Re: Parsing log files (still)

Splitting on /:\s*/ will save you some work. Actually, let's split on /:\s+/ to avoid needlessly splitting up the date.

We have two ways of looking at item 3 (formerly item 5): 1) It's either a space seperated list, and brackets need to be removed from the second (split approach), or 2) it's a string from which two substrings should be extractded (regexp approach). Since I'd use a regexp to remove the brackets, I might as well use a regexp for the whole thing.

I also added two sanity checks, in case the line doesn't appear as we think.

while (<DATA>) {
   chomp;

   my @parts = split /:\s+/, $_;
   next if $#parts < 3;

   my @parts_of_3 = $parts[3] =~ /^(\d+) <(.*)>$/;
   next unless @parts_of_3;

   my @result = ($parts[1], @parts_of_3);
   print(join(', ', @result), "\n");
}

__DATA__
Jul  6 14:36:41 moe postfix/smtp[15107]: A73DC113B63: to=<oetiker@conc
+entric.com>, relay=adamant.concentric.com[207.155.248.168], delay=17,
+ status=bounced (host adamant.concentric.com[207.155.248.168] said: 5
+54 <oetiker@concentric.com>: Recipient address rejected: Unknown or i
+nvalid user oetiker@concentric.com (in reply to RCPT TO command))
[download]

Comment on Re: Parsing log files (still) Select or Download Code

Replies are listed 'Best First'.
Re^2: Parsing log files (still) by Kanji (Parson) on Jul 06, 2005 at 23:11 UTC
I'd personally use regexp method that GrandFather suggests because it gives me just the data I'm after with the added benefit of (basic) sanity checks, but if you're going to go the `split` method, using a more complex pattern avoids the need for post-split massaging... `my @result = split /(: \|.<\|>,)/; my($qid,$email,$status) = @result[2,6,10]; # or my($qid,$email,$status) = (split /(: \|.<\|>,)/)[2,6,10];` [download] And depending on the extent of your Postfix-log parsing needs, you may be able to save yourself some effort by using or bastardizing pflogsum (assuming you don't find the code too hairy `:-)`). --k.	[reply] [d/l]

Replies are listed 'Best First'.

Re^2: Parsing log files (still)
by Kanji (Parson) on Jul 06, 2005 at 23:11 UTC

I'd personally use regexp method that GrandFather suggests because it gives me just the data I'm after with the added benefit of (basic) sanity checks, but if you're going to go the split method, using a more complex pattern avoids the need for post-split massaging...

my @result = split /(: |.<|>,)/;
my($qid,$email,$status) = @result[2,6,10];

  # or 

my($qid,$email,$status) = (split /(: |.<|>,)/)[2,6,10];
[download]

And depending on the extent of your Postfix-log parsing needs, you may be able to save yourself some effort by using or bastardizing pflogsum (assuming you don't find the code too hairy :-)).

--k.

[reply]
[d/l]