@Test
public void trimPackage() {
// 正则:去掉中括号前后的双引号
String fieldSeparator = ";";
String kvSeparator = "=";
String key = null;
String value = null;
String valueBoundaryChar = "\"";
Map<String, Object> kvMap = new HashMap();
StringBuilder builder = new StringBuilder();
String str = "aa=155;Content=[HTTP_SQL_注入攻击(1&1)]red_begin URL::1=1%20or%202=2 red_end ;dep3art=15215=8564;departmentName=研发部门;";
for (int i = 0; i < str.length(); i++) {
char c = str.charAt(i);
String nextStr = str.substring(i + 1);
int nextKvIndex = nextStr.indexOf(kvSeparator);
int nextFieldIndex = nextStr.indexOf(fieldSeparator);
boolean addValue = nextKvIndex < nextFieldIndex || StringUtils.isBlank(nextStr);
if (String.valueOf(c).equals(kvSeparator) && key == null) {
key = builder.toString();
builder.setLength(0);
continue;
}
if (String.valueOf(c).equals(fieldSeparator) && value == null && addValue) {
value = builder.toString();
builder.setLength(0);
if (StringUtils.isNotBlank(key)) {
kvMap.put(key, value);
key = null;
value = null;
}
continue;
}
builder.append(c);
}
System.out.println(JSON.toJSONString(kvMap));
}
第二种方式
import com.alibaba.fastjson.JSON;
import org.apache.commons.lang3.ArrayUtils;
import org.apache.commons.lang3.StringUtils;
import java.util.ArrayList;
import java.util.List;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
/**
* @Author xlj
* @Date 2018/8/14 9:40
*/
public class Test {
public static void main(String[] args) {
String str = "<665>Sep 6 16:39:45 host DCS_WAF:" +
" SerialNum=\"0003211412129999001\"" +
" GenTime=\"2017-09-06 16:39:45\"" +
" Module=\"SQL注入攻击防护\"" +
" SIP=\"192.168.101.70\"" +
" DIP=\"125.39.174.166\"" +
" SPORT=\"57613\"" +
" DPORT=\"80\"" +
" IN=\"eth4\"" +
" OUT=\"eth5\"" +
" Action=\"pass\"" +
" URL=\"web.chacuo.net/formatxml?1=1%20or%202=2\"" +
" Content=\"[HTTP_SQL_注入攻击(1&1)]red_begin URL::1=1%20or%202=2 red_end ;HOST=web.chacuo.net;URL=/formatxml?1=1%20or%202=2;REF=;\"" +
" Log_Count=\"1\"" +
" Sec_Level=\"40\"" +
" Sec_Type=\"SQL注入攻击\"" +
" Log_Level=\"1\"" +
" HOST=\"web.chacuo.net\"" +
" BNAT=\"\"";
Pattern pattern = Pattern.compile("\\S+\\s+\\S+\\s+\\S+\\s+\\S+\\s+\\S+\\s+(?<message>.*)");
Matcher matcher = pattern.matcher(str);
char kvSparatorChar = '=';
char fieldSeparatorChar = ' ';
char quotation = '"';
while (matcher.find()) {
String group = matcher.group("message");
String[] kvStr = splitWorker(group, fieldSeparatorChar, kvSparatorChar);
}
}
private static String[] splitWorker(final String str, final char fieldSeparatorChar, final char kvSparatorChar) {
if (str == null) {
return null;
}
final int len = str.length();
if (len == 0) {
return ArrayUtils.EMPTY_STRING_ARRAY;
}
final List<String> list = new ArrayList<>();
int i = 0, start = 0;
boolean match = false;
boolean lastMatch = false;
while (i < len) {
if (str.charAt(i) == fieldSeparatorChar) {
if (match) {
int fieldSeparatorIndex = str.indexOf(fieldSeparatorChar, i + 1);
int kvSeparatorIndex = str.indexOf(kvSparatorChar, i + 1);
char c = str.charAt(i + 1);
if (fieldSeparatorIndex < kvSeparatorIndex) {
++i;
continue;
}
list.add(str.substring(start, i));
System.out.println(str.substring(start, i));
match = false;
lastMatch = true;
}
start = ++i;
continue;
}
lastMatch = false;
match = true;
i++;
}
if (match || lastMatch) {
list.add(str.substring(start, i));
}
return list.toArray(new String[list.size()]);
}
}