Home > Enterprise >  Regex for openldap logs
Regex for openldap logs

Time:02-21

I'm trying to build a regex to divide the openldap logs to different regex groups

Logs:

620da112 conn=2871219 op=1 SRCH attr=extensionAttribute6
620da112 conn=2871220 fd=60 ACCEPT from IP=10.17.28.159:35708 (IP=0.0.0.0:19000)
620da112 conn=2871219 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
620da112 conn=2871219 op=2 UNBIND
620da112 conn=2871219 fd=52 closed
620da112 conn=2871220 fd=60 TLS established tls_ssf=256 ssf=256
620da112 conn=2871220 op=0 BIND dn="cn=admin,dc=ClinicalPortal" method=128

I need to create a regex where i need to divide each one to a group so that i can assign that to a variable and then the remaining part after the operation(UNBIND,closed,TLS established,BIND...) to a different variable(eg: tag=101 err=0 nentries=1 text= to a diff variable) I have tried the following regex so far but it doesn't work for all the lines and even it doesn't give the last values(eg: tag=101 err=0 nentries=1 text= to a diff variable) as a single group Expression:

function printMatch(line){

  const matchings = myRe.exec(line);
  console.log("Line --START");
  if(matchings !=null){
    for(var i=0;i<matchings.length;i  ){
    console.log("Group " i ":" matchings[i]);
    }  
  } else {
    console.log("Line " line " do not match the REGEX");
  }
  console.log("Line --END");

}

const myRe = /^([A-Za-z[0-9]{8})\s([=A-Za-z[0-9]*)\s([=A-Za-z[0-9]*)\s([A-Z\s{1}]*)/g;
printMatch('620da112 conn=2871219 op=1 SRCH attr=extensionAttribute6');
printMatch('620da112 conn=2871220 fd=60 ACCEPT from IP=10.17.28.159:35708 (IP=0.0.0.0:19000)');
printMatch('620da112 conn=2871219 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=');
printMatch('620da112 conn=2871219 op=2 UNBIND');
printMatch('620da112 conn=2871220 fd=60 TLS established tls_ssf=256 ssf=256');
printMatch('620da112 conn=2871220 op=0 BIND dn="cn=admin,dc=ClinicalPortal" method=128');

CodePudding user response:

"Is the OP looking for a tokenizing similar to this?.. /^(?<id>[a-zA-Z0-9]{8})\s (?<conn>\w =\S )\s (?<op>\w =\S )\s (?<cmd>.*?)\s*(?<rest>\w =.*)?$/gm – Peter Seliger

"Works like a charm!!! Could you please answer this one instead of a comment would like to accept it as a answer." – Pathfinder

const multilineSample = `620da112 conn=2871219 op=1 SRCH attr=extensionAttribute6
620da112 conn=2871220 fd=60 ACCEPT from IP=10.17.28.159:35708 (IP=0.0.0.0:19000)
620da112 conn=2871219 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
620da112 conn=2871219 op=2 UNBIND
620da112 conn=2871219 fd=52 closed
620da112 conn=2871220 fd=60 TLS established tls_ssf=256 ssf=256
620da112 conn=2871220 op=0 BIND dn="cn=admin,dc=ClinicalPortal" method=128`;

const regXNamedTokens =
  // see ... [https://regex101.com/r/k9mUPP/1]
  /^(?<id>[a-zA-Z0-9]{8})\s (?<conn>\w =\S )\s (?<op>\w =\S )\s (?<cmd>.*?)\s*(?<rest>\w =.*)?$/gm;

console.log(
  'all match results ...',
  Array.from(
    multilineSample.matchAll(regXNamedTokens)
  )
);
console.log(
  'all results each with its mapped named capture group ...',
  Array.from(
    multilineSample.matchAll(regXNamedTokens)
  )
  .map(({ groups }) => groups)
);
.as-console-wrapper { min-height: 100%!important; top: 0; }

  • Related