2023年5月28日 14:48:20go评论54阅读模式

英文:

Lookahead captures unwanted characterrs

问题

我正在尝试捕获来自防火墙的警报名称。每个日志都具有以下格式：

datetime alertname severity_level username endpoint_name domain

我目前正在使用的正则表达式对所有日志都有效，除了第三个。有任何修复它的想法吗？

regex = []

text = """2023-05-27 / 23:06:31 Computer account added/changed/deleted. medium ANONYMOUS LOGON PC-CR5$ SRVDC2 ACME 1
2023-05-27 / 23:28:08 Computer account added/changed/deleted. medium ANONYMOUS LOGON SRVXAP02$ SRVDC2 ACME 1
2023-05-28 / 02:24:29 User account locked out multiple login errors high SRVDC2$ john.smith.admin SRVDC2 \\NECBROWSER 1
2023-05-28 / 05:01:48 Computer account added/changed/deleted. medium ANONYMOUS LOGON SRVNPS01$ SRVDC1 ACME 1
2023-05-28 / 06:38:57 Computer account added/changed/deleted. medium ANONYMOUS LOGON VD-OPERATOR1$ SRVDC1 ACME 1"""

pattern = '(?:(?<=\d{2}:\d{2}:\d{2}))(.*)(?=.)|(?=medium )|(?=high )|(?=low )|(?=critical )'
regex.append(re.findall(pattern,text,re.MULTILINE))
print(regex)

当前输出

[[' Computer account added/changed/deleted', '', ' Computer account added/changed/deleted', '', ' User account locked out multiple login errors high SRVDC2$ john.smith', ' Computer account added/changed/deleted', '', ' Computer account added/changed/deleted']]

预期输出

[[' Computer account added/changed/deleted', '', ' Computer account added/changed/deleted', '', ' User account locked out multiple login errors', ' Computer account added/changed/deleted', '', ' Computer account added/changed/deleted']]

英文:

I'm trying to capture alert names that come from the firewall. Each log has the following format:

datetime alertname severity_level username endpoint_name domain

The current RegEx I'm using works for all logs except for the third one. Any ideas on how to fix it?

regex = []

text = &quot;&quot;&quot;2023-05-27 / 23:06:31 Computer account added/changed/deleted. medium ANONYMOUS LOGON PC-CR5$ SRVDC2 ACME 1
2023-05-27 / 23:28:08 Computer account added/changed/deleted. medium ANONYMOUS LOGON SRVXAP02$ SRVDC2 ACME 1
2023-05-28 / 02:24:29 User account locked out multiple login errors high SRVDC2$ john.smith.admin SRVDC2 \\\\NECBROWSER 1
2023-05-28 / 05:01:48 Computer account added/changed/deleted. medium ANONYMOUS LOGON SRVNPS01$ SRVDC1 ACME 1
2023-05-28 / 06:38:57 Computer account added/changed/deleted. medium ANONYMOUS LOGON VD-OPERATOR1$ SRVDC1 ACME 1&quot;&quot;&quot;

pattern = &#39;(?:(?&lt;=\d{2}:\d{2}:\d{2}))(.*)(?=\.)|(?=medium )|(?=high )|(?=low )|(?=critical )&#39;
regex.append(re.findall(pattern,text,re.MULTILINE))
print(regex)

Current Output

[[&#39; Computer account added/changed/deleted&#39;, &#39;&#39;, &#39; Computer account added/changed/deleted&#39;, &#39;&#39;, &#39; User account locked out multiple login errors high SRVDC2$ john.smith&#39;, &#39; Computer account added/changed/deleted&#39;, &#39;&#39;, &#39; Computer account added/changed/deleted&#39;, &#39;&#39;]]

Expected Output

[[&#39; Computer account added/changed/deleted&#39;, &#39;&#39;, &#39; Computer account added/changed/deleted&#39;, &#39;&#39;, &#39; User account locked out multiple login errors&#39;, &#39; Computer account added/changed/deleted&#39;, &#39;&#39;, &#39; Computer account added/changed/deleted&#39;, &#39;&#39;]]

答案1

得分: 3

你可以使用

\d{2}:\d{2}:\d{2}\s+
(.*?)
\s(?:medium|high|low|critical)

