用途 | 日志原文 | 正则表达式 | 提取结果 |
提取大括号中的内容 | [2021-11-24 11:11:08,232][328495eb-b562-478f-9d5d-3bf7e][INFO] curl -H 'Host: ' http://abc.com:8080/pc/api -d '{"version": "1.0", "user": "CGW", "password": "123", "timestamp": 1637723468, "interface": {"Name": "ListDetail", "para": {"owner": "1253", "limit": [10, 14], "orderField": "createTime"}}} | \\{[^\\}]+\\} | {"version": "1.0", "user": "CGW", "password": "123", "timestamp": 1637723468, "interface": {"Name": "ListDetail", "para": {"owner": "1253", "limit": [10, 10], "orderField": "createTime"}}} |
提取中括号的内容 | [2021-11-24 11:11:08,232][328495eb-b562-478f-9d5d-3bf7e][INFO] curl -H 'Host: ' http://abc.com:8080/pc/api -d '{"version": "1.0", "user": "CGW", "password": "123", "timestamp": 1637723468, "interface": {"Name": "ListDetail", "para": {"owner": "1253", "limit": [10, 14], "orderField": "createTime"}}} | \\[\\S+\\] | [328495eb-b562-478f-9d5d-3bf7e]
[INFO] |
提取时间 | [2021-11-24 11:11:08,232][328495eb-b562-478f-9d5d-3bf7e][INFO] curl -H 'Host: ' http://abc.com:8080/pc/api -d '{"version": "1.0", "user": "CGW", "password": "123", "timestamp": 1637723468, "interface": {"Name": "ListDetail", "para": {"owner": "1253", "limit": [10, 14], "orderField": "createTime"}}} | \\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2},\\d{3} | 2021-11-08 11:11:08,232 |
提取特定长度的大写字符 | [2021-11-24 11:11:08,232][328495eb-b562-478f-9d5d-3bf7e][INFO] curl -H 'Host: ' http://abc.com:8080/pc/api -d '{"version": "1.0", "user": "CGW", "password": "123", "timestamp": 1637723468, "interface": {"Name": "ListDetail", "para": {"owner": "1253", "limit": [10, 14], "orderField": "createTime"}}} | [A-Z]{4} | INFO |
提取特定长度的小写字符 | [2021-11-24 11:11:08,232][328495eb-b562-478f-9d5d-3bf7e][INFO] curl -H 'Host: ' http://abc.com:8080/pc/api -d '{"version": "1.0", "user": "CGW", "password": "123", "timestamp": 1637723468, "interface": {"Name": "ListDetail", "para": {"owner": "1253", "limit": [10, 15], "orderField": "createTime"}}} | [a-z]{6} | versio
passwo
timest
interf
create |
提取字母+数字 | [2021-11-24 11:11:08,232][328495eb-b562-478f-9d5d-3bf7e][INFO] curl -H 'Host: ' http://abc.com:8080/pc/api -d '{"version": "1.0", "user": "CGW", "password": "123", "timestamp": 1637723468, "interface": {"Name": "ListDetail", "para": {"owner": "1253", "limit": [10, 14], "orderField": "createTime"}}} | ([a-z]{3}):([0-9]{4}) | com:8080 |
regex_match(字段值, regex="", full=True)
参数名称 | 参数描述 | 参数类型 | 是否必须 | 参数默认值 | 参数取值范围 |
data | 字段值 | string | 是 | - | - |
regex | 正则表达式 | string | 是 | - | - |
full | 是否开启全匹配,对于全匹配,必须值完全满足正则,部分匹配则表示值中部分内容满足正则 | bool | 否 | True | - |
{"IP":"192.168.0.1", "status": "500"}
//判断正则公式"192\\.168.*"和字段ip的值192.168.0.1是否完全匹配,将结果保存到新字段"matched"中。t_if(regex_match(v("IP"), regex="192\\.168.*", full=True), fields_set("matched", True))
{"IP":"192.168.0.1","matched":"TRUE","status":"500"}
