How to parse Apache logs using a regex in PHP

Question

I'm trying to split this string in PHP:

11.11.11.11 - - [25/Jan/2000:14:00:01 +0100] "GET /1986.js HTTP/1.1" 200 932 "http://domain.com/index.html" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 GTB6"

How can split this into IP, date, HTTP method, domain-name and browser?

This is a worse version of this question, which goes into full parsing: stackoverflow.com/questions/7603017/… — ftrotter
– ftrotter, Commented Sep 2, 2014 at 18:54

The Surrican · Accepted Answer · 2012-01-02 16:16:49Z

14

This log format seems to be the Apache’s combined log format. Try this regular expression:

/^(\S+) \S+ \S+ \[([^\]]+)\] "([A-Z]+)[^"]*" \d+ \d+ "[^"]*" "([^"]*)"$/m

The matching groups are as follows:

remote IP address
request date
request HTTP method
User-Agent value

But the domain is not listed there. The second quoted string is the Referer value.

edited Jan 2, 2012 at 16:16

The Surrican

30k24 gold badges127 silver badges168 bronze badges

answered Feb 8, 2010 at 13:03

Gumbo

657k112 gold badges792 silver badges852 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Gumbo Over a year ago

@streetparade: Use preg_match_all and you get all matches: preg_match_all('…', $str, $matches)

The Surrican Over a year ago

well this regex doesnt compile... theres a round bracket missing ;)

Julien Palard Over a year ago

This one is wrong, the auth-user field (3rd one, %u) can contain spaces.

Gumbo Over a year ago

@JulienPalard Would you mind providing an update proposal?

Julien Palard Over a year ago

@Gumbo Here: stackoverflow.com/questions/7603017/…

|

KARASZI István · Accepted Answer · 2010-02-08 13:00:07Z

4

You should check out a regular expression tutorial. But here is the answer:

if (preg_match('/^(\S+) \S+ \S+ \[(.*?)\] "(\S+).*?" \d+ \d+ "(.*?)" "(.*?)"/', $line, $m)) {
  $ip = $m[1];
  $date = $m[2];
  $method = $m[3];
  $referer = $m[4];
  $browser = $m[5];
}

Take care, it's not the domain name in the log but the HTTP referer.

answered Feb 8, 2010 at 13:00

KARASZI István

31.5k9 gold badges107 silver badges133 bronze badges

Comments

Daniel S. Sterling · Accepted Answer · 2011-08-10 14:45:52Z

Here is some Perl, not PHP, but the regex to use is the same. This regex works to parse everything I've seen; clients can send some bizarre requests:

my ($ip, $date, $method, $url, $protocol, $alt_url, $code, $bytes,
        $referrer, $ua) = (m/
    ^(\S+)\s                    # IP
    \S+\s+                      # remote logname
    (?:\S+\s+)+                 # remote user
    \[([^]]+)\]\s               # date
    "(\S*)\s?                   # method
    (?:((?:[^"]*(?:\\")?)*)\s   # URL
    ([^"]*)"\s|                 # protocol
    ((?:[^"]*(?:\\")?)*)"\s)    # or, possibly URL with no protocol
    (\S+)\s                     # status code
    (\S+)\s                     # bytes
    "((?:[^"]*(?:\\")?)*)"\s    # referrer
    "(.*)"$                     # user agent
/x);
die "Couldn't match $_" unless $ip;
$alt_url ||= '';
$url ||= $alt_url;

recurse · Accepted Answer · 2015-08-31 21:10:27Z

2

// # Parses the NCSA Combined Log Format lines:
$pattern = '/^([^ ]+) ([^ ]+) ([^ ]+) (\[[^\]]+\]) "(.*) (.*) (.*)" ([0-9\-]+) ([0-9\-]+) "(.*)" "(.*)"$/';

Usage:

if (preg_match($pattern,$yourstuff,$matches)) {

    //# puts each part of the match in a named variable

    list($whole_match, $remote_host, $logname, $user, $date_time, $method, $request, $protocol, $status, $bytes, $referer, $user_agent) = $matches;

}

answered Aug 31, 2015 at 21:10

recurse

6346 silver badges15 bronze badges

Collectives™ on Stack Overflow

How to parse Apache logs using a regex in PHP

4 Answers 4

6 Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

6 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related