在你的原始尝试相反，这个使用了一个非捕获组（回溯是“昂贵的”！）和之后的一个懒惰量词构造。只使用第一个捕获组。

在 Python 中可以这样做

import re

text = &quot;&quot;&quot;2023-05-27 / 23:06:31 Computer account added/changed/deleted. medium ANONYMOUS LOGON PC-CR5$ SRVDC2 ACME 1
2023-05-27 / 23:28:08 Computer account added/changed/deleted. medium ANONYMOUS LOGON SRVXAP02$ SRVDC2 ACME 1
2023-05-28 / 02:24:29 User account locked out multiple login errors high SRVDC2$ john.smith.admin SRVDC2 \\\\NECBROWSER 1
2023-05-28 / 05:01:48 Computer account added/changed/deleted. medium ANONYMOUS LOGON SRVNPS01$ SRVDC1 ACME 1
2023-05-28 / 06:38:57 Computer account added/changed/deleted. medium ANONYMOUS LOGON VD-OPERATOR1$ SRVDC1 ACME 1&quot;&quot;&quot;

pattern = re.compile(r&#39;&#39;&#39;
    \d{2}:\d{2}:\d{2}\s+
    (.*?)
    \s(?:medium|high|low|critical)

&#39;&#39;&#39;, re.VERBOSE)

messages = [match.group(1) for match in pattern.finditer(text)]
print(messages)

会产生

[&#39;Computer account added/changed/deleted.&#39;, &#39;Computer account added/changed/deleted.&#39;, &#39;User account locked out multiple login errors&#39;, &#39;Computer account added/changed/deleted.&#39;, &#39;Computer account added/changed/deleted.&#39;]

英文:

You could use

\d{2}:\d{2}:\d{2}\s+
(.*?)
\s(?:medium|high|low|critical)

See a demo on regex101.com.

In contrast to your original attempt, this one uses a non-capturing group (lookbehinds are "expensive"!) and a lazy quantifier construct afterwards. Just use the first capturing group.

In Python this could be

import re

text = &quot;&quot;&quot;2023-05-27 / 23:06:31 Computer account added/changed/deleted. medium ANONYMOUS LOGON PC-CR5$ SRVDC2 ACME 1
2023-05-27 / 23:28:08 Computer account added/changed/deleted. medium ANONYMOUS LOGON SRVXAP02$ SRVDC2 ACME 1
2023-05-28 / 02:24:29 User account locked out multiple login errors high SRVDC2$ john.smith.admin SRVDC2 \\\\NECBROWSER 1
2023-05-28 / 05:01:48 Computer account added/changed/deleted. medium ANONYMOUS LOGON SRVNPS01$ SRVDC1 ACME 1
2023-05-28 / 06:38:57 Computer account added/changed/deleted. medium ANONYMOUS LOGON VD-OPERATOR1$ SRVDC1 ACME 1&quot;&quot;&quot;

pattern = re.compile(r&#39;&#39;&#39;
    \d{2}:\d{2}:\d{2}\s+
    (.*?)
    \s(?:medium|high|low|critical)

&#39;&#39;&#39;, re.VERBOSE)

messages = [match.group(1) for match in pattern.finditer(text)]
print(messages)

And would yield

[&#39;Computer account added/changed/deleted.&#39;, &#39;Computer account added/changed/deleted.&#39;, &#39;User account locked out multiple login errors&#39;, &#39;Computer account added/changed/deleted.&#39;, &#39;Computer account added/changed/deleted.&#39;]

See a demo on ideone.com.

通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。

Lookahead捕获到不需要的字符。

问题

答案1

在NumPy数组中进行向量化加法。

连接到Gmail使用电子邮件地址和密码与Python

嵌套字典循环与def（缩进问题）

Why is my boolean variable not updating when changed within functions in my tkinter custom scrollbar widget?

What's the correct way to type hint an empty list as a literal in python?

如何在Highcharts Gantt中更改本地化的星期名称

如何在同一个流中使用多个过滤器和映射函数？

如何使用Map/Set来将代码优化到O(n)？

.NET MAUI Android在GitHub Actions上构建失败，错误代码为1。

如何在Playwright视觉比较中屏蔽多个定位器？

在C++中，可以使用可变模板参数来检索类型的内部类型。

selenium.common.exceptions.StaleElementReferenceException: Message: stale element reference: stale element not found

Creating and opening a URL to log in to Website via Basic Auth with Robot Framework/Selenium (Python)

AG Grid 在上下文菜单中以大文本形式打开

发表评论