python- read specific words from log file

[anna]

Hi squenson,

1) Open log file (test.log)
2) Read line by line
3) match pattern for MAC and username i.e 0200400681@ttml and 5c:f4:ab:1f:3a:ec in each line
4) print and matches... i.e.
expecting below output

0200400681@ttml 5c:f4:ab:1f:3a:ec
0220367961@ttml 00:17:7c:75:b6:05

[anna]

below is the working code, however I am facing difficulty to print in desired format.
this code prints output in below format

0221470118
cc:5d:4e:72:71:a3
4010053642
e8:cc:18:60:f7:cc
0200408496
54:b8:0a:98:70:68
7911007200
74:da:da:d2:76:f7
1201005426
c4:e9:84:97:f4:cd

however how can i print this like

0221470118 cc:5d:4e:72:71:a3
4010053642 e8:cc:18:60:f7:cc
0200408496 54:b8:0a:98:70:68
7911007200 74:da:da:d2:76:f7
1201005426 c4:e9:84:97:f4:cd

#!/usr/bin/python
import re
file = open("test.txt", "r")
mac = re.compile(r'[a-fA-F0-9]{2}[:][a-fA-F0-9]{2}[:][a-fA-F0-9]{2}[:][a-fA-F0-9]{2}[:][a-fA-F0-9]{2}[:][a-fA-F0-9]{2}|\d{10}')
#dn = re.compile(r'(\d{10})')
for line in file:
    mac_address = mac.findall(line)
    for word in mac_address:
        print word

[wavic]

How does a single line look like?

[buran]

@nilamo already provided solution that works. all you need to do is to tweak it accordingly.

data = '''26 Dec 2017 00:00:00,018 [WARN] RAD-AUTH-RES-18 [AUTH_COUNT_LOGGER]: PACKET TYPE : ACCESS REQUEST, RESPONSE : ACCESS ACCEPT, REPLY MESSAGE : Authentication Success, USERNAME : 0221453122@ttml, MAC : ac:f1:df:ea:4c:26, NASIP : 10.124.117.36, NASPORTID : slot=4;subslot=2;port=1;vlanid=3727;vlanid2=1127;
26 Dec 2017 00:00:00,082 [WARN] RAD-AUTH-680 [AUTH_COUNT_LOGGER]: PACKET TYPE : ACCESS REQUEST, RESPONSE : ACCESS REJECT, REPLY MESSAGE : Account is not active, USERNAME : 0220367961@ttml, MAC : 00:17:7c:75:b6:05, NASIP : 10.124.117.36, NASPORTID : slot=5;subslot=2;port=1;vlanid=2000;vlanid2=2488;
26 Dec 2017 00:00:00,115 [WARN] RAD-AUTH-RES-18 [AUTH_COUNT_LOGGER]: PACKET TYPE : ACCESS REQUEST, RESPONSE : ACCESS ACCEPT, REPLY MESSAGE : Authentication Success, USERNAME : 4010059315, MAC : 08:60:6e:c9:dd:9a, NASIP : 10.124.113.246, NASPORTID : slot=6;subslot=2;port=100;vlanid=560;vlanid2=1284;
26 Dec 2017 00:00:00,189 [WARN] RAD-AUTH-695 [AUTH_COUNT_LOGGER]: PACKET TYPE : ACCESS REQUEST, RESPONSE : ACCESS REJECT, REPLY MESSAGE : Account is not active, USERNAME : 0200400681@ttml, MAC : 5c:f4:ab:1f:3a:ec, NASIP : 10.124.117.180, NASPORTID : pppoe lag-50:2925.3643'''
data = data.split('\n')


import csv

def parse_line(line):
    line = [item.split(' : ')[-2:] for item in line]
    return {key.split(':')[-1].strip(): value for key, value in line}


reader = csv.reader(data)
for line in reader:
    row_data = parse_line(line[1:])
    print('{USERNAME} {MAC}'.format(**row_data))

Output:
0221453122@ttml ac:f1:df:ea:4c:26
0220367961@ttml 00:17:7c:75:b6:05
4010059315 08:60:6e:c9:dd:9a
0200400681@ttml 5c:f4:ab:1f:3a:ec

parse_line() will return dict (unordered) that has all data (except for time-stamp), e.g.

