从C＃中的syslog固定行中扩展JSON

Question

我正在尝试解析syslog（或类似syslog的）响应，以仅提取JSON

<14>1 09 30 2019 15:34:37 UTC logsource {"somejson": "thejson", "details": {"detail1": detail, "detail2": detail"}}

<14>1 09 30 2019 15:34:37 UTC logsource {"somejson": "thejson", "details": {"detail1": detail, "detail2": detail"}}

<14>1 09 30 2019 15:34:37 UTC logsource {"somejson": "thejson", "details": {"detail1": detail, "detail2": detail"}}

我想删除“ <14> 1 09 30 2019 15:34:37 UTC日志源”前缀，以便剩余的数据是有效的JSON，因此我可以将每一行发送到数据库。我认为输出看起来像这样：

{
    "body" [
        {
            "somejson": "thejson",
            "details": {
                "detail1": details,
                "detail2": details.
            }
        },
        {
            "somejson": "thejson",
            "details": {
                "detail1": details,
                "detail2": details.
            }
        },
        {
            "somejson": "thejson",
            "details": {
                "detail1": details,
                "detail2": details.
            }
        }
    ]
}

也许我可以遍历原始数据并使用String替换字符串。以某种方式替换？我非常感谢您的帮助，即使它正指向正确的方向。

Answer 1

一种方法是使用Newtonsoft.Json。切掉不需要的日志前缀后，可以将字符串解析为JObject。我还继续删除了输入中的空白行。这是我用来执行此操作的代码：

using System;
using System.Linq;
using System.IO;
using Newtonsoft.Json.Linq;

namespace extractingJSONSyslogQuestion
{
    class Program
    {
        static void Main(string[] args)
        {
            var input = File.ReadAllText("test.txt");
            var lines = input.Split("\n");

            // Remove blank lines
            lines = lines.Where(l => !string.IsNullOrEmpty(l)).ToArray();

            foreach(var line in lines) {
                // Get rid of log prefix
                var data = line.Substring(line.IndexOf("{"));
                var json = JObject.Parse(data);
                Console.WriteLine(json);
            }
        }
    }
}

这里是我使用的输入文件。注意，我在字符串“ detail”周围添加了双引号，以使其成为有效的json：

<14>1 09 30 2019 15:34:37 UTC logsource {"somejson": "thejson", "details": {"detail1": "detail", "detail2": "detail"}}

<14>1 09 30 2019 15:34:37 UTC logsource {"somejson": "thejson", "details": {"detail1": "detail", "detail2": "detail"}}

<14>1 09 30 2019 15:34:37 UTC logsource {"somejson": "thejson", "details": {"detail1": "detail", "detail2": "detail"}

最后，这是我程序的输出：

{
  "somejson": "thejson",
  "details": {
    "detail1": "detail",
    "detail2": "detail"
  }
}
{
  "somejson": "thejson",
  "details": {
    "detail1": "detail",
    "detail2": "detail"
  }
}
{
  "somejson": "thejson",
  "details": {
    "detail1": "detail",
    "detail2": "detail"
  }
}

如果您发表评论，我很乐意更详细地回答有关代码的任何问题。