使用python mapredu识别错误警报

Question

有人能帮我解决以下问题吗。我正在尝试分析安全日志以查找错误警报。假警报是那些包含“TXT未创建”的警报，真警报是那些包含“TXT未创建”的警报。如何从数据源（下面给出的示例输入数据）中提取特定的“txt未创建”

from mrjob.job import MRJob

class MRWordFrequencyCount(MRJob):

def mapper(self, _, line):
    words = line.split()
    for word in words:
        word = unicode(word, "utf-8", errors="ignore") 
        yield word, 1

def reducer(self, key, values):
    yield key, sum(values)

if __name__ == '__main__':
    MRWordFrequencyCount.run()

这里给出了一个输入示例：

Mon Feb  1 12:13:59 EST 2016 virtual user etransactiondev started to upload file 
/export/home/pub/etransactiondev/uploads/etransactionenvironment/ABC/rrd/in/WCWT.SMR.XYZ0002.PLSE.INPUT01.LFEP_APOL_D_M_20160201171358.TXT
/export/home/pub/etransactiondev/uploads/etransactionenvironment/ABC/rrd/in/WCWT.SMR.XYZ0002.PLSE.INPUT01.LFEP_APOL_D_M_20160201171358.txt was not created

Answer 1

你能检查一下第一个单词吗

word = word.split(' ')
if word[0] == 'TXT':
    do something...