Click here to Skip to main content
15,887,746 members
Please Sign up or sign in to vote.
1.00/5 (4 votes)
See more:
Below shows the log file that I want parse in Java. As seen, the last column is abit different from the others. So how do I separate them into the correct column where eth1 inzone: External; outzone: Local; rule: 3; will be in the same column as eth1 rule: 7; ?

I have used the commands
Java
String delims = "[;]";
String[] tokens = log.split(delims);


But however, it will split eth1 inzone: External; outzone: Local; rule: 3; into different columns since there's ';' in it. I can't really edit it before running the commands as this log file has 20000 rows.
Jan 1 22:54:17 drop   %LOGSOURCE% eth1 rule: 7; rule_uid: {C1336766-9489-4049-9817-50584D83A245}; src: 70.77.116.190; dst: %DSTIP%; proto: tcp; product: VPN-1 & FireWall-1; service: 445; s_port: 2612;
Jan 1 22:54:22 drop   %LOGSOURCE% eth1 rule: 7; rule_uid: {C1336766-9489-4049-9817-50584D83A245}; src: 61.164.41.144; dst: %DSTIP%; proto: udp; product: VPN-1 & FireWall-1; service: 5060; s_port: 5069;
Jan 1 22:54:23 drop   %LOGSOURCE% eth1 rule: 7; rule_uid: {C1336766-9489-4049-9817-50584D83A245}; src: 69.55.245.136; dst: %DSTIP%; proto: tcp; product: VPN-1 & FireWall-1; service: 445; s_port: 2970;
Jan 1 22:54:41 drop   %LOGSOURCE% eth1 rule: 7; rule_uid: {C1336766-9489-4049-9817-50584D83A245}; src: 95.104.65.30; dst: %DSTIP%; proto: tcp; product: VPN-1 & FireWall-1; service: 445; s_port: 2565;
Jan 1 23:02:56 accept %LOGSOURCE% eth1 inzone: External; outzone: Local; rule: 3; rule_uid: {723F81EF-75C9-4CBB-8913-0EBB3686E0F7}; service_id: icmp-proto; ICMP: Echo Request; src: 24.188.22.101; dst: %DSTIP%; proto: icmp; ICMP Type: 8; ICMP Code: 0; product: VPN-1 & FireWall-1;
Posted
Updated 20-Jul-15 21:01pm
v3
Comments
Mohibur Rashid 20-Jul-15 21:35pm    
What was your initiation? Did you try anything besides posting here?
Afzaal Ahmad Zeeshan 21-Jul-15 3:09am    
You need double splitting, first split at ; and then at :.
iambadatcoding 21-Jul-15 3:44am    
How do I use double splitting functions?
Afzaal Ahmad Zeeshan 21-Jul-15 5:25am    
There is no such thing as double splitting. You split the items at a delimiter, use it as array, iterate over and then for each element in that iteration. You split it again based on another delimiter.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900