-
Notifications
You must be signed in to change notification settings - Fork 1
/
log.go
123 lines (104 loc) · 2.57 KB
/
log.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
package logalizer
import (
"bufio"
"errors"
"fmt"
"log"
"net"
"os"
"regexp"
"strconv"
"strings"
"github.com/oschwald/geoip2-golang"
)
// ReadFile ... Read access.log file to preapre for analysis
func ReadFile(fileName string) []string {
readFile, err := os.Open(fileName)
if err != nil {
log.Fatalf("failed to open file: %s", err)
}
fileScanner := bufio.NewScanner(readFile)
fileScanner.Split(bufio.ScanLines)
var fileTextLines []string
for fileScanner.Scan() {
fileTextLines = append(fileTextLines, fileScanner.Text())
}
readFile.Close()
return fileTextLines
}
func findMatch(log []string, exp *regexp.Regexp) []string {
var matches []string
for _, e := range log {
ips := exp.FindAllString(e, -1)
for _, element := range ips {
matches = append(matches, element)
}
}
return matches
}
// find matches for a certain field in access log
func ParseLog(field string, log []string) []string {
var fieldRegex *regexp.Regexp
switch field {
case "ip":
fieldRegex = regexp.MustCompile(`^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}`)
case "date":
fieldRegex = regexp.MustCompile(`\[\s*(\d+/\D+/.*?)\]`)
case "method":
fieldRegex = regexp.MustCompile(`^GET|POST|UPDATE|HEAD|DELETE`)
case "response":
fieldRegex = regexp.MustCompile(`\d+ (\d+)`)
case "size":
fieldRegex = regexp.MustCompile(`([0-9]{1,3}) \"`)
case "referrer":
fieldRegex = regexp.MustCompile(`"([^"]*)" \"`)
case "agent":
fieldRegex = regexp.MustCompile(`" "([^"]*)"`)
case "request":
fieldRegex = regexp.MustCompile(`(GET|POST|UPDATE|HEAD|DELETE) \/.*?\.[\w:]+`)
default:
err := errors.New("field not supported!")
fmt.Printf("%v \n", err)
os.Exit(1)
}
return findMatch(log, fieldRegex)
}
// Parse a custom field from the user
func ParseCustom(regexString string, log []string) []string {
fieldRegex := regexp.MustCompile(regexString)
return findMatch(log, fieldRegex)
}
// TopOccurr ... top occurrence
func TopOccurr(field []string) map[string]int {
var d = map[string]int{}
for _, item := range field {
d[item]++
}
return d
}
// TotalBandwidth ... calculate total bandwidt
func TotalBandwidth(slice []string) int {
nums := slice
sum := 0
for _, num := range nums {
x := strings.Trim(num, "\"")
x = strings.TrimSpace(x)
i1, _ := strconv.Atoi(x)
sum += i1
}
return sum
}
// IP2Geo translate ip to Country name
func IP2Geo(IP string) string {
db, err := geoip2.Open("db/GeoLite2-Country.mmdb")
if err != nil {
log.Fatal(err)
}
defer db.Close()
ip := net.ParseIP(IP)
record, err := db.Country(ip)
if err != nil {
log.Fatal(err)
}
return record.Country.Names["en"]
}