正則表達式從日誌中排除某些錯誤類型

Question

我對此比較陌生，但我需要編寫一個正則表達式以排除日誌中某些已知錯誤類型的幫助。

00:11:04 [0] 70-Error: Invalid index command: "/search.asp". 
00:11:04 [0] 70-Error: Invalid index command: "/wingate-internal//boot.ini". 
00:11:04 [0] 70-Error: Invalid index command: "/". 

，並排除這樣的：

04:16:46 [8] 70-Error: Action failed - unencrypted communication is not allowed (10.40.88.11): "ACTION=GETSTATUS". 
04:14:17 [7] 70-Error: Action failed - unencrypted communication is not allowed (10.40.88.11): "ACTION=GETSTATUS". 

我有相同的日誌中的其他錯誤類型的都很好，報告，例如：

17:43:17.370 ExecuterW: 957:Error [2400] DB Matters - addDocToWorklist - doSqlCommand: Error executing SQL statement - CID ed83d1e0d 

換句話說，我想正則表達式報告除上述兩種類型之外的所有錯誤。

我試圖創建這個正則表達式，但它似乎並沒有工作：

/(?:)(?:[^Error\:\ Action\ failed\ \-\ unencrypted\ communication\ is\ not\ allowed]*)(?:[^Error\:\ Invalid\ index\ command\:]*)/m 

任何幫助將大大讚賞。

Answer 1

嘗試此正則表達式：

\d+:\d+:\d+\s+\[\d\]\s+\d+-(Error:\s+Action\s+failed\s+\-\s+unencrypted\s+communication\s+is\s+not\s+allowed\s+.+|Error:\s+Invalid\s+index\s+command:\s+.+) 

用於多個輸入本已經過測試here。

它是什麼做一個小的介紹和解釋：

\ d：指符合個人數字。對於23號，這將匹配2和3作爲單獨的數字，但不能作爲一個數字 \ d +：意味着匹配至少一位數字後跟任意數量的多位數字。它會將23讀作一位數字。 \ s：表示匹配一個空格 \ s +：匹配多個空格，甚至是一個製表符。有些人可能會說，我們可以使用\ t作爲製表符，但製表符是空間的連接，所以在這裏使用了。 []：裝置匹配本方括號 （）內的字符中的任何一個：平均匹配存在於小括號內的所有表達

說明： 你的輸入字符串：

04:16:46 [8] 70-Error: Action failed - unencrypted communication is not allowed (10.40.88.11): "ACTION=GETSTATUS".

-->`\d+:\d+:\d+\s+\[\d\]` 

matches 04:16:46 [8]

-->\s+\[\d\]\s+\d+- 

matches [8] 70- including the space before[8]

-->(Error:\s+Action\s+failed\s+\-\s+unencrypted\s+communication\s+is\s+not\s+allowed\s+.+ 

matches till Error: Action failed - unencrypted communication is not allowed (10.40.88.11): "ACTION=GETSTATUS".

請注意，在最後的手段上述正則表達式.+，允許後和空間比賽的每一件事情別人後面了。 希望澄清。

|代表OR

-->Error:\s+Invalid\s+index\s+command:\s+.+) 

matches Error: Invalid index command: followed by any string/number/special characters

注：（A | B）匹配表達式a和b，如果兩者都存在否則既符合目前的表達。

Answer 2

如何：

^(?!.*Error: Invalid index command)(?!.*Error: Action failed - unencrypted communication is not allowed) 

說明：

^       : begining of the string 
(?!       : negative lookahead (asserts that the following is not present in the string 
    .*      : 0 or more (*) any character but newline (.) 
    Error: Invalid index command : literally 
)       : end of lookahead 
(?!       : negative lookahead (asserts that the following is not present in the string 
    .*      : 0 or more (*) any character but newline (.) 
    Error: Action failed - unencrypted communication is not allowed : literally 
)       : end of lookahead 

此正則表達式的所有行匹配不包含Error: .........

在Perl腳本中使用：

#!/usr/bin/perl 
use Modern::Perl; 

my $re1 = qr/^(?!.*Error: Invalid index command)(?!.*Error: Action failed - unencrypted communication is not allowed)/; 

while(<DATA>) { 
    print if /$re1/; 
} 

__DATA__ 
17:43:17.370 ExecuterW: 957:Error [2400] DB Matters - addDocToWorklist - doSqlCommand: Error executing SQL statement - CID ed83d1e0d 
00:11:04 [0] 70-Error: Invalid index command: "/search.asp". 
17:43:17.370 ExecuterW: 957:Error [2400] DB Matters - addDocToWorklist - doSqlCommand: Error executing SQL statement - CID ed83d1e0d 
00:11:04 [0] 70-Error: Invalid index command: "/wingate-internal//boot.ini". 
17:43:17.370 ExecuterW: 957:Error [2400] DB Matters - addDocToWorklist - doSqlCommand: Error executing SQL statement - CID ed83d1e0d 
00:11:04 [0] 70-Error: Invalid index command: "/". 
17:43:17.370 ExecuterW: 957:Error [2400] DB Matters - addDocToWorklist - doSqlCommand: Error executing SQL statement - CID ed83d1e0d 
04:16:46 [8] 70-Error: Action failed - unencrypted communication is not allowed (10.40.88.11): "ACTION=GETSTATUS". 
17:43:17.370 ExecuterW: 957:Error [2400] DB Matters - addDocToWorklist - doSqlCommand: Error executing SQL statement - CID ed83d1e0d 
04:14:17 [7] 70-Error: Action failed - unencrypted communication is not allowed (10.40.88.11): "ACTION=GETSTATUS". 
17:43:17.370 ExecuterW: 957:Error [2400] DB Matters - addDocToWorklist - doSqlCommand: Error executing SQL statement - CID ed83d1e0d 

輸出：

17:43:17.370 ExecuterW: 957:Error [2400] DB Matters - addDocToWorklist - doSqlCommand: Error executing SQL statement - CID ed83d1e0d 
17:43:17.370 ExecuterW: 957:Error [2400] DB Matters - addDocToWorklist - doSqlCommand: Error executing SQL statement - CID ed83d1e0d 
17:43:17.370 ExecuterW: 957:Error [2400] DB Matters - addDocToWorklist - doSqlCommand: Error executing SQL statement - CID ed83d1e0d 
17:43:17.370 ExecuterW: 957:Error [2400] DB Matters - addDocToWorklist - doSqlCommand: Error executing SQL statement - CID ed83d1e0d 
17:43:17.370 ExecuterW: 957:Error [2400] DB Matters - addDocToWorklist - doSqlCommand: Error executing SQL statement - CID ed83d1e0d 
17:43:17.370 ExecuterW: 957:Error [2400] DB Matters - addDocToWorklist - doSqlCommand: Error executing SQL statement - CID ed83d1e0d