>
you almost have it correct. The only thing that you are missing is that char-to<br>
doesn't 'consume' the matching character, so your rule would need to be:<br>
<br>
rule=:[%date:date-iso% %time:time-24hr% %microsec:number% %timezone:char-to:]%]<br>
<br>
David Lang<br>
_______________________________________________<br>
Lognorm mailing list<br>
<a href="//e.mail.ru/compose/?mailto=mailto%3aLognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a><br>
<a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank" rel="noreferrer">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
_______________________________________________<br>
Lognorm mailing list<br>
<a href="//e.mail.ru/compose/?mailto=mailto%3aLognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a><br>
<a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank" rel="noreferrer">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
</blockquote></div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
</div>
<div>_______________________________________________<br>
Lognorm mailing list<br>
<a>Lognorm@lists.adiscon.com</a><br>
<a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
</div>
</div>
</div>
</div>
</blockquote>
<br></div></blockquote></div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
</div>
<div>_______________________________________________<br>
Lognorm mailing list<br>
<a href="/compose?To=Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br>
<a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
</div>
<base href="https://e.mail.ru/" target="_self">
</div>
</div>
</div>
</blockquote>
<br></BODY></HTML>