0 
2011-12-01T00:43:51.251871+05:18 Dec 01 2011 00:41:32 KOC-TEJ-AMEX-ASA-5510-6 : %ASA-4-106023: Deny icmp src TCS:172.26.40.1 dst AMEX:172.26.40.187 (type 5, code 0) by access-group "TCS_access_in" [0x953d065b, 0x0]

需要提取2011-12-01T00:43:51.251871+05:18

我的代码

create view  standardLogTime as
extract regex /(\d{4}\-\d{2}\-\d+\w+\:\d{2}\:\d+\.\d+\+\d+\:\d+)/ on D.text as testValue
from Document D;

-- 提取标准日志生成时间。

create view  standardLogTime as
extract regex /\d{4}(-\d{2}){2}T(\d{2}:){2}\d{2}\.\d+?\+\d{2}:\d{2}/ on D.text as      testValue
from Document D;

output view standardLogTime;

-- 提取传入请求日期。

create view dateView as
extract regex /(\s+\w+\s\d+\s\d{4})/ on Date.text as testDate from Document Date;

--输出视图日期视图；

-- 提取传入请求时间。

create view timeView as
extract regex /\s+(\d{1,2}\:\d{1,2}\:\d{1,2})/ on Time.text
as requestTime from Document Time;

--输出视图时间视图；

-- 提取防火墙设备名称。

 create view deviceName as
 extract regex /(\w+\-\w+\-\w+\-\w+\-\d+\-\d+)/ on Device.text
 as deviceName from Document Device;

--输出查看设备名称；

create view combinedView as
extract pattern (<S.testValue>) (<D.testDate>) (<T.requestTime>) (<Div.deviceName>)
return group 0 as logTime and
   group 1 as date and
   group 2 as time and
  group 3 as deviceName 
from standardLogTime S,dateView D ,timeView T,deviceName Div; 

 output view combinedView;*/
4

2 回答 2

0

我不知道那是什么语言，但在 Python 中我会这样做

date = line.split()[0]

或者，如果我被迫使用 RE，那就是

^(\S+)\s
于 2012-07-30T11:31:17.633 回答
0

\d{4}(-\d{2}){2}T(\d{2}:){2}\d{2}\.\d+?\+\d{2}:\d{2}

于 2012-07-30T11:34:44.480 回答