Skip to content

Instantly share code, notes, and snippets.

@DerekHawkins
Created July 28, 2021 17:42
Show Gist options
  • Save DerekHawkins/4e271d75eebfac45f418d94e73e0e5ba to your computer and use it in GitHub Desktop.
Save DerekHawkins/4e271d75eebfac45f418d94e73e0e5ba to your computer and use it in GitHub Desktop.
def log_parse(data):
# Response Size
try:
size = re.search(r'[0-9] (\d{1,4})', data).group(1)
except AttributeError as e:
size = 'n/a'
# Server Response
try:
server_response = re.search(r'http.*?[\"]', data).group(0).replace('"', '')
except AttributeError as e:
server_response = 'n/a'
# Date Parameter
original_date_time_str = re.sub(r':.*', '', re.search(r'\[.*\]', data).group(0).split()[0].replace('[', ''))
date = parse(timestr=original_date_time_str)
date_str = date.strftime('%m/%d/%Y')
# Requested resource
requested_element = re.search(r'"(GET|POST|PUT|PATCH|DEBUG|HEAD|INDEX|PROPFIND|SEARCH|OPTIONS).*" [0-9]', data).group(0)
if 'GET' in requested_element:
request_type = 'GET'
requested_element = requested_element.replace('"GET ', '')
elif 'POST' in requested_element:
request_type = 'POST'
requested_element = requested_element.replace('"POST ', '')
elif 'PUT' in requested_element:
request_type = 'PUT'
requested_element = requested_element.replace('"PUT ', '')
elif 'PATCH' in requested_element:
request_type = 'PATCH'
requested_element = requested_element.replace('"PATCH ', '')
elif 'DEBUG' in requested_element:
request_type = 'DEBUG'
requested_element = requested_element.replace('"DEBUG ', '')
elif 'HEAD' in requested_element:
request_type = 'HEAD'
requested_element = requested_element.replace('"HEAD ', '')
elif 'INDEX' in requested_element:
request_type = 'INDEX'
requested_element = requested_element.replace('"INDEX ', '')
elif 'PROPFIND' in requested_element:
request_type = 'PROPFIND'
requested_element = requested_element.replace('"PROPFIND ', '')
elif 'SEARCH' in requested_element:
request_type = 'SEARCH'
requested_element = requested_element.replace('"SEARCH ', '')
elif 'OPTIONS' in requested_element:
request_type = 'OPTIONS'
requested_element = requested_element.replace('"OPTIONS ', '')
main_request = re.sub('" [0-9]', '', requested_element).split(' ')[0]
log_dict = {
'ip_address':re.match(r'.* - -', data).group(0).replace(' - -', ''),
'date':date_str,
'request_type': main_request,
'request_method': request_type,
'status_code': re.search(r'" \d{1,3}', data).group(0).replace('" ', ''),
'size': size,
'server_response':server_response,
'user_agent':re.search(r'\" \".*?\"', data).group(0).replace('"', '').strip(),
'host':re.search(r' host=.*? ', data).group(0).strip().replace('host=', '')
}
return log_dict
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment