(?<logstream_country_isp_province>d+.d+.d+.d+).*? [(?<logstream_timestamp>d+/w+/d+:d+:d+:d+).*? "(?<http_method>S+) .*?v.gif?.*?(?:media_type=(?<media_type>d+)&|page_type=(?<page_type>d+)&|channel_type=(?<channel_type>d+)&|mod=(?<mod>w+)&|page=(?<page>d+)&|play_time=(?<play_time>d+)&|.+?=[w]*&)+
测试字符串
60.9.140.7 - - [04/Jul/2017:18:00:00 +0800] "GET /feed/v.gif?media_type=1&channel_type=4&page=1&page_type=1&mod=recommend&pd=feed&type=1&index=1&stime=1499162393854&refer=&play_time=0&showInfo=%5B%7B%22locid%22%3A%22http%3A%2F%2Fwww.internal.video.baidu.com%2F54b1df58f5c3d941553a705e38c49e39.html%22%2C%22index%22%3A%222%22%7D%5D&cache_t=1499162395174 HTTP/1.1"
语法解释:
?: (...)的不分组的版本
.*?v.gif?.*? 不能写成 .*?v.gif.*? 否则因为是非贪婪匹配,即前面会尽量少的匹配,把匹配工作交给后面(导致.+?=[w]*&会把?media_type=1&匹配掉,media_type分组采集不到)