WordPress 默认日志格式
原始日志样例:
- [backcolor=transparent]172.64[backcolor=transparent].[backcolor=transparent]0.2[backcolor=transparent] [backcolor=transparent]-[backcolor=transparent] [backcolor=transparent]-[backcolor=transparent] [backcolor=transparent][[backcolor=transparent]07[backcolor=transparent]/[backcolor=transparent]Jan[backcolor=transparent]/[backcolor=transparent]2016[backcolor=transparent]:[backcolor=transparent]21[backcolor=transparent]:[backcolor=transparent]06[backcolor=transparent]:[backcolor=transparent]39[backcolor=transparent] [backcolor=transparent]+[backcolor=transparent]0800[backcolor=transparent]][backcolor=transparent] [backcolor=transparent]"GET /wp-admin/js/password-strength-meter.min.js?ver=4.4 HTTP/1.0"[backcolor=transparent] [backcolor=transparent]200[backcolor=transparent] [backcolor=transparent]776[backcolor=transparent] [backcolor=transparent]"http://wordpress.c4a1a0aecdb1943169555231dcc4adfb7.cn-hangzhou.alicontainer.com/wp-admin/install.php"[backcolor=transparent] [backcolor=transparent]"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36"
多行日志起始匹配(使用 IP 信息表示一行开头):
- [backcolor=transparent]\d[backcolor=transparent]+[backcolor=transparent]\.\d[backcolor=transparent]+[backcolor=transparent]\.\d[backcolor=transparent]+[backcolor=transparent]\.\d[backcolor=transparent]+[backcolor=transparent]\s[backcolor=transparent]-[backcolor=transparent]\s[backcolor=transparent].*
提取日志信息的正则表达式:
- [backcolor=transparent]([backcolor=transparent]\S[backcolor=transparent]+)[backcolor=transparent] [backcolor=transparent]-[backcolor=transparent] [backcolor=transparent]-[backcolor=transparent] \[[backcolor=transparent]([^[backcolor=transparent]\][backcolor=transparent]]*)][backcolor=transparent] [backcolor=transparent]"(\S+) ([^"[backcolor=transparent]]+)[backcolor=transparent]" (\S+) (\S+) "[backcolor=transparent]([^[backcolor=transparent]"]+)"[backcolor=transparent] [backcolor=transparent]"([^"[backcolor=transparent]]+)[backcolor=transparent]"
时间转换格式:
- [backcolor=transparent]%[backcolor=transparent]d[backcolor=transparent]/%[backcolor=transparent]b[backcolor=transparent]/%[backcolor=transparent]Y[backcolor=transparent]:%[backcolor=transparent]H[backcolor=transparent]:%[backcolor=transparent]M[backcolor=transparent]:%[backcolor=transparent]S
样例日志提取结果: