Parse Apache log in PHP using preg_match

Question

I need to save data in a table (for reporting, stats etc...) so a user can search by time, user agent etc. I have a script that runs every day that reads the Apache Log and then insert it in the database. Log format: ``` 10.1.1.150 - - [29/September/2011:14:21:49 -0400] "GET /info/ HTTP/1.1" 200 9955 "http://www.domain.com/download/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; de-at) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1" ``` My regex: ``` preg_match('/^(\S+) (\S+) (\S+) $$([^:]+):(\d+:\d+:\d+) ([^$$]+)\] "(\S+) (.*?) (\S+)" (\S+) (\S+) (".*?") (".*?")$/',$log, $matches); ``` Now when I print: ``` print_r($matches); Array ( [0] => 10.1.1.150 - - [29/September/2011:14:21:49 -0400] "GET /info/ HTTP/1.1" 200 9955 "http://www.domain.com/download/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; de-at) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1" [1] => 10.1.1.150 [2] => - [3] => - [4] => 29/September/2011 [5] => 1…

Accepted Answer

To parse an Apache `access_log` log in PHP you can use this regex:

```
$regex = '/^(\S+) (\S+) (\S+) $$([^:]+):(\d+:\d+:\d+) ([^$$]+)\] "(\S+) (.*?) (\S+)" (\S+) (\S+) "([^"]*)" "([^"]*)"$/';
preg_match($regex ,$log, $matches);
```

To match the Apache `error_log` format, you can use this regex:

```
$regex = '/^$$([^$$]+)\] $$([^$$]+)\] (?:$$client ([^$$]+)\])?\s*(.*)$/i';
preg_match($regex, $log, $matches);
$matches[1] = Date and time,           $matches[2] = severity,
$matches[3] = client addr (if present) $matches[4] = log message
```

It matches lines with or without the client:

```
[Tue Feb 28 11:42:31 2012] [notice] Apache/2.4.1 (Unix) mod_ssl/2.4.1 OpenSSL/0.9.8k PHP/5.3.10 configured -- resuming normal operations
[Tue Feb 28 14:34:41 2012] [error] [client 192.168.50.10] Symbolic link not allowed or link target not accessible: /usr/local/apache2/htdocs/x.js
```

Parse Apache log in PHP using preg_match

Solution

Problem