<HTML><BODY>Just want to clarify:<br>i think it would be better to add IPv6 parameter to parse IPv6 address and parameter for both versions of IP.<br><br>It can be used, as example, in apache %c - client IP. It is may contain IPv4 addresss or IPv6 address.<br><br><br>Среда, 10 июня 2015, 10:39 -07:00 от David Lang <david@lang.hm>:<br>
<blockquote style="margin: 10px; padding: 0px 0px 0px 10px; border-left-color: rgb(8, 87, 166); border-left-width: 1px; border-left-style: solid;">
<div>
<div class="js-helper js-readmsg-msg">
<style type="text/css"></style>
<div>
<base href="https://e.mail.ru/" target="_self">
<div id="style_14339579850000000906_BODY">On Wed, 10 Jun 2015, Фадеев Виталий Львович wrote:<br>
<br>
> And, probably, there is mismatch:<br>
><br>
> $ cat num.txt <br>
> num: 42<br>
><br>
> $ cat num.rb<br>
> rule=:num: %answer:number%<br>
><br>
> $lognormalizer -r num.rb -e json < num.txt <br>
> { "answer": "42" }<br>
><br>
> But if i read on <a href="https://en.wikipedia.org/wiki/JSON" target="_blank">https://en.wikipedia.org/wiki/JSON</a><br>
><br>
> JSON's basic types are:<br>
> * Number: a signed decimal number that may contain a fractional part and may use exponential E notation . JSON does not allow non-numbers like NaN , nor does it make any distinction between integer and floating-point. (Even though JavaScript uses a double-precision floating-point format for all its numeric values, other languages implementing JSON may encode numbers differently)<br>
> * String : a sequence of zero or more Unicode characters. Strings are delimited with double-quotation marks and support a backslash escaping syntax.<br>
><br>
> So, i think lognorm return wrong JSON. This is must be without double quotes:<br>
> { "answer": 42 }<br>
><br>
> Is this expected behavior?<br>
<br>
this is the current behavior. The unreleased version in git has a new function <br>
'interpret' that can convert strings to numbers among other things.<br>
<br>
<br>
>> Also, i did not find how to get IPv6 and IPv4 string<br>
>> For example:<br>
>><br>
>> IP: 2607:f8b0:4000:807::1006:<br>
>> IP: 64.233.160.106<br>
<br>
there is an IPv4 type, but not a IPv6 type, it probably should be added.<br>
<br>
David Lang<br>
<br>
>> This all of google.com<br>
>><br>
>><br>
>> Среда, 10 июня 2015, 6:15 UTC от Chris Schafer <<a href="/compose?To=chrisp.schafer@gmail.com">chrisp.schafer@gmail.com</a>>:<br>
>>> Glad I can help. I spent way too much time learning this stuff and I don't get to use it often enough :)<br>
>>> On Tue, Jun 9, 2015 at 11:13 PM David Lang < <a href="/compose?To=david@lang.hm">david@lang.hm</a> > wrote:<br>
>>>> On Wed, 10 Jun 2015, Фадеев Виталий Львович wrote:<br>
>>>><br>
>>>>><br>
>>>>> Hi!<br>
>>>>> I want to log all from apache. I use custom log in apache that looks like:<br>
>>>>><br>
>>>>> [2015-06-09 18:27:07 197 NOVT] [192.168.1.67] [192.168.1.67] [192.168.1.254] [818] [/var/www/host/css/button.css] [192.168.1.67] [HTTP/1.1] [1] [-] [GET] [5064] [?v=0] [GET /css/button.css?v=0 HTTP/1.1] [-] [200] [200] [0] [/css/button.css] [hostname.domain] [hostname.domain] [+] [1540] [1138] [" <a href="http://hostname.domain/index.html" target="_blank">http://hostname.domain/index.html</a> "] ["Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0"]<br>
>>>>><br>
>>>>> For example, i create test.log that contains:<br>
>>>>> [2015-06-09 16:47:34 830 NOVT]<br>
>>>>><br>
>>>>> and test.rb:<br>
>>>>> rule=:[%date:date-iso% %time:time-24hr% %microsec:number% %timezone:char-to:]%<br>
>>>>><br>
>>>>> If i try i get:<br>
>>>>> $ lognormalizer -r test.rb -e json < test.log<br>
>>>>> { "originalmsg": "[2015-06-09 16:47:34 830 NOVT]", "unparsed-data": "]" }<br>
>>>>><br>
>>>>> How to parse data between [ and ] ?<br>
>>>><br>
>>>> you almost have it correct. The only thing that you are missing is that char-to<br>
>>>> doesn't 'consume' the matching character, so your rule would need to be:<br>
>>>><br>
>>>> rule=:[%date:date-iso% %time:time-24hr% %microsec:number% %timezone:char-to:]%]<br>
>>>><br>
>>>> David Lang<br>
>>>> _______________________________________________<br>
>>>> Lognorm mailing list<br>
>>>> <a href="/compose?To=Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br>
>>>> <a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
>>>> _______________________________________________<br>
>>>> Lognorm mailing list<br>
>>>> <a href="/compose?To=Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br>
>>>> <a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
>><br>
>> _______________________________________________<br>
>> Lognorm mailing list<br>
>> <a href="/compose?To=Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br>
>> <a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br data-mce-bogus="1"></div>
<div>_______________________________________________<br>
<br>
Lognorm mailing list<br>
<br>
<a href="/compose?To=Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br>
<br>
<a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
<br>
</div>
<base href="https://e.mail.ru/" target="_self">
</div>
</div>
</div>
</blockquote>
<br></BODY></HTML>