{"IP":"192.168.0.1", "status": "500"}
t_if(regex_match(v("ip"), regex="192", full=False), fields_set("matched", True))
{"IP":"192.168.0.1","matched":"TRUE","status":"500"}
regex_select(字段值, regex="", index=1, group=1)
参数名称 | 参数描述 | 参数类型 | 是否必须 | 参数默认值 | 参数取值范围 |
data | 字段值 | string | 是 | - | - |
regex | 正则表达式 | string | 是 | - | - |
index | 匹配结果中的第几个表达式 | number | 否 | 默认第一个 | - |
group | 匹配结果中的第几个分组 | number | 否 | 默认第一个 | - |
{"data":"hello123,world456", "status": "500"}
fields_set("match_result", regex_select(v("data"), regex="[a-z]+(\\d+)",index=0, group=0))fields_set("match_result1", regex_select(v("data"), regex="[a-z]+(\\d+)", index=1, group=0))fields_set("match_result2", regex_select(v("data"), regex="([a-z]+)(\\d+)",index=0, group=0))fields_set("match_result3", regex_select(v("data"), regex="([a-z]+)(\\d+)",index=0, group=1))
{"match_result2":"hello123","match_result1":"world456","data":"hello123,world456","match_result3":"hello","match_result":"hello123","status":"500"}
regex_split(字段值, regex=\\"\\", limit=100)
参数名称 | 参数描述 | 参数类型 | 是否必须 | 参数默认值 | 参数取值范围 |
data | 字段值 | string | 是 | - | - |
regex | 正则表达式 | string | 是 | - | - |
limit | 分割最大数组长度,当超过长度时,剩余未分割部分将作为一个元素,添加到数组 | number | 否 | 默认值100 | - |
{"data":"hello123world456", "status": "500"}
fields_set("split_result", regex_split(v("data"), regex="\\d+"))
{"data":"hello123world456","split_result":"[\\"hello\\",\\"world\\"]","status":"500"}
regex_replace(字段值, regex="", replace="", count=0)
参数名称 | 参数描述 | 参数类型 | 是否必须 | 参数默认值 | 参数取值范围 |
data | 字段值 | string | 是 | - | - |
regex | 正则表达式 | string | 是 | - | - |
replace | 目标字符串,使用此字符串替换匹配结果 | string | 是 | - | - |
count | 替换次数,默认0,进行全部替换 | number | 否 | 默认值0 | - |
{"data":"hello123world456", "status": "500"}
fields_set("replace_result", regex_replace(v("data"), regex="\\d+", replace="", count=0))
{"replace_result":"helloworld","data":"hello123world456","status":"500"}
{"Id": "dev@12345","Ip": "11.111.137.225","phonenumber": "13912345678"}
//对 Id 字段进行脱敏处理,结果为dev@***45fields_set("Id",regex_replace(v("Id"),regex="\\d{3}", replace="***",count=0))fields_set("Id",regex_replace(v("Id"),regex="\\S{2}", replace="**",count=1))//对 phonenumber 字段进行脱敏处理,将中间的4位数替换为****,结果为139****5678fields_set("phonenumber",regex_replace(v("phonenumber"),regex="(\\d{0,3})\\d{4}(\\d{4})", replace="$1****$2"))//对 IP 字段进行脱敏处理,将第二段替换为***,结果为11.***137.225。fields_set("Ip",regex_replace(v("Ip"),regex="(\\d+\\.)\\d+(\\.\\d+\\.\\d+)", replace="$1***$2",count=0))
{"Id":"**v@***45","Ip":"11.***.137.225","phonenumber":"139****5678"}
regex_findall(字段值, regex="")
参数名称 | 参数描述 | 参数类型 | 是否必须 | 参数默认值 | 参数取值范围 |
data | 字段值 | string | 是 | - | - |
regex | 正则表达式 | string | 是 | - | - |
{"data":"hello123world456", "status": "500"}
fields_set("result", regex_findall(v("data"), regex="\\d+"))
{"result":"[\\"123\\",\\"456\\"]","data":"hello123world456","status":"500"}
本页内容是否解决了您的问题?