PERL按照時間輸出的相關性

Question

我想問一些提示。我正在研究腳本解析一些有趣的數據，合成它，而不是寫在屏幕上。在我的情況下，我有3個屬性輸出「日期」，「時間」和一些「消息」。我有一些消息經常發生的日誌文件。我的想法是。如果它可能使用Perl進行關聯？例如，如果我在5分鐘內發生過9次事件，輸出只有1條消息，計數爲9次？

我的代碼是這一個：

#!/usr/bin/perl 
use strict; 

#what should be searched in logs 
my $regex = 'Error'; 

my @filtered_arr =(); 
my @formated_rows =(); 

my $filename = 'report3.txt'; 

while (<DATA>) { 
    if (my $i =/\b(\d\d.\d\d.\d\d\d\d)\b/ .. /^\n+$/) { 
     s/\n// if $i !~ /E0\z/; 

     my $logContent = "$_"; 

    open(my $fh, '>>', $filename) or die("Could not open file. $!"); 
    print $fh "$logContent"; 
    close $fh; 
    } 
} 

    open my $formatedLog, $filename or die "Could not open $filename: $!"; 

    while(my $line = <$formatedLog>){ 
     while ($line =~ m/$regex/g) { 
     $line =~ m/$regex/; 
      push @filtered_arr, $line; 
     } 
} 
    close $formatedLog; 

    for my $row (@filtered_arr) { 

    my $date = substr $row, 1, 10; 
    my $time = substr $row, 12, 8; 
    my $stringDistance = (length $row) - 24; 
    my $message = substr $row, 24, $stringDistance -1; 

    # creating formated array (For AB) 
    push @formated_rows, [$date,";", $time ,";", $message]; 
    } 

# first pass over rows: compute the maximum width for each column 
my @widths; 
for my $output_row (@formated_rows) { 
    for (my $col = 0; $col < @$output_row; $col++) { 
     $widths[$col] = length $output_row->[$col] if length $output_row->[$col] > ($widths[$col] // 0); 
    } 
} 

# compute the format. for this data, it works out to "%-3s %-11s %-6s %-5s\n" 
my $format = join(' ', map { "%-${_}s" } @widths) . "\n"; 

# second pass: print each row using the format 
for my $output_row (@formated_rows) { 
    printf $format, @$output_row; 
} 

__DATA__ 

[05.09.2015 18:44:56] - Error 505 
some text about Error 505 

[05.09.2015 18:45:56] - Error 505 
some text about Error 505 

[05.09.2015 18:46:56] - Error 505 
some text about Error 505 

[05.09.2015 18:47:56] - Error 505 
some text about Error 505 

[05.09.2015 18:48:56] - Error 505 
some text about Error 505 

[05.09.2015 18:49:56] - Error 505 
some text about Error 505 

[06.09.2015 12:46:56] - Error 404 
some text about Error 404 

[06.09.2015 12:47:56] - Error 404 
some text about Error 404 

[06.09.2015 12:48:56] - Error 404 
some text about Error 404 

[06.09.2015 12:48:56] - Oracle Error 
some text about Oracle Error 

[06.09.2015 12:49:56] - Error 404 
some text about Error 404 

我的輸出是這樣的：

05.09.2015 ; 18:44:56 ; Error 505 some text about Error 505 
05.09.2015 ; 18:44:56 ; Error 505 some text about Error 505 
05.09.2015 ; 18:45:56 ; Error 505 some text about Error 505 
05.09.2015 ; 18:45:56 ; Error 505 some text about Error 505 
05.09.2015 ; 18:46:56 ; Error 505 some text about Error 505 
05.09.2015 ; 18:46:56 ; Error 505 some text about Error 505 
05.09.2015 ; 18:47:56 ; Error 505 some text about Error 505 
05.09.2015 ; 18:47:56 ; Error 505 some text about Error 505 
05.09.2015 ; 18:48:56 ; Error 505 some text about Error 505 
05.09.2015 ; 18:48:56 ; Error 505 some text about Error 505 
05.09.2015 ; 18:49:56 ; Error 505 some text about Error 505 
05.09.2015 ; 18:49:56 ; Error 505 some text about Error 505 
06.09.2015 ; 12:46:56 ; Error 404 some text about Error 404 
06.09.2015 ; 12:46:56 ; Error 404 some text about Error 404 
06.09.2015 ; 12:47:56 ; Error 404 some text about Error 404 
06.09.2015 ; 12:47:56 ; Error 404 some text about Error 404 
06.09.2015 ; 12:48:56 ; Error 404 some text about Error 404 
06.09.2015 ; 12:48:56 ; Error 404 some text about Error 404 
06.09.2015 ; 12:48:56 ; Oracle Error some text about Oracle Error 
06.09.2015 ; 12:48:56 ; Oracle Error some text about Oracle Error 
06.09.2015 ; 12:49:56 ; Error 404 some text about Error 404 
06.09.2015 ; 12:49:56 ; Error 404 some text about Error 404 

