nginx日誌數據提取

分析nginx日誌

$s_line = '1.202.39.44 - - [22/Mar/2016:17:12:25 +0800] "POST /auth/login HTTP/1.1" 200 261 "http://www.halfcookie.cn/auth/login" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36" "-"';
$p = '/^(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\s-\s(.*)\s\[(.*)\]\s"(.*)\"\s(\d{3})\s(\d+)\s"(.*)"\s"(.*)"\s\"(.*)\"$/u';

preg_match($p,$s_line,$a_match);
var_dump($a_match);

array(13) {
  [0] =>
  string(233) "1.202.39.44 - - [22/Mar/2016:17:12:25 +0800] "POST /auth/login HTTP/1.1" 200 261 "http://www.halfcookie.cn/auth/login" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36" "-""
  'ip' =>
  string(11) "1.202.39.44"
  [1] =>
  string(11) "1.202.39.44"
  [2] =>
  string(1) "-"
  'time' =>
  string(26) "22/Mar/2016:17:12:25 +0800"
  [3] =>
  string(26) "22/Mar/2016:17:12:25 +0800"
  [4] =>
  string(25) "POST /auth/login HTTP/1.1"
  'status' =>
  string(3) "200"
  [5] =>
  string(3) "200"
  [6] =>
  string(3) "261"
  [7] =>
  string(35) "http://www.halfcookie.cn/auth/login"
  [8] =>
  string(108) "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36"
  [9] =>
  string(1) "-"
}

$s_line = '1.202.39.44 - - [22/Mar/2016:17:12:25 +0800] "POST /auth/login HTTP/1.1" 200 261 "http://www.halfcookie.cn/auth/login" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36" "-"';
$p = '/^(?P<ip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\s-\s(.*)\s\[(?P<time>.*)\]\s"(.*)"\s(?P<status>\d{3})\s(\d+)\s\"(.*)\"\s\"(.*)"\s\"(.*)"/u';

preg_match($p,$s_line,$a_match);
var_dump($a_match);

array(13) {
  [0] =>
  string(233) "1.202.39.44 - - [22/Mar/2016:17:12:25 +0800] "POST /auth/login HTTP/1.1" 200 261 "http://www.halfcookie.cn/auth/login" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36" "-""
  'ip' =>
  string(11) "1.202.39.44"
  [1] =>
  string(11) "1.202.39.44"
  [2] =>
  string(1) "-"
  'time' =>
  string(26) "22/Mar/2016:17:12:25 +0800"
  [3] =>
  string(26) "22/Mar/2016:17:12:25 +0800"
  [4] =>
  string(25) "POST /auth/login HTTP/1.1"
  'status' =>
  string(3) "200"
  [5] =>
  string(3) "200"
  [6] =>
  string(3) "261"
  [7] =>
  string(35) "http://www.halfcookie.cn/auth/login"
  [8] =>
  string(108) "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36"
  [9] =>
  string(1) "-"
}

解析：

?P<name> :命名捕獲組

nginx配置日誌文檔。。

https://www.ttlsa.com/linux/the-nginx-log-configuration/