# Parsing an apache access log line

**URL:** <https://www.ruby-forum.com/t/parsing-an-apache-access-log-line/109528>\
**Category:** Ruby\
**Created:** [July 16, 2007, 1:59pm UTC](https://www.ruby-forum.com/t/parsing-an-apache-access-log-line/109528 "2007-07-16T13:59:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![joenova](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/c37758/32.png) [@joenova](https://www.ruby-forum.com/u/joenova)\
**Post date:** [July 16, 2007, 1:59pm UTC](https://www.ruby-forum.com/t/parsing-an-apache-access-log-line/109528/1 "2007-07-16T13:59:11Z")

</div>

a have a line to parse…

10.88.90.75 - - [16/Jul/2007:07:46:09 -0400] “GET /star/images/main.gif  
HTTP/1.1” 200 334

anyone has a better idea… got stuck coming up with one simple regex (  
the double quote…) Need to tokenize the line,

token 1 = 10.88.90.75  
token 2 = -  
token 3 = -  
token 4 = [16/Jul/2007:07:46:09 -0400]  
token 5 = “GET /star/images/main.gif HTTP/1.1”  
token 6 = 200  
token 7 = 234

can some one help please.

Joe.

---

<div class="post-metadata">

**Author:** ![joenova](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/c37758/32.png) [@joenova](https://www.ruby-forum.com/u/joenova)\
**Post date:** [July 16, 2007, 2:11pm UTC](https://www.ruby-forum.com/t/parsing-an-apache-access-log-line/109528/2 "2007-07-16T14:11:02Z")

</div>

2007/7/16, Joe N. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> token 2 = -  
> token 3 = -  
> token 4 = [16/Jul/2007:07:46:09 -0400]  
> token 5 = “GET /star/images/main.gif HTTP/1.1”  
> token 6 = 200  
> token 7 = 234
> 
> can some one help please.

Try this as a starting point:

line.scan %r{  
\S+  
| [[^]]_]  
| “[^”]_"  
}x

(untested)

Kind regards

robert

---

<div class="post-metadata">

**Author:** ![joenova](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/c37758/32.png) [@joenova](https://www.ruby-forum.com/u/joenova)\
**Post date:** [July 16, 2007, 2:13pm UTC](https://www.ruby-forum.com/t/parsing-an-apache-access-log-line/109528/3 "2007-07-16T14:13:03Z")

</div>

hi joe!

Joe N. [2007-07-16 13:59]:

> a have a line to parse…
> 
> 10.88.90.75 - - [16/Jul/2007:07:46:09 -0400] “GET /star/images/main.gif  
> HTTP/1.1” 200 334  
> maybe you want to have a look at log\_parser:  
> [http://topfunky.net/svn/plugins/mint/lib/log\_parser.rb](http://topfunky.net/svn/plugins/mint/lib/log_parser.rb)

cheers  
jens

---

<div class="post-metadata">

**Author:** ![joenova](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/c37758/32.png) [@joenova](https://www.ruby-forum.com/u/joenova)\
**Post date:** [July 16, 2007, 2:54pm UTC](https://www.ruby-forum.com/t/parsing-an-apache-access-log-line/109528/4 "2007-07-16T14:54:17Z")

</div>

2007/7/16, Robert K. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> > token 1 = 10.88.90.75  
> > Try this as a starting point:
> 
> line.scan %r{  
> \S+  
> | [[^]]_]  
> | “[^”]_"  
> }x
> 
> (untested)

I think I got the order wrong. Rather do

line.scan %r{  
[[^]]_]  
| “[^”]_"  
| \S+  
}x

Or do an explicit parse like the one Aur suggested.

Kind regards

robert

---

<div class="post-metadata">

**Author:** ![joenova](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/c37758/32.png) [@joenova](https://www.ruby-forum.com/u/joenova)\
**Post date:** [July 16, 2007, 2:16pm UTC](https://www.ruby-forum.com/t/parsing-an-apache-access-log-line/109528/5 "2007-07-16T14:16:05Z")

</div>

/([0-9.]_) (-) (-) ([._]) ("._") ([0-9]_) ([0-9]\*)/ comes to mind,  
although I’m probably wrong with the backslashes - some of the things  
I escaped probably aren’t significant characters and some other ones  
probably are.

Could you provide a test suite with more lines?

Hey, wouldn’t /(?^| )[^\S]_|"._")(?| )/, work to find each of the  
tokens (that is, iterate it to find ALL matches)?

Aur

---

<div class="post-metadata">

**Author:** ![joenova](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/c37758/32.png) [@joenova](https://www.ruby-forum.com/u/joenova)\
**Post date:** [July 16, 2007, 5:00pm UTC](https://www.ruby-forum.com/t/parsing-an-apache-access-log-line/109528/6 "2007-07-16T17:00:31Z")

</div>

Joe N. schrieb:

> token 2 = -

line = “10.88.90.75 - - [16/Jul/2007:07:46:09 -0400] “GET  
star/images/main.gif HTTP/1.1” 200 334”  
token =  
/^(._?)\s+(._?)\s+(._?)\s+([._?])\s+(".\*?")\s+(\d+)\s+(\d+)$/.match(line)

=\> token[1] = 10.88.90.75  
token[2] = -  
token[3] = -  
etc.

BR Phil