From: Peter Vandenabeele <peter@...>
Date: 2012-01-24T03:12:33+09:00
Subject: Re: Parsing log with date time entry

--20cf3074b4125f18aa04b735f976
Content-Type: text/plain; charset=UTF-8

On Mon, Jan 23, 2012 at 6:26 PM, Christopher Graves <gravescl@gmail.com>wrote:

> hmm interesting
>
> 3 of the logs have the month as 1 instead of 01 and it does not get seen
> as in range.
>

The regexp that I proposed now:

  /^(\d{2}\/\d{2})\/(\d{4})(\s\d{1,2}\:\d{2}\:\d{2}\:\d{1,3})/

will indeed only work on a month like '01' , '12', ...
That is because the {2} required _exactly_ 2 digits.

If you also want to match '1', '5' etc. you may need to write

 /^(\d{1,2}\/\d{2})\/(\d{4})(\s\d{1,2}\:\d{2}\:\d{2}\:\d{1,3})/

But then ... for a _string_ comparison, you will need to
expand it always to a 2 character result (otherwise
the month '5' would be "higher" than the month '10';
but '05' is lower than '10').



> What are you doing here time = "#{$2}/#{$1}#{$3}"   ?
>

There are 3 groups in the regex (between the brackets) and
I am reordering them to generate the YYYY/mm/dd HH:MM:SS:MMM
format.

I think UNTESTED !! the new regexp then becomes:

/^(\d{1,2})\/\(\d{1,2})\/(\d{4})(\s\d{1,2}\:\d{2}\:\d{2}\:\d{1,3})/
  ^ GRP 1 ^   ^ GRP 2 ^  ^ GRP3^^     GROUP 4                    ^

and

time = "#{$3}/#{$1.rjust(2,'0')}/#{$2.rjust(2,'0')}#{$4}"


The GRP comments are to show you the extent of the 4 Regex groups, that
you find back then as $1, $2, $3, $4.


> In order to catch these logs I'm thinking I should drop the date
> completely from this part of the scan because the logs are generated
> daily do I can just search the date.log for the proper time.
>

That 's also a possibility :-)

Pete

--20cf3074b4125f18aa04b735f976--