使用字典清理域名的Python正则表达式替换

Question

对于输出，需要将括号中包含的数字替换为句点“.”。同时移除域开头和结尾的括号

我们可以用re.sub来做这个吗？如果可以，怎么做

代码

import re

log = ["4/19/2020 11:59:09 PM 2604 PACKET  0000014DE1921330 UDP Rcv 192.168.1.28   f975   Q [0001   D   NOERROR] A      (7)pagead2(17)googlesyndication(3)com(0)",
       "4/19/2020 11:59:09 PM 0574 PACKET  0000014DE18C4720 UDP R cv 192.168.2.54    9c63   Q [0001   D   NOERROR] A      (2)pg(3)cdn(5)viber(3)com(0)"]

rx_dict = { 'query': re.compile(r'(?P<query>[\S]*)$') }

for item in log:
    for key, r_exp in rx_dict.items():
        print(f"{r_exp.search(item).group(1)}")

输出

(7)pagead2(17)googlesyndication(3)com(0)
(2)pg(3)cdn(5)viber(3)com(0)

首选输出

pagead2.googlesyndication.com
pg.cdn.viber.com

Answer 1

是的，您可以使用re.sub。我假设你有这本字典，所以你可以从日志中提取多个片段。您可以为dispatch执行类似的操作：

ops = {
    "query": lambda e: (
         re.sub(r"\(\d+\(", ".", (
             re.search(r"(?P<query>[\S]*)$", e).group(1),
         )
     ),
     ...
}

然后将这些函数应用于所有日志实体

log_results = {op_name: op(l) for op_name, op in ops.items() for l in log}

Answer 2

实用python用法：

log = ["4/19/2020 11:59:09 PM 2604 PACKET  0000014DE1921330 UDP Rcv 192.168.1.28   f975   Q [0001   D   NOERROR] A      (7)pagead2(17)googlesyndication(3)com(0)",
       "4/19/2020 11:59:09 PM 0574 PACKET  0000014DE18C4720 UDP R cv 192.168.2.54    9c63   Q [0001   D   NOERROR] A      (2)pg(3)cdn(5)viber(3)com(0)"]

import re

urls = [re.sub(r'\(\d+\)','.',t.split()[-1]).strip('.') for t in log]

print (urls)

输出：

['pagead2.googlesyndication.com', 'pg.cdn.viber.com']

---

通过规则优化字典：

如果要通过字典应用连续规则，请一直执行lambda：

import re 

rules = {"r0": lambda x: x.split()[-1],
         "r1": lambda x: re.sub(r'\(\d+\)','.',x),
         "r2": lambda x: x.strip(".")}

result = []
for value in log:  
    result.append(value)
    for r in rules:
        result[-1] = rules[r](result[-1])

print(result)

输出：

['pagead2.googlesyndication.com', 'pg.cdn.viber.com']