而且我想要達到的輸出：

05.09.2015 ; 18:44:56 ; Error 505 some text about Error 505 ; 12 <- (Means it occur 12 times) 
06.09.2015 ; 12:46:56 ; Error 404 some text about Error 404 ; 8 
06.09.2015 ; 12:48:56 ; Oracle Error some text about Oracle Error; 2 

感謝您的任何提示Jan.

Answer 1

首先，使用日期/時間庫使您的生活更輕鬆。 Time::Piece是Perl發行版的一個標準部分，在這裏運行良好。其次，將時間標準化爲五分鐘的大塊。第三，創建關於規範化時間和錯誤消息的錯誤散列。

事情是這樣的，也許：

#!/usr/bin/perl 

use strict; 
use warnings; 
use 5.010; 

use Time::Piece; 

# Paragraph mode 
$/ = ''; 

my $format = '[%d.%m.%Y %H:%M:%S]'; 

my %errors; 

while (<DATA>) { 
    # Convert to one line 
    s/\n+/ /g; 
    my ($time, $error) = split /\s+\-\s+/; 
    $time = Time::Piece->strptime($time, $format); 
    my $mins = $time->min; 
    # Normalise to a five mins 
    # By subtracting the correct number of seconds 
    $time -= (($mins % 5) * 60) + $time->sec; 
    $errors{$time}{$error}++; 
} 

foreach my $time (keys %errors) { 
    foreach my $error (keys %{$errors{$time}}) { 
    say "$time ; $error ; $errors{$time}{$error}" 
    } 
} 

__DATA__ 
[05.09.2015 18:44:56] - Error 505 
some text about Error 505 

[05.09.2015 18:45:56] - Error 505 
some text about Error 505 

[05.09.2015 18:46:56] - Error 505 
some text about Error 505 

[05.09.2015 18:47:56] - Error 505 
some text about Error 505 

[05.09.2015 18:48:56] - Error 505 
some text about Error 505 

[05.09.2015 18:49:56] - Error 505 
some text about Error 505 

[06.09.2015 12:46:56] - Error 404 
some text about Error 404 

[06.09.2015 12:47:56] - Error 404 
some text about Error 404 

[06.09.2015 12:48:56] - Error 404 
some text about Error 404 

[06.09.2015 12:48:56] - Oracle Error 
some text about Oracle Error 

[06.09.2015 12:49:56] - Error 404 
some text about Error 404 

Answer 2

對於我（和比較）日期，看看Time::Piece，這應該是一個核心模塊，除非你使用的是非常古老的perl。您可以通過分析你的時刻字符串然後創建一個Time::Piece對象......所以一旦你拉出來只是時間戳記子...

my $datetime = Time::Piece->strptime($timestamp, '%d.%m.%Y %H:%M:%S'); 

，一旦你有Time::Piece對象，你可以添加和刪除秒，並且比較它與其他Time::Piece對象。你可能會做這樣的事情來創建截止時間......

$end_time = $datetime; 
$end_time += 1 while $end_time->minute !~ /(?:0|5)$/; 

給出一個$datetime的05.09.2015 18:46:56，$end_time將05.09.2015 18:50:00。然後，您可以繼續每行時間戳轉換爲Time::Piece對象，這些對象的數字比較，即

if ($datetime < $end_time) { 
    # ... increase count for the current logs error 
} 
else { 
    # ... define new $end_time from the current logs timestamp 
} 

最終我離開實際落實這些想法變成你的腳本由您決定。