Output:
{'NASPORTID': 'pppoe lag-50:2925.3643', 'REPLY MESSAGE': 'Account is not active', 'RESPONSE': 'ACCESS REJECT', 'MAC': '5c:f4:ab:1f:3a:ec', 'USERNAME': '0200400681@ttml', 'NASIP': '10.124.117.180', 'PACKET TYPE': 'ACCESS REQUEST'}

I will leave to you to make it work with your file.
Using RegEx is also possible, but let's keep it simple

[anna]

sample two lines
bold highlighted need to print

26 Dec 2017 00:00:00,018 [WARN] RAD-AUTH-RES-18 [AUTH_COUNT_LOGGER]: PACKET TYPE : ACCESS REQUEST, RESPONSE : ACCESS ACCEPT, REPLY MESSAGE : Authentication Success, USERNAME : 0221453122@ttml, MAC : ac:f1:df:ea:4c:26, NASIP : 10.124.117.36, NASPORTID : slot=4;subslot=2;port=1;vlanid=3727;vlanid2=1127;
26 Dec 2017 00:00:00,082 [WARN] RAD-AUTH-680 [AUTH_COUNT_LOGGER]: PACKET TYPE : ACCESS REQUEST, RESPONSE : ACCESS REJECT, REPLY MESSAGE : Account is not active, USERNAME : 0220367961@ttml, MAC : 00:17:7c:75:b6:05, NASIP : 10.124.117.36, NASPORTID : slot=5;subslot=2;port=1;vlanid=2000;vlanid2=2488;

[wavic]

Perhaps mac_address contains a tuple like ('0221470118', 'cc:5d:4e:72:71:a3')?

for line in file:
    mac_address = mac.findall(line)
    if mac_address
        print "%s %s" % (mac_address[0], mac_address[1])

:D I had some troubles with the print statement. Python 2... Brrrrr

[buran]

you can construct better regex and also use named groups

data = '''26 Dec 2017 00:00:00,018 [WARN] RAD-AUTH-RES-18 [AUTH_COUNT_LOGGER]: PACKET TYPE : ACCESS REQUEST, RESPONSE : ACCESS ACCEPT, REPLY MESSAGE : Authentication Success, USERNAME : 0221453122@ttml, MAC : ac:f1:df:ea:4c:26, NASIP : 10.124.117.36, NASPORTID : slot=4;subslot=2;port=1;vlanid=3727;vlanid2=1127;
26 Dec 2017 00:00:00,082 [WARN] RAD-AUTH-680 [AUTH_COUNT_LOGGER]: PACKET TYPE : ACCESS REQUEST, RESPONSE : ACCESS REJECT, REPLY MESSAGE : Account is not active, USERNAME : 0220367961@ttml, MAC : 00:17:7c:75:b6:05, NASIP : 10.124.117.36, NASPORTID : slot=5;subslot=2;port=1;vlanid=2000;vlanid2=2488;
26 Dec 2017 00:00:00,115 [WARN] RAD-AUTH-RES-18 [AUTH_COUNT_LOGGER]: PACKET TYPE : ACCESS REQUEST, RESPONSE : ACCESS ACCEPT, REPLY MESSAGE : Authentication Success, USERNAME : 4010059315, MAC : 08:60:6e:c9:dd:9a, NASIP : 10.124.113.246, NASPORTID : slot=6;subslot=2;port=100;vlanid=560;vlanid2=1284;
26 Dec 2017 00:00:00,189 [WARN] RAD-AUTH-695 [AUTH_COUNT_LOGGER]: PACKET TYPE : ACCESS REQUEST, RESPONSE : ACCESS REJECT, REPLY MESSAGE : Account is not active, USERNAME : 0200400681@ttml, MAC : 5c:f4:ab:1f:3a:ec, NASIP : 10.124.117.180, NASPORTID : pppoe lag-50:2925.3643'''



import re

regex = r"USERNAME : (?P<username>[\d\D@][^ ]*), MAC : (?P<mac>[a-z\d:]*)"
matches = re.finditer(regex, data)
for match in matches:
    my_data = match.group('username', 'mac')
    print(' '.join(my_data))

Output:
0221453122@ttml ac:f1:df:ea:4c:26
0220367961@ttml 00:17:7c:75:b6:05
4010059315 08:60:6e:c9:dd:9a
0200400681@ttml 5c:f4:ab:1f:3a:ec

here is nice regex test site
https://regex101.com/

---

you can have regex pattern simplified as r"USERNAME : (?P<username>\S*), MAC : (?P<mac>[\S]{17})"

[anna]

Thanks Buran.... was struggling to solve this issue, once again you help me. Thanks Ton.

---

possible to add

REPLY MESSAGE : Account is not active ... messages

pattern in RegEX

[buran]

I already provided solution in my post#14
I will leave to you to amend the regex if you would like to use that approach