Re: Parsing text files with a regex lookahead

I came up with the following, which isn't 100% there. The difficulty is that some keys use underscores ("device_id") and others do not ("src zone"). Is there a way to fix this in the application/configuration? Is it correct assuming that "proto" goes with "6"?

Update: New pattern...
/ ((?:src\s|dst\s|translated\s)?\S+) \n? = (")? ((?:(?(2)[^"]|\S)(?!\S+=))+) /xmg;
[download]

use warnings;
use strict;
use Data::Dumper;

my %hash;
my @records;
my $record;
{
    local $/ = "\n\n";
    @records = <DATA>;
}
for (@records) {
    ++$record;
    $hash{$record}{$1} = $3 while $_ =~ /(\S+)=(")?((?:(?(2)[^"]|\S)(?
+!\S+=))+)/mg;
}

print Data::Dumper->Dump([\%hash]);

__DATA__

messages:Dec 17 09:41:08 10.14.93.7 ns5xp: NetScreen device_id=ns5xp  
system-notification-00257(traffic): start_time="2002-12-17 09:45:58" d
+uration=5 policy_id=0 service=tcp/port:8000 proto
=6 src zone=Trust dst zone=Untrust action=Permit sent=1034 rcvd=19829 
+src=10.14.94.221 dst=10.14.90.217 src_port=1059 dst_port=8000 transla
+ted ip=10.14.93.7 port=1223

messages:Dec 17 09:41:08 10.14.93.7 ns5xp: NetScreen device_id=ns5xp  
+system-notification-00257(traffic): start_time="2002-12-17 09:45:59" 
+duration=4 policy_id=0 service=tcp/port:8000 proto
=6 src zone=Trust dst zone=Untrust action=Permit sent=722 rcvd=520 src
+=10.14.94.221 dst=10.14.90.217 src_port=1060 dst_port=8000 translated
+ ip=10.14.93.7 port=1224
[download]

Comment on Re: Parsing text files with a regex lookahead Select or Download Code

Replies are listed 'Best First'.
Re^2: Parsing text files with a regex lookahead by jalewis2 (Monk) on Sep 24, 2007 at 18:11 UTC
Those are netscreen firewall logs... so no chance of modifying the output. I sometimes wonder what the developers of these devices are thinking when the make them. Thanks for the try, I have some ideas to work with now.	[reply]