Question

I have this string “IP 1.2.3.4 is currently trusted in the white list, but it is now using a new trusted certificate.” in a log file. What I need to do is look for this message and extract the IP address (1.2.3.4) from the log file.

import os
import shutil
import optparse
import sys

def main():
    file = open("messages", "r")
    log_data = file.read()
    file.close()

    search_str = "is currently trusted in the white list, but it is now using a new trusted certificate."

    index = log_data.find(search_str)
    print index

    return

if __name__ == '__main__':
    main()

How do I extract the IP address? Your response is appreciated.

Answer 1

Use regular expressions.

Code like this:

import re

compiled = re.compile(r"""
    .*?                                # Leading junk
    (?P<ipaddress>\d+\.\d+\.\d+\.\d+)  # IP address
    .*?                                # Trailing junk
    """, re.VERBOSE)
str = "IP 1.2.3.4 is currently trusted in the white list, but it is now using a new trusted certificate."
m = compiled.match(str)
print m.group("ipaddress")

And you get this:

>>> import re
>>> 
>>> compiled = re.compile(r"""
...     .*?                                # Leading junk
...     (?P<ipaddress>\d+\.\d+\.\d+\.\d+)  # IP address
...     .*?                                # Trailing junk
...     """, re.VERBOSE)
>>> str = "IP 1.2.3.4 is currently trusted in the white list, but it is now using a new trusted certificate."
>>> m = compiled.match(str)
>>> print m.group("ipaddress")
1.2.3.4

Also, I learned there there is a dictionary of matches, groupdict():

>>>> str = "Peer 10.11.6.224 is currently trusted in the white list, but it is now using a new trusted certificate. Consider removing its likely outdated white list entry."
>>>> m = compiled.match(str)
>>>> print m.groupdict()
{'ipaddress': '10.11.6.224'}

---

Later: fixed that. The initial ‘.*’ was eating your first character match. Changed it to be non-greedy. For consistency (but not necessity), I changed the trailing match, too.