正则
(?<logstream_country_isp_province>\d+\.\d+\.\d+\.\d+).*? \[(?<logstream_timestamp>\d+\/\w+\/\d+:\d+:\d+:\d+).*? \"(?<http_method>\S+) .*?v.gif\?.*?(?:media_type=(?<media_type>\d+)&|page_type=(?<page_type>\d+)&|channel_type=(?<channel_type>\d+)&|mod=(?<mod>\w+)&|page=(?<page>\d+)&|play_time=(?<play_time>\d+)&|.+?=[\w]*&)+
测试字符串
60.9.140.7 - - [04/Jul/2017:18:00:00 +0800] "GET /feed/v.gif?media_type=1&channel_type=4&page=1&page_type=1&mod=recommend&pd=feed&type=1&index=1&stime=1499162393854&refer=&play_time=0&showInfo=%5B%7B%22locid%22%3A%22http%3A%2F%2Fwww.internal.video.baidu.com%2F54b1df58f5c3d941553a705e38c49e39.html%22%2C%22index%22%3A%222%22%7D%5D&cache_t=1499162395174 HTTP/1.1"
语法解释:
?: (...)的不分组的版本
.*?v.gif\?.*? 不能写成 .*?v.gif.*? 否则因为是非贪婪匹配,即前面会尽量少的匹配,把匹配工作交给后面(导致.+?=[\w]*&会把?media_type=1&匹配掉,media_type分组采集不到)