使用Python处理日志文件：拆分事件行并移除指定元素

针对你需要拆分日志、移除"EventX":标识的需求，这里提供两种实用的Python方案：

方法一：正则表达式快速处理 #

适合格式固定的简单日志，直接匹配并提取目标内容：

import re

# 替换为你的日志文件读取逻辑，比如with open(...) as f: log_content = f.read()
log_content = '''"Event1":{"Time":"2022-12-16 16:04:16","Username":"IAmUser1@gmail.com","IP_Address":"1.1.1.1","Action":"Action1","Data":"Datahere"},"Event2":{"Time":"2022-12-16 16:03:59","Username":"IAmUser2@gmail.com","IP_Address":"1.1.1.1","Action":"Action2","Data":"Datahere"},"Event3":{"Time":"2022-12-16 15:54:56","Username":"IAmUser3@gmail.com","IP_Address":"1.1.1.1","Action":"Action3","Data":"Datahere"},'''

# 匹配"EventX":{...}结构，提取{}内的事件内容
pattern = r'"Event\d+":(\{.*?\})(?:,|$)'
events = re.findall(pattern, log_content, re.DOTALL)

# 逐行输出事件
for event in events:
    print(event)

正则说明：

• "Event\d+": 精准匹配"Event"+数字+冒号的标识部分
• (\{.*?\}) 非贪婪捕获{}包裹的完整事件内容，避免跨事件匹配
• (?:,|$) 匹配事件后的分隔逗号或文本结尾，不捕获该部分

方法二：JSON解析（更可靠） #

如果日志本质是JSON片段，用官方JSON库解析更稳妥，能处理复杂嵌套结构：

import json

log_content = '''"Event1":{"Time":"2022-12-16 16:04:16","Username":"IAmUser1@gmail.com","IP_Address":"1.1.1.1","Action":"Action1","Data":"Datahere"},"Event2":{"Time":"2022-12-16 16:03:59","Username":"IAmUser2@gmail.com","IP_Address":"1.1.1.1","Action":"Action2","Data":"Datahere"},"Event3":{"Time":"2022-12-16 15:54:56","Username":"IAmUser3@gmail.com","IP_Address":"1.1.1.1","Action":"Action3","Data":"Datahere"},'''

# 补全为合法JSON格式：移除末尾多余逗号，前后包裹{}
cleaned_json = '{' + log_content.rstrip(',') + '}'
# 解析为Python字典
event_data = json.loads(cleaned_json)

# 遍历输出每个事件的JSON字符串
for event in event_data.values():
    print(json.dumps(event))

优势：无需担心正则匹配的边界问题，自动处理JSON格式的细节，输出内容格式标准。

内容的提问来源于stack exchange，提问作者Dmitry