求日志匹配正则

本帖最后由 LMUser 于 2010-08-20 12:54 编辑

58.251.166.12 [19/Aug/2010:23:59:05 +0800] "/e.st?e_cd=dm_9_g10_tp&[email protected]&send_date=2010-07-30" 200 "" ""
115.232.16.62 [19/Aug/2010:23:59:13 +0800] "/e.st?e_cd=dm_9_g10_tp&[email protected]&send_date=2010-08-10" 200 "" ""
120.193.201.30 [19/Aug/2010:23:59:25 +0800] "/e.st?e_cd=N5&uid=1901543&send_date=2010-08-19" 200 "" ""
221.221.129.86 [19/Aug/2010:23:59:30 +0800] "/e.st?e_cd=dm_9_g10_tp&[email protected]&send_date=2010-08-09" 200 "" ""
61.49.54.119 [19/Aug/2010:23:59:31 +0800] "/e.st?e_cd=T16&uid=611179&send_date=2010-06-27" 200 "" ""
58.250.89.98 [19/Aug/2010:23:59:31 +0800] "/e.st?e_cd=T16&uid=382869&send_date=2010-05-29" 200 "" ""
120.193.201.30 [19/Aug/2010:23:59:32 +0800] "/e.st?e_cd=[N5]&uid=1901543" 200 "" ""
58.34.217.126 [19/Aug/2010:23:59:36 +0800] "/e.st?e_cd=dm_9_g10_tp&[email protected]&send_date=2010-08-19" 200 "" ""
180.155.231.176 [19/Aug/2010:23:59:36 +0800] "/e.st?e_cd=dm_9_g10_tp&[email protected]&send_date=2010-08-11" 200 "" ""
120.32.237.48 [19/Aug/2010:23:59:38 +0800] "/e.st?e_cd=dm_9_g10_tp&[email protected]&send_date=2010-07-18" 200 "" ""  

结果就是匹配 e_cd=dm_9_g10_tp& 红色标注这两个位置的值；
[root@WEB1 st.dajie.com]# head -10 email_access.log | perl -e 'while(<>) { /^[^"]+"\/..st\?(e_cd|e_cat)=([^&]+)&/; print "$1\t$2\t\n";}' | more
e_cd    dm_9_g10_tp
e_cd    dm_9_g10_tp
e_cd    N5
e_cd    dm_9_g10_tp
e_cd    T16
e_cd    T16
e_cd    [N5]
e_cd    dm_9_g10_tp
e_cd    dm_9_g10_tp
e_cd    dm_9_g10_tp

有一个问题，在 e_cd=[N5]& 中N5的值，如果匹配，应该把[]过滤掉；

难道是太简单？

要去掉 [] 的话，可以用下面的这个。你的正则里面并没有去掉[]的部分啊。

perl -nale 'print "$1 $2" if $F[3] =~ /(e_cd|e_cat)=\[?([^&]+?)\]?\&/'   email_access.log